User has exceeded the maximum allowable number of postbacks

Microsoft.Office.Sharepoint.Server.2007.User_has_exceeded_the_maximum_allowable_number_of_postbacks (Rule)

A user has exceeded the maximum number of postbacks configured for InfoPath Forms Services. When this condition occurs, InfoPath Forms Services terminates the user session to protect the server.

Knowledge Base article:

Summary

This alert indicates that a user has exceeded the maximum number of postbacks configured for InfoPath Forms Services. When this condition occurs, InfoPath Forms Services terminates the user session to protect the server.

Causes

The number of postbacks configured for InfoPath Forms Services can be exceeded when a user attempts a denial of service (DoS) attack against a server running InfoPath Forms Services.

Resolutions

Review the Windows NT Event log to determine whether the error was caused by a denial of service (DoS) attack. If the problem is not caused by a DoS attack, use the Configure InfoPath Forms Services page in Central Administration to increase the number of postbacks per form session state.

Element properties:

Target

Microsoft.Office.Sharepoint.Server.2007.MOSS.Application

Category

EventCollection

Enabled

True

Event_ID

5736

Event Source

Office SharePoint Server

Alert Generate

True

Alert Severity

Information

Alert Priority

Normal

Remotable

True

Alert Message

User has exceeded the maximum allowable number of postbacks

Event ID {0} from Source {2} on agent computer {3} has triggered this Alert Description : {1}

Event Log

Application

Member Modules:

ID	Module Type	TypeId	RunAs
DS	DataSource	Microsoft.Windows.EventProvider	Default
CollectData	WriteAction	Microsoft.SystemCenter.CollectEvent	Default
DataWarehousePublishData	WriteAction	Microsoft.SystemCenter.DataWarehouse.PublishEventData	Default
MOSS.GenerateAlert	WriteAction	System.Health.GenerateAlert	Default

Source Code:

<Rule ID="Microsoft.Office.Sharepoint.Server.2007.User_has_exceeded_the_maximum_allowable_number_of_postbacks" Enabled="onEssentialMonitoring" Target="Microsoft.Office.Sharepoint.Server.2007.MOSS.Application" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>EventCollection</Category>

  <DataSources>

    <DataSource ID="DS" TypeID="MSWL!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Host/Property[Type="MSWL!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>Application</LogName>

      <Expression>

        <And>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="Integer">EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>5736</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="String">PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>Office SharePoint Server</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="CollectData" TypeID="SystemCenter!Microsoft.SystemCenter.CollectEvent"/>

    <WriteAction ID="DataWarehousePublishData" TypeID="SCDW!Microsoft.SystemCenter.DataWarehouse.PublishEventData"/>

    <WriteAction ID="MOSS.GenerateAlert" TypeID="Health!System.Health.GenerateAlert">

      <Priority>1</Priority>

      <Severity>0</Severity>

      <AlertMessageId>$MPElement[Name="Microsoft.Office.Sharepoint.Server.2007.User_has_exceeded_the_maximum_allowable_number_of_postbacks.AlertMessageID"]$</AlertMessageId>

      <AlertParameters>

        <AlertParameter1>$Data/EventDisplayNumber$</AlertParameter1>

        <AlertParameter2>$Data/EventDescription$</AlertParameter2>

        <AlertParameter3>$Data/PublisherName$</AlertParameter3>

        <AlertParameter4>$Target/Host/Property[Type="MSWL!Microsoft.Windows.Computer"]/NetworkName$</AlertParameter4>

      </AlertParameters>

      <Suppression>

        <SuppressionValue>$Data/EventDisplayNumber$</SuppressionValue>

        <SuppressionValue>$Data/PublisherName$</SuppressionValue>

        <SuppressionValue>$Data/LoggingComputer$</SuppressionValue>

        <SuppressionValue>$Data/EventDescription$</SuppressionValue>

      </Suppression>

    </WriteAction>

  </WriteActions>

</Rule>