Home
  •  

DHCP 用于 IPv4 运行时审核日志已满的监视器

Microsoft.Windows.DHCPServer.Library.IPv4Runtime.UnitMonitor.Auditing.2 (UnitMonitor)

Knowledge Base article:

解决方案

如果磁盘已满或已达到最大日志大小，则 DHCP 服务器会关闭当前文件并忽略对日志审核事件的后续请求，直到午夜或磁盘状态得到改进并且不再处于已满状态为止。如果磁盘已满，则您可以增加更多物理磁盘空间，增大最大审核日志大小，或从默认日志目录 %windir%\System32\Dhcp 中删除以前的日志文件。

若要执行这些过程，您必须是管理员组的成员，或者您必须被委派了适当的权限。

若要增大最大审核日志大小，请执行以下操作：

警告：注册表编辑不当可能会严重损坏您的系统。更改注册表之前，您应备份任何有价值的数据。

Element properties:

TargetMicrosoft.Windows.DHCPServer.Library.IPv4Runtime
Parent MonitorSystem.Health.SecurityState
CategoryStateCollection
EnabledTrue
Alert GenerateTrue
Alert SeverityMatchMonitorHealth
Alert PriorityNormal
Alert Auto ResolveTrue
Monitor TypeMicrosoft.Windows.SingleEventLogManualReset2StateMonitorType
RemotableTrue
AccessibilityPublic
Alert Message
DHCP 有关 IPv4 运行时审核日志已满的警报
{0}
RunAsMicrosoft.Windows.DHCPServer.Library.ActionAccount

Source Code:

<UnitMonitor ID="Microsoft.Windows.DHCPServer.Library.IPv4Runtime.UnitMonitor.Auditing.2" Accessibility="Public" Enabled="true" Target="Microsoft.Windows.DHCPServer.Library.IPv4Runtime" ParentMonitorID="Health!System.Health.SecurityState" Remotable="true" Priority="Normal" TypeID="Windows!Microsoft.Windows.SingleEventLogManualReset2StateMonitorType" ConfirmDelivery="true" RunAs="Microsoft.Windows.DHCPServer.Library.ActionAccount">

  <Category>StateCollection</Category>

  <AlertSettings AlertMessage="Microsoft.Windows.DHCPServer.Library.IPv4Runtime.UnitMonitor.Auditing.2_AlertMessageResourceID">

    <AlertOnState>Warning</AlertOnState>

    <AutoResolve>true</AutoResolve>

    <AlertPriority>Normal</AlertPriority>

    <AlertSeverity>MatchMonitorHealth</AlertSeverity>

    <AlertParameters>

      <AlertParameter1>$Data/Context/EventDescription$</AlertParameter1>

    </AlertParameters>

  </AlertSettings>

  <OperationalStates>

    <OperationalState ID="EventRaised" MonitorTypeStateID="EventRaised" HealthState="Warning"/>

    <OperationalState ID="ManualResetEventRaised" MonitorTypeStateID="ManualResetEventRaised" HealthState="Success"/>

  </OperationalStates>

  <Configuration>

    <ComputerName>$Target/Host/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

    <LogName>System</LogName>

    <Expression>

      <And>

        <Expression>

          <Or>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="String">PublisherName</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="String">Microsoft-Windows-DHCP-Server</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="String">PublisherName</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="String">DHCPServer</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

          </Or>

        </Expression>

        <Expression>

          <Or>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="UnsignedInteger">1027</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="UnsignedInteger">1030</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

          </Or>

        </Expression>

      </And>

    </Expression>

  </Configuration>

</UnitMonitor>