Centralized Logging Service Agent Trace events buffers lost
%1 buffers could not be delivered to Centralized Logging Service Agent. Most likely cause - traces are getting produced at a rate higher than Centralized Logging Service Agent can consume. Event 33029 will be raised when buffers stop from getting lost
Stop on-demand scenario if running. If this does not solve the issue stop always on tracing. Consider reviewing the component tracing heavily in bursts
Target | Microsoft.LS.2019.Component.ClsAgent | ||
Parent Monitor | System.Health.AvailabilityState | ||
Category | AvailabilityHealth | ||
Enabled | True | ||
Alert Generate | True | ||
Alert Severity | Error | ||
Alert Priority | High | ||
Alert Auto Resolve | True | ||
Monitor Type | Microsoft.LS.2019.MonitorType.PairedEvent.Simple | ||
Remotable | True | ||
Accessibility | Public | ||
Alert Message |
| ||
RunAs | Default |
<UnitMonitor ID="Microsoft.LS.2019.Monitoring.UnitMonitor.PairedEvent.ClsAgent.CLSAGENT_E_LOSING_BUFFERS" Accessibility="Public" Enabled="true" Target="SFBDiscovery!Microsoft.LS.2019.Component.ClsAgent" ParentMonitorID="Health!System.Health.AvailabilityState" Remotable="true" Priority="Normal" TypeID="Microsoft.LS.2019.MonitorType.PairedEvent.Simple" ConfirmDelivery="true">
<Category>AvailabilityHealth</Category>
<AlertSettings AlertMessage="Alert_Centralized_Logging_Service_Agent_Trace_events_buffers_lost">
<AlertOnState>Error</AlertOnState>
<AutoResolve>true</AutoResolve>
<AlertPriority>High</AlertPriority>
<AlertSeverity>Error</AlertSeverity>
<AlertParameters>
<AlertParameter1>$Data/Context/EventDescription$</AlertParameter1>
</AlertParameters>
</AlertSettings>
<OperationalStates>
<OperationalState ID="Microsoft.LS.2019.Monitoring.UnitMonitor.PairedEvent.ClsAgent.CLSAGENT_E_LOSING_BUFFERS.Success" MonitorTypeStateID="SuccessEventRaised" HealthState="Success"/>
<OperationalState ID="Microsoft.LS.2019.Monitoring.UnitMonitor.PairedEvent.ClsAgent.CLSAGENT_E_LOSING_BUFFERS.Error" MonitorTypeStateID="ErrorEventRaised" HealthState="Error"/>
</OperationalStates>
<Configuration>
<ComputerName>$Target/Host/Host/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>
<LogName>Lync Server</LogName>
<SuccessExpression>
<Or>
<Expression>
<And>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="UnsignedInteger">33029</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="String">PublisherName</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="String">LS Centralized Logging Agent</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</And>
</Expression>
<Expression>
<And>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="UnsignedInteger">33002</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="String">PublisherName</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="String">LS Centralized Logging Agent</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</And>
</Expression>
</Or>
</SuccessExpression>
<ErrorExpression>
<And>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="UnsignedInteger">33028</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="String">PublisherName</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="String">LS Centralized Logging Agent</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</And>
</ErrorExpression>
</Configuration>
</UnitMonitor>