Home
  •  

Microsoft Windows Server 2016 DNS Active Refresh Query Failed

Microsoft.Windows.DNSServer.2016.Rules.DNSSEC.TARefreshFailed (Rule)

Alert generating rule for DNSSEC Active Refresh Query

Knowledge Base article:

Summary

The active refresh query for the DNSKEY records at the trust point has failed. This query will be retried.

Causes

The active refresh query for the DNSKEY records at the trust point has failed. This query will be retried.

Element properties:

TargetMicrosoft.Windows.DNSServer.2016.Server
CategoryAlert
EnabledTrue
Alert GenerateTrue
Alert SeverityError
Alert PriorityNormal
RemotableTrue
Alert Message
Windows DNS 2016 - DNSSEC Active Refresh Query Has Failed

Event ID: {0}
Event Source: {1}
Event Log: {2}
Event Description: {3}
Event LogDNS Server

Member Modules:

ID Module Type TypeId RunAs 
DS DataSource Microsoft.Windows.EventProvider Default
Alert WriteAction System.Health.GenerateAlert Default

Source Code:

<Rule ID="Microsoft.Windows.DNSServer.2016.Rules.DNSSEC.TARefreshFailed" Enabled="true" Target="Microsoft.Windows.DNSServer.2016.Server" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>Alert</Category>

  <DataSources>

    <DataSource ID="DS" TypeID="Windows!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>DNS Server</LogName>

      <Expression>

        <SimpleExpression>

          <ValueExpression>

            <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

          </ValueExpression>

          <Operator>Equal</Operator>

          <ValueExpression>

            <Value Type="UnsignedInteger">7644</Value>

          </ValueExpression>

        </SimpleExpression>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="Alert" TypeID="Health!System.Health.GenerateAlert">

      <Priority>1</Priority>

      <Severity>2</Severity>

      <AlertOwner/>

      <AlertMessageId>$MPElement[Name="Microsoft.Windows.DNSServer.2016.Rules.DNSSEC.TARefreshFailed.AlertMessage"]$</AlertMessageId>

      <AlertParameters>

        <AlertParameter1>$Data/EventDisplayNumber$</AlertParameter1>

        <AlertParameter2>$Data/EventSourceName$</AlertParameter2>

        <AlertParameter3>$Data/Channel$</AlertParameter3>

        <AlertParameter4>$Data/EventDescription$</AlertParameter4>

      </AlertParameters>

      <Suppression>

        <SuppressionValue>$Data/LoggingComputer$</SuppressionValue>

      </Suppression>

      <Custom1/>

      <Custom2/>

      <Custom3/>

      <Custom4/>

      <Custom5/>

      <Custom6/>

      <Custom7/>

      <Custom8/>

      <Custom9/>

      <Custom10/>

    </WriteAction>

  </WriteActions>

</Rule>