处理囤积的事件花费时间较长

Microsoft.SystemCenter.HealthServiceModules.WindowsEventLog.ProcessingBackLoggedEventsTooLong (UnitMonitor)

此监视器检查 Windows 事件日志模块是否在一段时间内在处理囤积的事件。

Knowledge Base article:

摘要

此监视器和警报表示 System Center 管理运行状况服务正在为超出预期时间的特定事件日志处理旧事件。

以下是此监视器的默认配置摘要：

警告状态：如果 10 分钟后 Operations Manager 仍在处理囤积的事件，则会切换为警告状态。这意味着 Operations Manager 已处理了事件 25017（已开始处理囤积的事件），但是未达到当前记录（如事件 25018 所示）。
严重状态：如果 20 分钟后 Operations Manager 仍在处理囤积的事件，则会从警告状态切换到严重状态。这意味着 System Center 管理运行状况服务处理囤积的事件除了已花费的 10 分钟，又花费了额外的 10 分钟，即处理事件 25017 共花费了 20 分钟。

原因

警告和严重状态都将表示在代理上发生了以下状况：

生成此事件的计算机上每分钟都在记录成百上千个事件，需要对所有这些事件进行处理以供监视。
计算机的可用资源（例如，内存）不足。
System Center 管理运行状况服务已被停止很长时间，它必须从其成功处理的最后一个事件开始处理所有的事件。

解决方法

你可以执行以下检查来进一步确定问题产生的根本原因：

1. 在出现此警报或监视器状态的计算机上打开事件查看器。

2. 检查是否存在看起来每分钟都在将许多事件记录到事件日志中的应用程序或事件源。

3. 如果未明确表示出可能正在记录这些事件的应用程序，请检查该计算机上的资源使用率。如果某个应用程序正在消耗大量的内存或 CPU，请与应用程序所有者或管理员联系以确定该操作是否是预期的操作。

4. 如果你不担心失去对现有事件的监视，则可以清除事件日志。

注意：当 System Center 管理运行状况服务仍在处理囤积的事件时，清除事件日志会导致失去监视。

Element properties:

Target

Microsoft.SystemCenter.HealthService

Parent Monitor

Microsoft.SystemCenter.HealthServiceModules.WindowsEventLog.Rollup

Category

AvailabilityHealth

Enabled

True

Alert Generate

True

Alert Severity

MatchMonitorHealth

Alert Priority

Normal

Alert Auto Resolve

True

Monitor Type

Microsoft.SystemCenter.HealthServiceModules.CorrelatedEventAndMissingEvent

Remotable

True

Accessibility

Public

Alert Message

处理囤积的事件花费时间较长

{0}

RunAs

Default

Source Code:

<UnitMonitor ID="Microsoft.SystemCenter.HealthServiceModules.WindowsEventLog.ProcessingBackLoggedEventsTooLong" Accessibility="Public" Enabled="true" Target="SCLibrary!Microsoft.SystemCenter.HealthService" ParentMonitorID="Microsoft.SystemCenter.HealthServiceModules.WindowsEventLog.Rollup" Remotable="true" Priority="Normal" TypeID="Microsoft.SystemCenter.HealthServiceModules.CorrelatedEventAndMissingEvent" ConfirmDelivery="true">

  <Category>AvailabilityHealth</Category>

  <AlertSettings AlertMessage="Microsoft.SystemCenter.HealthServiceModules.WindowsEventLog.ProcessingBackLoggedEventsTooLong_AlertMessageResourceID">

    <AlertOnState>Error</AlertOnState>

    <AutoResolve>true</AutoResolve>

    <AlertPriority>Normal</AlertPriority>

    <AlertSeverity>MatchMonitorHealth</AlertSeverity>

    <AlertParameters>

      <AlertParameter1>$Data/Context/Item0Context/DataItem/EventDescription$</AlertParameter1>

    </AlertParameters>

  </AlertSettings>

  <OperationalStates>

    <OperationalState ID="FinishedProcessingBackLoggedEvents" MonitorTypeStateID="SuccessEventRaised" HealthState="Success"/>

    <OperationalState ID="StillProccessingBackLoggedEventsWarning" MonitorTypeStateID="CorrelatedMissingEventWarningRaised" HealthState="Warning"/>

    <OperationalState ID="StillProccessingBackLoggedEventsError" MonitorTypeStateID="CorrelatedMissingEventErrorRaised" HealthState="Error"/>

  </OperationalStates>

  <Configuration>

    <ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

    <LogName>Operations Manager</LogName>

    <Expression>

      <And>

        <Expression>

          <Or>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="UnsignedInteger">25018</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="UnsignedInteger">26018</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

          </Or>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="String">PublisherName</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="String">Health Service Modules</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <Value Type="String">$Target/ManagementGroup/Name$</Value>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <XPathQuery Type="String">Params/Param[1]</XPathQuery>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

      </And>

    </Expression>

    <FirstCorrelatedMissingEventWarningComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</FirstCorrelatedMissingEventWarningComputerName>

    <FirstCorrelatedMissingEventWarningLogName>Operations Manager</FirstCorrelatedMissingEventWarningLogName>

    <FirstCorrelatedMissingEventWarningExpression>

      <And>

        <Expression>

          <Or>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="UnsignedInteger">25017</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="UnsignedInteger">26017</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

          </Or>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="String">PublisherName</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="String">Health Service Modules</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <Value Type="String">$Target/ManagementGroup/Name$</Value>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <XPathQuery Type="String">Params/Param[1]</XPathQuery>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

      </And>

    </FirstCorrelatedMissingEventWarningExpression>

    <SecondCorrelatedMissingEventWarningComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</SecondCorrelatedMissingEventWarningComputerName>

    <SecondCorrelatedMissingEventWarningLogName>Operations Manager</SecondCorrelatedMissingEventWarningLogName>

    <SecondCorrelatedMissingEventWarningExpression>

      <And>

        <Expression>

          <Or>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="UnsignedInteger">25018</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="UnsignedInteger">26018</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

          </Or>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="String">PublisherName</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="String">Health Service Modules</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <Value Type="String">$Target/ManagementGroup/Name$</Value>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <XPathQuery Type="String">Params/Param[1]</XPathQuery>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

      </And>

    </SecondCorrelatedMissingEventWarningExpression>

    <CorrelatorWarning>

      <CorrelationExpression>

        <Expression/>

      </CorrelationExpression>

      <Count>1</Count>

      <Interval>600</Interval>

      <CorrelationOrder>InSequence</CorrelationOrder>

      <CorrelationItemPolicy>ResetWindow</CorrelationItemPolicy>

    </CorrelatorWarning>

    <FirstCorrelatedMissingEventErrorComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</FirstCorrelatedMissingEventErrorComputerName>

    <FirstCorrelatedMissingEventErrorLogName>Operations Manager</FirstCorrelatedMissingEventErrorLogName>

    <FirstCorrelatedMissingEventErrorExpression>

      <And>

        <Expression>

          <Or>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="UnsignedInteger">25017</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="UnsignedInteger">26017</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

          </Or>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="String">PublisherName</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="String">Health Service Modules</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <Value Type="String">$Target/ManagementGroup/Name$</Value>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <XPathQuery Type="String">Params/Param[1]</XPathQuery>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

      </And>

    </FirstCorrelatedMissingEventErrorExpression>

    <SecondCorrelatedMissingEventErrorComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</SecondCorrelatedMissingEventErrorComputerName>

    <SecondCorrelatedMissingEventErrorLogName>Operations Manager</SecondCorrelatedMissingEventErrorLogName>

    <SecondCorrelatedMissingEventErrorExpression>

      <And>

        <Expression>

          <Or>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="UnsignedInteger">25018</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="UnsignedInteger">26018</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

          </Or>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="String">PublisherName</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="String">Health Service Modules</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <Value Type="String">$Target/ManagementGroup/Name$</Value>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <XPathQuery Type="String">Params/Param[1]</XPathQuery>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

      </And>

    </SecondCorrelatedMissingEventErrorExpression>

    <CorrelatorError>

      <CorrelationExpression>

        <Expression/>

      </CorrelationExpression>

      <Count>1</Count>

      <Interval>1200</Interval>

      <CorrelationOrder>InSequence</CorrelationOrder>

      <CorrelationItemPolicy>ResetWindow</CorrelationItemPolicy>

    </CorrelatorError>

  </Configuration>

</UnitMonitor>