No End to End Event for 45 Minutes (Critical Level)

Microsoft.SystemCenter.AgentManagement.EndToEndEventMonitorError (UnitMonitor)

This monitor detects if the local System Center Management Health Service was able to log an event in the last 45 minutes as a synthetic transaction to check the System Center Management Health Service's ability to process events.

Knowledge Base article:

Summary

This monitor detects if an event that is logged periodically is not detected. The rule associated with this monitor is "Log Distributed Workflow Test Event". If you disable the "Log Distributed Workflow Test Event" rule or configure too high of a threshold, it may cause this monitor to change state or generate an alert.

Configuration

The default configuration is to enter a error state when the expected event is not detected within 45 minutes.

Causes

This can be caused if there is problem logging events to the Windows Event Log or if there is a problem reading and collecting this event from the Event Log.

Resolutions

Check if there are any script errors in the Operations Manager event log for the LogEndToEndEvent.ps1 script. This script logs the event that this monitor detects.

If there is no script error, check if there are any errors with the Windows Event Log Module having problems reading from the Operations Manager event log; this may be caused by the Action Account not having permissions to either write to or read from the event log.

Element properties:

Target	Microsoft.SystemCenter.HealthService
Parent Monitor	Microsoft.SystemCenter.AgentManagement.EndToEndEventMonitorRollup
Category	Custom
Enabled	False
Alert Generate	False
Alert Auto Resolve	True
Monitor Type	Microsoft.Windows.MissingEventLogSingleEventLog2StateMonitorType
Remotable	True
Accessibility	Public
RunAs	Default

Source Code:

<UnitMonitor ID="Microsoft.SystemCenter.AgentManagement.EndToEndEventMonitorError" Accessibility="Public" Enabled="false" Target="SCLibrary!Microsoft.SystemCenter.HealthService" ParentMonitorID="Microsoft.SystemCenter.AgentManagement.EndToEndEventMonitorRollup" Remotable="true" Priority="Normal" TypeID="Windows!Microsoft.Windows.MissingEventLogSingleEventLog2StateMonitorType" ConfirmDelivery="false">

  <Category>Custom</Category>

  <OperationalStates>

    <OperationalState ID="EventFound" MonitorTypeStateID="EventRaised" HealthState="Success"/>

    <OperationalState ID="MissingFor45Min" MonitorTypeStateID="MissingEventRaised" HealthState="Error"/>

  </OperationalStates>

  <Configuration>

    <ComputerName>.</ComputerName>

    <LogName>Operations Manager</LogName>

    <Expression>

      <And>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="UnsignedInteger">6022</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="String">PublisherName</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="String">Health Service Script</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

      </And>

    </Expression>

    <MissingComputerName>.</MissingComputerName>

    <MissingLogName>Operations Manager</MissingLogName>

    <MissingExpression>

      <And>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="UnsignedInteger">6022</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="String">PublisherName</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="String">Health Service Script</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

      </And>

    </MissingExpression>

    <Consolidator>

      <ConsolidationProperties/>

      <TimeControl>

        <GenericSchedule>

          <SimpleReccuringSchedule>

            <Interval Unit="Minutes">45</Interval>

          </SimpleReccuringSchedule>

          <ExcludeDates/>

        </GenericSchedule>

      </TimeControl>

      <CountingCondition>

        <CountMode>OnNewItemNOP_OnTimerOutputRestart</CountMode>

      </CountingCondition>

    </Consolidator>

  </Configuration>

</UnitMonitor>