Checks for expiring RunAs accounts and their passwords
The specified RunAs account is expiring (or its password is expiring). If the account or password expires, the Health Service will not be able to monitor or perform actions using this RunAs account.
Below is a summary of the default configuration of this monitor:
Red state : Transition to red state if the specified RunAs account (event 7014) or its password (event 7001) will expire in less than 3 days
Yellow state: Transition to yellow state if the specified RunAs account (event 7014) or its password (event 7001) will expire soon (in 4 days or more)
Green state : Transition to green state if the Health Service has successfully validated all RunAs accounts (except the unauthorized ones) (event 7019 or 7020) or if the Health Service failed to validate any RunAs accounts (event 7021)
The red (or yellow) state can indicate that the following might be happening on the agent:
The specified RunAs account is expiring. If the account expiration is not extended before expiry, the Health Service will not be able to monitor or perform actions using this RunAs account.
The password for the specified RunAs account is expiring. If the password is not updated before the expiry date, the Health Service will not be able to monitor or perform actions using this RunAs account.
You can perform the following steps to resolve the problem or to gather data prior to seeking assistance from Microsoft product support:
Extend the account (update the account password) in Active Directory (for domain accounts) or on the local computer (for local accounts).
Capture all 7### events, save the Service Manager event log (named Operations Manager) on the management server and call Microsoft product support. During the support call, mention the most recent 7### events and any error codes (e.g. event 7022) inside the event and ask if the Service Manager event log is needed.
Target | Microsoft.SystemCenter.ServiceManager.ManagementServer | ||
Parent Monitor | Microsoft.ServiceManager.HealthServiceRunAsAccounts.Rollup | ||
Category | StateCollection | ||
Enabled | True | ||
Alert Generate | True | ||
Alert Severity | Error | ||
Alert Priority | Normal | ||
Alert Auto Resolve | True | ||
Monitor Type | Microsoft.Windows.3SingleEventLog3StateUnitMonitorType | ||
Remotable | True | ||
Accessibility | Public | ||
Alert Message |
| ||
RunAs | Default |
<UnitMonitor ID="Microsoft.ServiceManager.HealthServiceRunAsAccounts.ExpirationCheck.Unit" Accessibility="Public" Enabled="true" Target="SM!Microsoft.SystemCenter.ServiceManager.ManagementServer" ParentMonitorID="Microsoft.ServiceManager.HealthServiceRunAsAccounts.Rollup" Remotable="true" Priority="Normal" TypeID="Windows!Microsoft.Windows.3SingleEventLog3StateUnitMonitorType" ConfirmDelivery="true">
<Category>StateCollection</Category>
<AlertSettings AlertMessage="Microsoft.ServiceManager.HealthServiceRunAsAccounts.ExpirationCheck.Unit.AlertMessage">
<AlertOnState>Error</AlertOnState>
<AutoResolve>true</AutoResolve>
<AlertPriority>Normal</AlertPriority>
<AlertSeverity>Error</AlertSeverity>
<AlertParameters>
<AlertParameter1>$Data/Context/EventDescription$</AlertParameter1>
</AlertParameters>
</AlertSettings>
<OperationalStates>
<OperationalState ID="AccountsExpiringVerySoon" MonitorTypeStateID="FirstEventRaised" HealthState="Error"/>
<OperationalState ID="AccountsExpiringSoon" MonitorTypeStateID="SecondEventRaised" HealthState="Warning"/>
<OperationalState ID="NoAccountsExpiring" MonitorTypeStateID="ThirdEventRaised" HealthState="Success"/>
</OperationalStates>
<Configuration>
<FirstComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</FirstComputerName>
<FirstLogName>Operations Manager</FirstLogName>
<FirstExpression>
<And>
<Expression>
<Or>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="UnsignedInteger">7001</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="UnsignedInteger">7014</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</Or>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="String">PublisherName</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="String">HealthService</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<Value Type="String">$Target/Property[Type="SM!Microsoft.SystemCenter.ServiceManager.ManagementServer"]/ManagementGroupName$</Value>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<XPathQuery Type="String">Params/Param[5]</XPathQuery>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="UnsignedInteger">Params/Param[4]</XPathQuery>
</ValueExpression>
<Operator>LessEqual</Operator>
<ValueExpression>
<Value Type="UnsignedInteger">3</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</And>
</FirstExpression>
<SecondComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</SecondComputerName>
<SecondLogName>Operations Manager</SecondLogName>
<SecondExpression>
<And>
<Expression>
<Or>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="UnsignedInteger">7001</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="UnsignedInteger">7014</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</Or>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="String">PublisherName</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="String">HealthService</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<Value Type="String">$Target/Property[Type="SM!Microsoft.SystemCenter.ServiceManager.ManagementServer"]/ManagementGroupName$</Value>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<XPathQuery Type="String">Params/Param[5]</XPathQuery>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="UnsignedInteger">Params/Param[4]</XPathQuery>
</ValueExpression>
<Operator>Greater</Operator>
<ValueExpression>
<Value Type="UnsignedInteger">3</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</And>
</SecondExpression>
<ThirdComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ThirdComputerName>
<ThirdLogName>Operations Manager</ThirdLogName>
<ThirdExpression>
<And>
<Expression>
<Or>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="UnsignedInteger">7019</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="UnsignedInteger">7020</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="UnsignedInteger">7021</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</Or>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="String">PublisherName</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="String">HealthService</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<Value Type="String">$Target/Property[Type="SM!Microsoft.SystemCenter.ServiceManager.ManagementServer"]/ManagementGroupName$</Value>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<XPathQuery Type="String">Params/Param[1]</XPathQuery>
</ValueExpression>
</SimpleExpression>
</Expression>
</And>
</ThirdExpression>
</Configuration>
</UnitMonitor>