Event Collection: Site component manager fails to read Active Directory objects

Microsoft.SystemCenter2012.ConfigurationManager.SiteComponentManager.CanNotFindObjectInAD_Events (Rule)

This rule generates alerts if the site component manager fails to read objects in Active Directory.

Knowledge Base article:

Summary

This rule generates an alert if the site component manager fails to read objects in Active Directory.

Causes

The SMS Agent Host is stopped or is not responding.
Insufficient permissions to read object in Active Directory.

Resolutions

Verify that the SMS Agent Host service is running. If it is stopped or is not responding, restart the service.
Check network connectivity to the site system database server, along with certificate issues that may exist (check in the administration console database replication node under monitoring).

Element properties:

Target

Microsoft.SystemCenter2012.ConfigurationManager.SiteComponentManager

Category

EventCollection

Enabled

False

Event_ID

4909

Event Source

SMS Server

Alert Generate

True

Alert Severity

Error

Alert Priority

Normal

Remotable

True

Alert Message

Fail to read Active Directory alert

The site server failed to read objects in Active Directory.

Event Log

Application

Comment

SIV:SVC0031

Member Modules:

ID	Module Type	TypeId	RunAs
DS	DataSource	Microsoft.Windows.EventProvider	Default
Alert	WriteAction	System.Health.GenerateAlert	Default
WriteToDB	WriteAction	Microsoft.SystemCenter.CollectEvent	Default
WriteToDW	WriteAction	Microsoft.SystemCenter.DataWarehouse.PublishEventData	Default

Source Code:

<Rule ID="Microsoft.SystemCenter2012.ConfigurationManager.SiteComponentManager.CanNotFindObjectInAD_Events" Comment="SIV:SVC0031" Enabled="false" Target="SCCM!Microsoft.SystemCenter2012.ConfigurationManager.SiteComponentManager" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>EventCollection</Category>

  <DataSources>

    <DataSource ID="DS" TypeID="Windows!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>Application</LogName>

      <Expression>

        <And>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="UnsignedInteger">4909</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="String">PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="String">SMS Server</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="WriteToDB" TypeID="SC!Microsoft.SystemCenter.CollectEvent"/>

    <WriteAction ID="WriteToDW" TypeID="SCDW!Microsoft.SystemCenter.DataWarehouse.PublishEventData"/>

    <WriteAction ID="Alert" TypeID="SystemHealth!System.Health.GenerateAlert">

      <Priority>1</Priority>

      <Severity>2</Severity>

      <AlertName/>

      <AlertDescription/>

      <AlertOwner/>

      <AlertMessageId>$MPElement[Name="Microsoft.SystemCenter2012.ConfigurationManager.SiteComponentManager.CanNotFindObjectInAD_AlertMessageResourceID"]$</AlertMessageId>

      <AlertParameters/>

      <Suppression>

        <SuppressionValue/>

      </Suppression>

      <Custom1/>

      <Custom2/>

      <Custom3/>

      <Custom4/>

      <Custom5/>

      <Custom6/>

      <Custom7/>

      <Custom8/>

      <Custom9/>

      <Custom10/>

    </WriteAction>

  </WriteActions>

</Rule>