處理積存的事件花費很長的時間

Microsoft.SystemCenter.HealthServiceModules.WindowsEventLog.ProcessingBackLoggedEventsTooLong (UnitMonitor)

此監視會檢查 Windows 事件記錄模組是否正在處理一段時間的回溯記錄事件。

Knowledge Base article:

摘要

此監視及警示表示 System Center 管理健全狀況服務在處理某特定事件記錄檔的較早期事件所花費的時間超出預期。

此監視的預設設定摘要如下：

警告狀態：如果經過 10 分鐘後 Operations Manager 仍在處理積存事件，即轉為警告狀態。這表示 Operations Manager 已處理事件 25017 (已開始處理積存事件)，但尚未到達目前的記錄 (以事件 25018 表示)。
重大狀態：如果經過 20 分鐘後 Operations Manager 仍在處理積存事件，會從警告狀態轉為嚴重狀態。這表示除了 System Center 管理健全狀況服務已開始處理回溯記錄事件的 10 分鐘之外又過了 10 分鐘，亦即自從開始處理事件 25017 後總共經過 20 分鐘。

原因

警告及重大狀態均可能表示代理程式也許發生下列問題：

產生此事件的電腦每分鐘記錄數百至數千個事件，而這些事件都需要進行監視處理。
電腦的可用資源 (如記憶體) 可能不足。
System Center 管理健全狀況服務曾長時間停止執行，而必須處理最後一個處理成功的事件之後累積的所有事件。

解決方式

您可執行下列檢查以進一步判定問題的根本原因：

1. 在產生此警示或監視狀態的電腦上開啟事件檢視器。

2. 檢查有無應用程式或事件來源疑似每分鐘記錄多筆事件至事件記錄檔

3. 若無明顯徵兆指出記錄這些事件的應用程式為何，請檢查此電腦上的資源使用量。如有應用程式耗用大量記憶體或 CPU，請向應用程式所有人或系統管理員確認這是否屬於預期行為。

4. 如果您可容忍現有事件的監視遺失，則可清除事件記錄檔。

附註: 在 System Center 管理健全狀況服務仍在處理回溯記錄事件期間清除事件記錄檔，將導致監視遺失。

Element properties:

Target

Microsoft.SystemCenter.HealthService

Parent Monitor

Microsoft.SystemCenter.HealthServiceModules.WindowsEventLog.Rollup

Category

AvailabilityHealth

Enabled

True

Alert Generate

True

Alert Severity

MatchMonitorHealth

Alert Priority

Normal

Alert Auto Resolve

True

Monitor Type

Microsoft.SystemCenter.HealthServiceModules.CorrelatedEventAndMissingEvent

Remotable

True

Accessibility

Public

Alert Message

處理積存的事件花費很長的時間

{0}

RunAs

Default

Source Code:

<UnitMonitor ID="Microsoft.SystemCenter.HealthServiceModules.WindowsEventLog.ProcessingBackLoggedEventsTooLong" Accessibility="Public" Enabled="true" Target="SCLibrary!Microsoft.SystemCenter.HealthService" ParentMonitorID="Microsoft.SystemCenter.HealthServiceModules.WindowsEventLog.Rollup" Remotable="true" Priority="Normal" TypeID="Microsoft.SystemCenter.HealthServiceModules.CorrelatedEventAndMissingEvent" ConfirmDelivery="true">

  <Category>AvailabilityHealth</Category>

  <AlertSettings AlertMessage="Microsoft.SystemCenter.HealthServiceModules.WindowsEventLog.ProcessingBackLoggedEventsTooLong_AlertMessageResourceID">

    <AlertOnState>Error</AlertOnState>

    <AutoResolve>true</AutoResolve>

    <AlertPriority>Normal</AlertPriority>

    <AlertSeverity>MatchMonitorHealth</AlertSeverity>

    <AlertParameters>

      <AlertParameter1>$Data/Context/Item0Context/DataItem/EventDescription$</AlertParameter1>

    </AlertParameters>

  </AlertSettings>

  <OperationalStates>

    <OperationalState ID="FinishedProcessingBackLoggedEvents" MonitorTypeStateID="SuccessEventRaised" HealthState="Success"/>

    <OperationalState ID="StillProccessingBackLoggedEventsWarning" MonitorTypeStateID="CorrelatedMissingEventWarningRaised" HealthState="Warning"/>

    <OperationalState ID="StillProccessingBackLoggedEventsError" MonitorTypeStateID="CorrelatedMissingEventErrorRaised" HealthState="Error"/>

  </OperationalStates>

  <Configuration>

    <ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

    <LogName>Operations Manager</LogName>

    <Expression>

      <And>

        <Expression>

          <Or>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="UnsignedInteger">25018</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="UnsignedInteger">26018</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

          </Or>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="String">PublisherName</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="String">Health Service Modules</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <Value Type="String">$Target/ManagementGroup/Name$</Value>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <XPathQuery Type="String">Params/Param[1]</XPathQuery>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

      </And>

    </Expression>

    <FirstCorrelatedMissingEventWarningComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</FirstCorrelatedMissingEventWarningComputerName>

    <FirstCorrelatedMissingEventWarningLogName>Operations Manager</FirstCorrelatedMissingEventWarningLogName>

    <FirstCorrelatedMissingEventWarningExpression>

      <And>

        <Expression>

          <Or>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="UnsignedInteger">25017</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="UnsignedInteger">26017</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

          </Or>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="String">PublisherName</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="String">Health Service Modules</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <Value Type="String">$Target/ManagementGroup/Name$</Value>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <XPathQuery Type="String">Params/Param[1]</XPathQuery>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

      </And>

    </FirstCorrelatedMissingEventWarningExpression>

    <SecondCorrelatedMissingEventWarningComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</SecondCorrelatedMissingEventWarningComputerName>

    <SecondCorrelatedMissingEventWarningLogName>Operations Manager</SecondCorrelatedMissingEventWarningLogName>

    <SecondCorrelatedMissingEventWarningExpression>

      <And>

        <Expression>

          <Or>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="UnsignedInteger">25018</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="UnsignedInteger">26018</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

          </Or>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="String">PublisherName</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="String">Health Service Modules</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <Value Type="String">$Target/ManagementGroup/Name$</Value>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <XPathQuery Type="String">Params/Param[1]</XPathQuery>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

      </And>

    </SecondCorrelatedMissingEventWarningExpression>

    <CorrelatorWarning>

      <CorrelationExpression>

        <Expression/>

      </CorrelationExpression>

      <Count>1</Count>

      <Interval>600</Interval>

      <CorrelationOrder>InSequence</CorrelationOrder>

      <CorrelationItemPolicy>ResetWindow</CorrelationItemPolicy>

    </CorrelatorWarning>

    <FirstCorrelatedMissingEventErrorComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</FirstCorrelatedMissingEventErrorComputerName>

    <FirstCorrelatedMissingEventErrorLogName>Operations Manager</FirstCorrelatedMissingEventErrorLogName>

    <FirstCorrelatedMissingEventErrorExpression>

      <And>

        <Expression>

          <Or>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="UnsignedInteger">25017</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="UnsignedInteger">26017</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

          </Or>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="String">PublisherName</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="String">Health Service Modules</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <Value Type="String">$Target/ManagementGroup/Name$</Value>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <XPathQuery Type="String">Params/Param[1]</XPathQuery>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

      </And>

    </FirstCorrelatedMissingEventErrorExpression>

    <SecondCorrelatedMissingEventErrorComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</SecondCorrelatedMissingEventErrorComputerName>

    <SecondCorrelatedMissingEventErrorLogName>Operations Manager</SecondCorrelatedMissingEventErrorLogName>

    <SecondCorrelatedMissingEventErrorExpression>

      <And>

        <Expression>

          <Or>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="UnsignedInteger">25018</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="UnsignedInteger">26018</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

          </Or>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="String">PublisherName</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="String">Health Service Modules</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <Value Type="String">$Target/ManagementGroup/Name$</Value>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <XPathQuery Type="String">Params/Param[1]</XPathQuery>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

      </And>

    </SecondCorrelatedMissingEventErrorExpression>

    <CorrelatorError>

      <CorrelationExpression>

        <Expression/>

      </CorrelationExpression>

      <Count>1</Count>

      <Interval>1200</Interval>

      <CorrelationOrder>InSequence</CorrelationOrder>

      <CorrelationItemPolicy>ResetWindow</CorrelationItemPolicy>

    </CorrelatorError>

  </Configuration>

</UnitMonitor>