Centralized Logging Service Agent Log Disk Space

Microsoft.LS.2019.Monitoring.UnitMonitor.PairedEvent.ClsAgent.CLSAGENT_E_LOSING_TRACES (UnitMonitor)

Knowledge Base article:

Summary

Centralized Logging Service Agent Local logs being deleted and unable to move to network share

Causes

Centralized Logging Service Agent has reached local disk usage threshold or few of the old logs have exceeded the Cache File Local Retention Period and there is error moving logs to network share. Logs are getting lost permanently

Resolutions

- Check network share is configured and is accessible%n- Free up network disk space

Element properties:

Target

Microsoft.LS.2019.Component.ClsAgent

Parent Monitor

System.Health.AvailabilityState

Category

AvailabilityHealth

Enabled

True

Alert Generate

True

Alert Severity

Error

Alert Priority

High

Alert Auto Resolve

True

Monitor Type

Microsoft.LS.2019.MonitorType.PairedEvent.Simple

Remotable

True

Accessibility

Public

Alert Message

[Skype] Centralized Logging Service Agent Local logs being deleted and unable to move to network share

{0}

Please see the 'Product Knowledge' and the 'Alert Context' tab on Alert Properties view for more information.

RunAs

Default

Source Code:

<UnitMonitor ID="Microsoft.LS.2019.Monitoring.UnitMonitor.PairedEvent.ClsAgent.CLSAGENT_E_LOSING_TRACES" Accessibility="Public" Enabled="true" Target="SFBDiscovery!Microsoft.LS.2019.Component.ClsAgent" ParentMonitorID="Health!System.Health.AvailabilityState" Remotable="true" Priority="Normal" TypeID="Microsoft.LS.2019.MonitorType.PairedEvent.Simple" ConfirmDelivery="true">

  <Category>AvailabilityHealth</Category>

  <AlertSettings AlertMessage="Alert_Centralized_Logging_Service_Agent_Local_logs_being_deleted_and_unable_to_move_to_network_share">

    <AlertOnState>Error</AlertOnState>

    <AutoResolve>true</AutoResolve>

    <AlertPriority>High</AlertPriority>

    <AlertSeverity>Error</AlertSeverity>

    <AlertParameters>

      <AlertParameter1>$Data/Context/EventDescription$</AlertParameter1>

    </AlertParameters>

  </AlertSettings>

  <OperationalStates>

    <OperationalState ID="Microsoft.LS.2019.Monitoring.UnitMonitor.PairedEvent.ClsAgent.CLSAGENT_E_LOSING_TRACES.Success" MonitorTypeStateID="SuccessEventRaised" HealthState="Success"/>

    <OperationalState ID="Microsoft.LS.2019.Monitoring.UnitMonitor.PairedEvent.ClsAgent.CLSAGENT_E_LOSING_TRACES.Error" MonitorTypeStateID="ErrorEventRaised" HealthState="Error"/>

  </OperationalStates>

  <Configuration>

    <ComputerName>$Target/Host/Host/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

    <LogName>Lync Server</LogName>

    <SuccessExpression>

      <Or>

        <Expression>

          <And>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="UnsignedInteger">33027</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="String">PublisherName</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="String">LS Centralized Logging Agent</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

          </And>

        </Expression>

        <Expression>

          <And>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="UnsignedInteger">33002</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="String">PublisherName</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="String">LS Centralized Logging Agent</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

          </And>

        </Expression>

      </Or>

    </SuccessExpression>

    <ErrorExpression>

      <And>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="UnsignedInteger">33026</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="String">PublisherName</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="String">LS Centralized Logging Agent</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

      </And>

    </ErrorExpression>

  </Configuration>

</UnitMonitor>