Collection Rule for event with source CertificationAuthority and ID 110

Microsoft.Windows.CertificateServices.CARole.2016.CertSvcEvents.110 (Rule)

Certificate Services could not initialize performance counters.

Knowledge Base article:

Summary

Performance counters make it possible to monitor the use of a certification authority (CA). If performance counters cannot be started, this data will not be available.

Resolutions

Initialize AD CS performance counters

Active Directory Certificate Services (AD CS) needs to initialize performance counters in order to track performance data.

To start performance counters, you may need to:

To perform these procedures, you must have Manage CA permission, or you must have been delegated the appropriate authority.

Restart a CA

To restart a CA:

Register performance counters

To register the performance counters for a CA:

Additional

To confirm that the performance counters are initialized and working:

Element properties:

TargetMicrosoft.Windows.CertificateServices.CARole.2016
CategoryEventCollection
EnabledTrue
Event_ID110
Event SourceMicrosoft-Windows-CertificationAuthority
Alert GenerateFalse
RemotableTrue
Event LogApplication

Member Modules:

ID Module Type TypeId RunAs 
DS DataSource Microsoft.Windows.EventProvider Default
WriteToCertSvcEvents WriteAction Microsoft.Windows.CertificateServices.CARole.CertSvcEvents.Publisher Default
WriteToDB WriteAction Microsoft.SystemCenter.CollectEvent Default

Source Code:

<Rule ID="Microsoft.Windows.CertificateServices.CARole.2016.CertSvcEvents.110" Enabled="true" Target="CSDisc!Microsoft.Windows.CertificateServices.CARole.2016" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">
<Category>EventCollection</Category>
<DataSources>
<DataSource ID="DS" TypeID="Windows!Microsoft.Windows.EventProvider">
<ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>
<LogName>Application</LogName>
<Expression>
<And>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="UnsignedInteger">110</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="String">PublisherName</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="String">Microsoft-Windows-CertificationAuthority</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</And>
</Expression>
</DataSource>
</DataSources>
<WriteActions>
<WriteAction ID="WriteToDB" TypeID="SC!Microsoft.SystemCenter.CollectEvent"/>
<WriteAction ID="WriteToCertSvcEvents" TypeID="Microsoft.Windows.CertificateServices.CARole.CertSvcEvents.Publisher"/>
</WriteActions>
</Rule>