Esse monitor verifica se o módulo Log de Eventos do Windows está processando eventos acumulados por um determinado tempo.
Esse monitor e alerta indica que o Serviço de Integridade estava processando eventos antigos para um determinado log de eventos mais tempo que o previsto.
Abaixo, um resumo da configuração padrão desse monitor:
Estado de aviso: Passa para o estado de aviso se ainda estivermos processando eventos acumulados depois de 10 minutos. Isso significa que processamos o Evento 25017 (iniciou processando eventos registrados antigos), mas não alcançamos o registro atual (indicado pelo evento 25018).
Estado crítico: Passa do estado de aviso para o estado crítico se depois de 20 minutos ainda estivermos processando eventos acumulados. Isso significa que, além dos 10 minutos em que o Serviço de Integridade já processou eventos acumulados, mais 10 minutos já passaram, totalizando 20 minutos desde que processamos o Evento 25017.
Tanto o estado de aviso quanto o estado crítico podem indicar que esteja ocorrendo o seguinte no agente:
O computador em que esse evento foi gerado está registrando de centenas a milhares de eventos por minuto e todos terão de ser processados para monitoramento.
O computador pode ter poucos recursos disponíveis (por exemplo, memória).
O Serviço de Integridade foi interrompido por um logo período e deve processar todos os eventos desde o último que foi processado com êxito.
Você poderá realizar as seguintes verificações para determinar melhor a causa raiz do problema:
1. Abra o visualizador de eventos no computador para o qual ocorreu esse estado de alerta ou monitor.
2. Verifique se há um aplicativo ou origem do evento que pareça estar registrando muitos eventos por minuto no log de eventos
3. Se não existir uma indicação clara do aplicativo que possa estar registrando esses eventos, verifique a utilização de recursos nesse computador. Se existir um aplicativo consumindo grandes quantidade de memória ou tempo de CPU, consulte o proprietário do aplicativo ou o administrador, para saber se esse é um comportamento esperado.
4. Se você não estiver preocupado com a perda de monitoramento dos eventos existentes, você poderá apagar o log de eventos.
Observação: Apagar o log de eventos quando o Serviço de Integridade ainda está processando eventos acumulados resultará na perda do monitoramento.
Target | Microsoft.SystemCenter.HealthService | ||
Parent Monitor | Microsoft.SystemCenter.HealthServiceModules.WindowsEventLog.Rollup | ||
Category | AvailabilityHealth | ||
Enabled | True | ||
Alert Generate | True | ||
Alert Severity | MatchMonitorHealth | ||
Alert Priority | Normal | ||
Alert Auto Resolve | True | ||
Monitor Type | Microsoft.SystemCenter.HealthServiceModules.CorrelatedEventAndMissingEvent | ||
Remotable | True | ||
Accessibility | Public | ||
Alert Message |
| ||
RunAs | Default |
<UnitMonitor ID="Microsoft.SystemCenter.HealthServiceModules.WindowsEventLog.ProcessingBackLoggedEventsTooLong" Accessibility="Public" Enabled="true" Target="SCLibrary!Microsoft.SystemCenter.HealthService" ParentMonitorID="Microsoft.SystemCenter.HealthServiceModules.WindowsEventLog.Rollup" Remotable="true" Priority="Normal" TypeID="Microsoft.SystemCenter.HealthServiceModules.CorrelatedEventAndMissingEvent" ConfirmDelivery="true">
<Category>AvailabilityHealth</Category>
<AlertSettings AlertMessage="Microsoft.SystemCenter.HealthServiceModules.WindowsEventLog.ProcessingBackLoggedEventsTooLong_AlertMessageResourceID">
<AlertOnState>Error</AlertOnState>
<AutoResolve>true</AutoResolve>
<AlertPriority>Normal</AlertPriority>
<AlertSeverity>MatchMonitorHealth</AlertSeverity>
<AlertParameters>
<AlertParameter1>$Data/Context/Item0Context/DataItem/EventDescription$</AlertParameter1>
</AlertParameters>
</AlertSettings>
<OperationalStates>
<OperationalState ID="FinishedProcessingBackLoggedEvents" MonitorTypeStateID="SuccessEventRaised" HealthState="Success"/>
<OperationalState ID="StillProccessingBackLoggedEventsWarning" MonitorTypeStateID="CorrelatedMissingEventWarningRaised" HealthState="Warning"/>
<OperationalState ID="StillProccessingBackLoggedEventsError" MonitorTypeStateID="CorrelatedMissingEventErrorRaised" HealthState="Error"/>
</OperationalStates>
<Configuration>
<ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>
<LogName>Operations Manager</LogName>
<Expression>
<And>
<Expression>
<Or>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="UnsignedInteger">25018</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="UnsignedInteger">26018</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</Or>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="String">PublisherName</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="String">Health Service Modules</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<Value Type="String">$Target/ManagementGroup/Name$</Value>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<XPathQuery Type="String">Params/Param[1]</XPathQuery>
</ValueExpression>
</SimpleExpression>
</Expression>
</And>
</Expression>
<FirstCorrelatedMissingEventWarningComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</FirstCorrelatedMissingEventWarningComputerName>
<FirstCorrelatedMissingEventWarningLogName>Operations Manager</FirstCorrelatedMissingEventWarningLogName>
<FirstCorrelatedMissingEventWarningExpression>
<And>
<Expression>
<Or>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="UnsignedInteger">25017</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="UnsignedInteger">26017</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</Or>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="String">PublisherName</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="String">Health Service Modules</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<Value Type="String">$Target/ManagementGroup/Name$</Value>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<XPathQuery Type="String">Params/Param[1]</XPathQuery>
</ValueExpression>
</SimpleExpression>
</Expression>
</And>
</FirstCorrelatedMissingEventWarningExpression>
<SecondCorrelatedMissingEventWarningComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</SecondCorrelatedMissingEventWarningComputerName>
<SecondCorrelatedMissingEventWarningLogName>Operations Manager</SecondCorrelatedMissingEventWarningLogName>
<SecondCorrelatedMissingEventWarningExpression>
<And>
<Expression>
<Or>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="UnsignedInteger">25018</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="UnsignedInteger">26018</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</Or>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="String">PublisherName</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="String">Health Service Modules</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<Value Type="String">$Target/ManagementGroup/Name$</Value>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<XPathQuery Type="String">Params/Param[1]</XPathQuery>
</ValueExpression>
</SimpleExpression>
</Expression>
</And>
</SecondCorrelatedMissingEventWarningExpression>
<CorrelatorWarning>
<CorrelationExpression>
<Expression/>
</CorrelationExpression>
<Count>1</Count>
<Interval>600</Interval>
<CorrelationOrder>InSequence</CorrelationOrder>
<CorrelationItemPolicy>ResetWindow</CorrelationItemPolicy>
</CorrelatorWarning>
<FirstCorrelatedMissingEventErrorComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</FirstCorrelatedMissingEventErrorComputerName>
<FirstCorrelatedMissingEventErrorLogName>Operations Manager</FirstCorrelatedMissingEventErrorLogName>
<FirstCorrelatedMissingEventErrorExpression>
<And>
<Expression>
<Or>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="UnsignedInteger">25017</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="UnsignedInteger">26017</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</Or>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="String">PublisherName</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="String">Health Service Modules</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<Value Type="String">$Target/ManagementGroup/Name$</Value>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<XPathQuery Type="String">Params/Param[1]</XPathQuery>
</ValueExpression>
</SimpleExpression>
</Expression>
</And>
</FirstCorrelatedMissingEventErrorExpression>
<SecondCorrelatedMissingEventErrorComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</SecondCorrelatedMissingEventErrorComputerName>
<SecondCorrelatedMissingEventErrorLogName>Operations Manager</SecondCorrelatedMissingEventErrorLogName>
<SecondCorrelatedMissingEventErrorExpression>
<And>
<Expression>
<Or>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="UnsignedInteger">25018</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="UnsignedInteger">26018</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</Or>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="String">PublisherName</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="String">Health Service Modules</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<Value Type="String">$Target/ManagementGroup/Name$</Value>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<XPathQuery Type="String">Params/Param[1]</XPathQuery>
</ValueExpression>
</SimpleExpression>
</Expression>
</And>
</SecondCorrelatedMissingEventErrorExpression>
<CorrelatorError>
<CorrelationExpression>
<Expression/>
</CorrelationExpression>
<Count>1</Count>
<Interval>1200</Interval>
<CorrelationOrder>InSequence</CorrelationOrder>
<CorrelationItemPolicy>ResetWindow</CorrelationItemPolicy>
</CorrelatorError>
</Configuration>
</UnitMonitor>