Client-side monitoring collection endpoint alerting rule for IIS Shared Configuration

Microsoft.SystemCenter.Apm.Infrastructure.Monitoring.CsmCollectorRemovalOnSharedIisRule (Rule)

This rule generates an alert when an event log contains a warning that suggests that a client-side monitoring collection endpoint might no longer be needed.

Knowledge Base article:

Summary

Turning off client-side monitoring in IIS Shared Configuration environments preserves the client-side monitoring collection IIS endpoint CSMCollector, which might be used by other monitored servers.

Causes

When you enable client-side monitoring, a single instance of CSMCollector is created automatically for each website that hosts at least one client-side monitored application. This endpoint is not needed for server-side monitoring or when monitoring is disabled. You can manually delete unused instances of CSMCollector with Internet Information Services (IIS) Manager. Turning off client-side monitoring automatically deletes the CSMCollector endpoint in environments that do not use IIS Shared Configuration.

Resolutions

Ensure that no servers sharing the same IIS configuration host applications that are monitored with client-side monitoring on the website specified by this alert:

If client-side monitoring is enabled for any application, keep the CSMCollector endpoint.
If no remaining applications have client-side monitoring enabled, you can manually delete unused instances of CSMCollector using Internet Information Services (IIS) Manager.

You can close this alert after ensuring that there are no unwanted instances of client-side monitoring collection endpoints configured in the IIS Shared Configuration.

Element properties:

Target

Microsoft.SystemCenter.Apm.ApmAgent

Category

Alert

Enabled

True

Alert Generate

True

Alert Severity

Warning

Alert Priority

Normal

Remotable

False

Alert Message

Client-side monitoring collection IIS endpoint is not removed

Disabling monitoring for {0} on website {1} did not remove the client-side monitoring collection IIS endpoint CSMCollector due to shared IIS configuration. If this endpoint is no longer used by other monitored servers, remove it from the shared IIS configuration using IIS management tools.

Member Modules:

ID	Module Type	TypeId	RunAs
DS	DataSource	Microsoft.Windows.EventCollector	Default
GenerateAlert	WriteAction	System.Health.GenerateAlert	Default

Source Code:

<Rule ID="Microsoft.SystemCenter.Apm.Infrastructure.Monitoring.CsmCollectorRemovalOnSharedIisRule" Enabled="true" Target="AI!Microsoft.SystemCenter.Apm.ApmAgent" ConfirmDelivery="true" Remotable="false" Priority="Normal" DiscardLevel="100">

  <Category>Alert</Category>

  <DataSources>

    <DataSource ID="DS" TypeID="Windows!Microsoft.Windows.EventCollector">

      <ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>Operations Manager</LogName>

      <AllowProxying>false</AllowProxying>

      <Expression>

        <And>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="String">PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="String">.Net app monitoring</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="UnsignedInteger">34251</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="GenerateAlert" TypeID="Health!System.Health.GenerateAlert">

      <Priority>1</Priority>

      <Severity>1</Severity>

      <AlertMessageId>$MPElement[Name="Microsoft.SystemCenter.Apm.Infrastructure.Monitoring.CsmCollectorRemovalOnSharedIisAlertMessage"]$</AlertMessageId>

      <AlertParameters>

        <AlertParameter1>$Data/Params/Param[1]$</AlertParameter1>

        <AlertParameter2>$Data/Params/Param[2]$</AlertParameter2>

      </AlertParameters>

      <Suppression>

        <SuppressionValue>$Data/Params/Param[2]$</SuppressionValue>

      </Suppression>

    </WriteAction>

  </WriteActions>

</Rule>