The Microsoft Distributed Transaction Coordinator Service Log is read-only

Microsoft.MSDTC.6.3.MicrosoftDistributedTransactionCoordinatorServiceLogAvailability.Application.RemovethereadonlyattributefromtheMSDTClog (UnitMonitor)

Knowledge Base article:

Summary

Microsoft Distributed Transaction Coordinator Service Log Availability

The system indicates that the log file for the Microsoft Distributed Transaction Coordinator service (MSDTC) is read only. The administrator need to remove the read-only attribute from the MSDTC log file.

Causes

The log file for the Microsoft Distributed Transaction Coordinator service (MSDTC) is read only.

Resolutions

Remove the read-only attribute from the MSDTC log

The system indicates that the log file for the Microsoft Distributed Transaction Coordinator service (MSDTC) is read only. Find the log file. By default, the log file is located in the \windows\system32 folder. When you locate the log file, remove the read-only file attribute.

Administrators

To open Component Services and find the location of the MSDTC log file:

Click Start, and then click Run.
comexp.msc
Click Component Services, click Computers, click My Computer, click Distributed Transaction Coordinator, and then click Local DTC.
Right-click the Local DTC, and then click Properties.
In the Local DTC properties dialog box, click the Logging tab. Under Log Information, find the path in Location to identify the current drive and location of the log file. By default, the log file is located in the \windows\system32 folder.

Element properties:

Target

Microsoft.MSDTC.6.3.Servers

Parent Monitor

System.Health.AvailabilityState

Category

StateCollection

Enabled

True

Alert Generate

True

Alert Severity

MatchMonitorHealth

Alert Priority

Normal

Alert Auto Resolve

True

Monitor Type

Microsoft.Windows.2SingleEventLog2StateMonitorType

Remotable

True

Accessibility

Public

Alert Message

Microsoft Distributed Transaction Coordinator Service Log Availability Alert (Remove the read only attribute from the MSDTC log)

RunAs

Default

Source Code:

<UnitMonitor ID="Microsoft.MSDTC.6.3.MicrosoftDistributedTransactionCoordinatorServiceLogAvailability.Application.RemovethereadonlyattributefromtheMSDTClog" Accessibility="Public" Enabled="onEssentialMonitoring" Target="Microsoft.MSDTC.6.3.Servers" ParentMonitorID="SystemHealth!System.Health.AvailabilityState" Remotable="true" Priority="Normal" TypeID="Windows!Microsoft.Windows.2SingleEventLog2StateMonitorType" ConfirmDelivery="true">

  <Category>StateCollection</Category>

  <AlertSettings AlertMessage="Microsoft.MSDTC.6.3.MicrosoftDistributedTransactionCoordinatorServiceLogAvailability.Application.RemovethereadonlyattributefromtheMSDTClog.AlertMessage">

    <AlertOnState>Error</AlertOnState>

    <AutoResolve>true</AutoResolve>

    <AlertPriority>Normal</AlertPriority>

    <AlertSeverity>MatchMonitorHealth</AlertSeverity>

    <AlertParameters>

      <AlertParameter1>$Data/Context/EventDescription$</AlertParameter1>

    </AlertParameters>

  </AlertSettings>

  <OperationalStates>

    <OperationalState ID="Success" MonitorTypeStateID="FirstEventRaised" HealthState="Success"/>

    <OperationalState ID="Negative" MonitorTypeStateID="SecondEventRaised" HealthState="Error"/>

  </OperationalStates>

  <Configuration>

    <FirstComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</FirstComputerName>

    <FirstLogName>Application</FirstLogName>

    <FirstExpression>

      <Or>

        <Expression>

          <Or>

            <Expression>

              <Or>

                <Expression>

                  <Or>

                    <Expression>

                      <And>

                        <Expression>

                          <SimpleExpression>

                            <ValueExpression>

                              <XPathQuery>PublisherName</XPathQuery>

                            </ValueExpression>

                            <Operator>Equal</Operator>

                            <ValueExpression>

                              <Value>Microsoft-Windows-MSDTC</Value>

                            </ValueExpression>

                          </SimpleExpression>

                        </Expression>

                        <Expression>

                          <SimpleExpression>

                            <ValueExpression>

                              <XPathQuery>EventDisplayNumber</XPathQuery>

                            </ValueExpression>

                            <Operator>Equal</Operator>

                            <ValueExpression>

                              <Value>4142</Value>

                            </ValueExpression>

                          </SimpleExpression>

                        </Expression>

                      </And>

                    </Expression>

                    <Expression>

                      <And>

                        <Expression>

                          <SimpleExpression>

                            <ValueExpression>

                              <XPathQuery>PublisherName</XPathQuery>

                            </ValueExpression>

                            <Operator>Equal</Operator>

                            <ValueExpression>

                              <Value>Microsoft-Windows-MSDTC</Value>

                            </ValueExpression>

                          </SimpleExpression>

                        </Expression>

                        <Expression>

                          <SimpleExpression>

                            <ValueExpression>

                              <XPathQuery>EventDisplayNumber</XPathQuery>

                            </ValueExpression>

                            <Operator>Equal</Operator>

                            <ValueExpression>

                              <Value>4446</Value>

                            </ValueExpression>

                          </SimpleExpression>

                        </Expression>

                      </And>

                    </Expression>

                  </Or>

                </Expression>

                <Expression>

                  <And>

                    <Expression>

                      <SimpleExpression>

                        <ValueExpression>

                          <XPathQuery>PublisherName</XPathQuery>

                        </ValueExpression>

                        <Operator>Equal</Operator>

                        <ValueExpression>

                          <Value>Microsoft-Windows-MSDTC</Value>

                        </ValueExpression>

                      </SimpleExpression>

                    </Expression>

                    <Expression>

                      <SimpleExpression>

                        <ValueExpression>

                          <XPathQuery>EventDisplayNumber</XPathQuery>

                        </ValueExpression>

                        <Operator>Equal</Operator>

                        <ValueExpression>

                          <Value>4447</Value>

                        </ValueExpression>

                      </SimpleExpression>

                    </Expression>

                  </And>

                </Expression>

              </Or>

            </Expression>

            <Expression>

              <And>

                <Expression>

                  <SimpleExpression>

                    <ValueExpression>

                      <XPathQuery>PublisherName</XPathQuery>

                    </ValueExpression>

                    <Operator>Equal</Operator>

                    <ValueExpression>

                      <Value>Microsoft-Windows-MSDTC</Value>

                    </ValueExpression>

                  </SimpleExpression>

                </Expression>

                <Expression>

                  <SimpleExpression>

                    <ValueExpression>

                      <XPathQuery>EventDisplayNumber</XPathQuery>

                    </ValueExpression>

                    <Operator>Equal</Operator>

                    <ValueExpression>

                      <Value>53252</Value>

                    </ValueExpression>

                  </SimpleExpression>

                </Expression>

              </And>

            </Expression>

          </Or>

        </Expression>

        <Expression>

          <And>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery>PublisherName</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value>Microsoft-Windows-MSDTC</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery>EventDisplayNumber</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value>53256</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

          </And>

        </Expression>

      </Or>

    </FirstExpression>

    <SecondComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</SecondComputerName>

    <SecondLogName>Application</SecondLogName>

    <SecondExpression>

      <Or>

        <Expression>

          <And>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery>PublisherName</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value>Microsoft-Windows-MSDTC</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery>EventDisplayNumber</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value>4126</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

          </And>

        </Expression>

        <Expression>

          <And>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery>PublisherName</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value>Microsoft-Windows-MSDTC</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery>EventDisplayNumber</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value>4135</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

          </And>

        </Expression>

      </Or>

    </SecondExpression>

  </Configuration>

</UnitMonitor>