无端对端事件已 45 分钟（严重级别）

Microsoft.SystemCenter.AgentManagement.EndToEndEventMonitorError (UnitMonitor)

此监视器检测本地 System Center 管理运行状况服务是否能够在最近 45 分钟内记录事件作为综合事务，以检查 System Center 管理运行状况服务处理事件的能力。

Knowledge Base article:

摘要

此监视器检测是否未检测到定期记录的事件。与此监视器关联的规则是“Log Distributed Workflow Test Event”。如果禁用“Log Distributed Workflow Test Event”规则，或者将阈值配置得太高，则可能导致此监视器更改状态或生成警报。

配置

默认配置为在 45 分钟内未检测到预期事件时进入错误状态。

原因

如果将事件记录到 Windows 事件日志时出现问题或者从事件日志读取和收集此事件时出现问题，则可能导致此情形。

解决方法

在 Operations Manager 事件日志中检查 LogEndToEndEvent.js 脚本是否存在任何脚本错误。此脚本记录此监视器检测到的事件。

如果不存在脚本错误，则检查 Windows 事件日志模块是否存在错误，导致从 Operations Manager 事件日志读取时出现问题；这可能是由于操作帐户没有权限从事件日志执行写入或读取操作引起的。

Element properties:

Target	Microsoft.SystemCenter.HealthService
Parent Monitor	Microsoft.SystemCenter.AgentManagement.EndToEndEventMonitorRollup
Category	Custom
Enabled	False
Alert Generate	False
Alert Auto Resolve	True
Monitor Type	Microsoft.Windows.MissingEventLogSingleEventLog2StateMonitorType
Remotable	True
Accessibility	Public
RunAs	Default

Source Code:

<UnitMonitor ID="Microsoft.SystemCenter.AgentManagement.EndToEndEventMonitorError" Accessibility="Public" Enabled="false" Target="SCLibrary!Microsoft.SystemCenter.HealthService" ParentMonitorID="Microsoft.SystemCenter.AgentManagement.EndToEndEventMonitorRollup" Remotable="true" Priority="Normal" TypeID="Windows!Microsoft.Windows.MissingEventLogSingleEventLog2StateMonitorType" ConfirmDelivery="false">

  <Category>Custom</Category>

  <OperationalStates>

    <OperationalState ID="EventFound" MonitorTypeStateID="EventRaised" HealthState="Success"/>

    <OperationalState ID="MissingFor45Min" MonitorTypeStateID="MissingEventRaised" HealthState="Error"/>

  </OperationalStates>

  <Configuration>

    <ComputerName>.</ComputerName>

    <LogName>Operations Manager</LogName>

    <Expression>

      <And>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="UnsignedInteger">6022</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="String">PublisherName</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="String">Health Service Script</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

      </And>

    </Expression>

    <MissingComputerName>.</MissingComputerName>

    <MissingLogName>Operations Manager</MissingLogName>

    <MissingExpression>

      <And>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="UnsignedInteger">6022</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="String">PublisherName</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="String">Health Service Script</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

      </And>

    </MissingExpression>

    <Consolidator>

      <ConsolidationProperties/>

      <TimeControl>

        <GenericSchedule>

          <SimpleReccuringSchedule>

            <Interval Unit="Minutes">45</Interval>

          </SimpleReccuringSchedule>

          <ExcludeDates/>

        </GenericSchedule>

      </TimeControl>

      <CountingCondition>

        <CountMode>OnNewItemNOP_OnTimerOutputRestart</CountMode>

      </CountingCondition>

    </Consolidator>

  </Configuration>

</UnitMonitor>