File Upload Quota

Microsoft.SystemCenter.FileUpload.FileQuotaMonitor (UnitMonitor)

This unit monitor monitors the file upload quotas.

Knowledge Base article:

Summary

This unit monitor monitors the file upload quotas i.e. the number of pending files that are in process of being transferred over to the management server by a monitored agent. If it exceeds the configured quota, an alert will be raised upon two consecutive failed attempts to transfer a file to the management server. The alert will auto resolve if the file processing falls back within the quota specified denoted by a missed failed attempt.

The following summarizes the default thresholds:

Maximum Pending files (Default value 512)
Maximum pending file bytes (Default size 10GB)

Causes

A brief summary of potential causes are:

A malicious agent may be trying to cause the server to run out of disk space by uploading too much data. All the above mentioned limits apply to both file uploads that have not yet completed as well as completed uploads which have not been posted (and acknowledged) by a data source instance yet.
A failed/missing rule for completing file uploads.

Resolutions

The manual resolution steps that can be performed are:

Investigate the malicious agent for uploading data over quota limit.
Use the task for listing failed rules/monitors on the management server to check and see if any rules processing completed file uploads have failed.

Element properties:

Target

Microsoft.SystemCenter.ManagementServer

Parent Monitor

System.Health.SecurityState

Category

SecurityHealth

Enabled

True

Alert Generate

True

Alert Severity

Warning

Alert Priority

High

Alert Auto Resolve

True

Monitor Type

Microsoft.Windows.RepeatedEventSpecialLogTimer2StateMonitorType

Remotable

False

Accessibility

Public

Alert Message

File Transfer Quota Limit

The management server has exceeded the file upload quota limit.

RunAs

Default

Source Code:

<UnitMonitor ID="Microsoft.SystemCenter.FileUpload.FileQuotaMonitor" Accessibility="Public" Enabled="true" Target="SCLibrary!Microsoft.SystemCenter.ManagementServer" ParentMonitorID="Health!System.Health.SecurityState" Remotable="false" Priority="Normal" TypeID="Windows!Microsoft.Windows.RepeatedEventSpecialLogTimer2StateMonitorType" ConfirmDelivery="true">

  <Category>SecurityHealth</Category>

  <AlertSettings AlertMessage="Microsoft.SystemCenter.FileUpload.FileQuotaMonitor_AlertMessageResourceID">

    <AlertOnState>Warning</AlertOnState>

    <AutoResolve>true</AutoResolve>

    <AlertPriority>High</AlertPriority>

    <AlertSeverity>Warning</AlertSeverity>

  </AlertSettings>

  <OperationalStates>

    <OperationalState ID="Microsoft.SystemCenter.FileUpload.FileQuotaMonitor.Warning" MonitorTypeStateID="RepeatedEventRaised" HealthState="Warning"/>

    <OperationalState ID="Microsoft.SystemCenter.FileUpload.FileQuotaMonitor.Success" MonitorTypeStateID="TimerEventRaised" HealthState="Success"/>

  </OperationalStates>

  <Configuration>

    <RepeatedComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</RepeatedComputerName>

    <RepeatedLogName>Operations Manager</RepeatedLogName>

    <RepeatedExpression>

      <And>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="String">Params/Param[1]</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="String">$Target/ManagementGroup/Name$</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="String">PublisherName</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="String">HealthService</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="UnsignedInteger">2126</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="UnsignedInteger">EventLevel</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="UnsignedInteger">2</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

      </And>

    </RepeatedExpression>

    <Consolidator>

      <ConsolidationProperties/>

      <TimeControl>

        <WithinTimeSchedule>

          <Interval>1020</Interval>

        </WithinTimeSchedule>

      </TimeControl>

      <CountingCondition>

        <Count>2</Count>

        <CountMode>OnNewItemTestOutputRestart_OnTimerSlideByOne</CountMode>

      </CountingCondition>

    </Consolidator>

    <TimerWaitInSeconds>1020</TimerWaitInSeconds>

  </Configuration>

</UnitMonitor>