System Center Management Health Service Credentials Not Found

Microsoft.SystemCenter.HealthService.Credentials.NotFound.Monitor (UnitMonitor)

This monitor raises an alert when the Operations Manager agent cannot resolve Secure Reference override.

Knowledge Base article:

Summary

This monitor raises an alert when the Operations Manager agent cannot resolve Secure Reference overrides that are defined in the management packs.

Causes

The Operations Manager agent uses an asynchronous distribution mechanism for delivering accounts that are referenced by the management pack secure reference overrides. Distributing configuration changes in the overrides among multiple computers might take a few minutes. During this time, the accounts remain inaccessible, making the Operations Manager agent log an event indicating that the accounts referenced by Run As Profile cannot be resolved.

With properly configured account distribution, a separate event is logged after all referenced accounts are delivered to the monitored computer. The second event will not be logged while there are remaining unresolved secure reference overrides.

This monitor tracks these events and raises an alert when the Operations Manager agent does not receive the accounts referenced in Run As Profiles in a configurable timeframe (the default time is 5 minutes).

Resolutions

If you receive alerts from this monitor, you must verify the RunAs account configuration. Open the Run As Profile specified in the event delivered by the alert, locate the Account entry as specified by its SSID, and then either choose to distribute the Account to the computer if appropriate, or change the setting in the Profile so that the target object does not use the specified Account.

Element properties:

Target

Microsoft.SystemCenter.HealthService

Parent Monitor

System.Health.ConfigurationState

Category

Custom

Enabled

True

Alert Generate

True

Alert Severity

Error

Alert Priority

High

Alert Auto Resolve

True

Monitor Type

Microsoft.Windows.MissingCorrelatedEventLogSingleEventLog2StateMonitorType

Remotable

True

Accessibility

Public

Alert Message

System Center Management Health Service Credentials Not Found Alert Message

An account specified in the Run As profile "{3}" cannot be resolved.

This condition may have occurred because the account is not configured to be distributed to this computer. To resolve this problem, you need to open the Run As profile specified below, locate the account entry as specified by its SSID, and either choose to distribute the account to this computer if appropriate, or change the setting in the profile so that the target object does not use the specified account.
Note: you may use the command shell to get the Run As account display name by its SSID.

Management Group: {1}
Run As Profile: {3}
Account SSID: {2}

RunAs

Default

Source Code:

<UnitMonitor ID="Microsoft.SystemCenter.HealthService.Credentials.NotFound.Monitor" Accessibility="Public" Enabled="onEssentialMonitoring" Target="SCLibrary!Microsoft.SystemCenter.HealthService" ParentMonitorID="Health!System.Health.ConfigurationState" Remotable="true" Priority="Normal" TypeID="Windows!Microsoft.Windows.MissingCorrelatedEventLogSingleEventLog2StateMonitorType" ConfirmDelivery="true">

  <Category>Custom</Category>

  <AlertSettings AlertMessage="Microsoft.SystemCenter.HealthService.Credentials.NotFound.AlertMessage">

    <AlertOnState>Error</AlertOnState>

    <AutoResolve>true</AutoResolve>

    <AlertPriority>High</AlertPriority>

    <AlertSeverity>Error</AlertSeverity>

    <AlertParameters>

      <AlertParameter1>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</AlertParameter1>

      <AlertParameter2>$Data/Context/DataItem/Item0Context/DataItem/Params/Param[1]$</AlertParameter2>

      <AlertParameter3>$Data/Context/DataItem/Item0Context/DataItem/Params/Param[5]$</AlertParameter3>

      <AlertParameter4>$Data/Context/DataItem/Item0Context/DataItem/Params/Param[7]$</AlertParameter4>

    </AlertParameters>

  </AlertSettings>

  <OperationalStates>

    <OperationalState ID="Microsoft.SystemCenter.HealthService.Credentials.NotFound.Monitor.State.Healthy" MonitorTypeStateID="EventRaised" HealthState="Success"/>

    <OperationalState ID="Microsoft.SystemCenter.HealthService.Credentials.NotFound.Monitor.State.Error" MonitorTypeStateID="MissingCorrelatedEventRaised" HealthState="Error"/>

  </OperationalStates>

  <Configuration>

    <ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

    <LogName>Operations Manager</LogName>

    <Expression>

      <And>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="String">Params/Param[1]</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="String">$Target/ManagementGroup/Name$</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="UnsignedInteger">1109</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="String">PublisherName</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="String">HealthService</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

      </And>

    </Expression>

    <FirstMissingCorrelatedComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</FirstMissingCorrelatedComputerName>

    <FirstMissingCorrelatedLogName>Operations Manager</FirstMissingCorrelatedLogName>

    <FirstMissingCorrelatedExpression>

      <And>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="String">Params/Param[1]</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="String">$Target/ManagementGroup/Name$</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="UnsignedInteger">1108</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="String">PublisherName</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="String">HealthService</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

      </And>

    </FirstMissingCorrelatedExpression>

    <SecondMissingCorrelatedComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</SecondMissingCorrelatedComputerName>

    <SecondMissingCorrelatedLogName>Operations Manager</SecondMissingCorrelatedLogName>

    <SecondMissingCorrelatedExpression>

      <And>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="String">Params/Param[1]</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="String">$Target/ManagementGroup/Name$</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="UnsignedInteger">1109</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="String">PublisherName</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="String">HealthService</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

      </And>

    </SecondMissingCorrelatedExpression>

    <Correlator>

      <CorrelationExpression>

        <Expression/>

      </CorrelationExpression>

      <Count>1</Count>

      <Interval>300</Interval>

      <CorrelationOrder>InSequence</CorrelationOrder>

      <CorrelationItemPolicy>Last</CorrelationItemPolicy>

    </Correlator>

  </Configuration>

</UnitMonitor>