SMB Resume Key Filter Attach Failed

Microsoft.Windows.FileServices.Service.SMB.6.2.ResumeKeyFilterAttach (UnitMonitor)

Monitors the status of Resume Key Filter Attach

Knowledge Base article:

Summary

Resume Key failed to attach to one or more volumes.

Causes

f Resume Key failed to attach to a cluster volume inspect the cause in the event. Resume Key will be unable to resume any open handles.

Resolutions

Inspect and resolve the error specified in the event. Applications with continuously available handles opened on file shares on the affected volume(s) will have their handles closed. Once the issue has been resolved, the application owner will need to take recovery action to reestablish those handles . This could include restarting virtual machines, reattaching databases or restarting the application.

Element properties:

Target

Microsoft.Windows.FileServices.Service.SMB.6.2.Clustered

Parent Monitor

Microsoft.Windows.FileServices.Service.SMB.6.2.ContinuousAvailability

Category

AvailabilityHealth

Enabled

True

Alert Generate

True

Alert Severity

Error

Alert Priority

Normal

Alert Auto Resolve

True

Monitor Type

Microsoft.Windows.2SingleEventLog2StateMonitorType

Remotable

True

Accessibility

Public

Alert Message

Resume Key filter failed to attach

Resume Key filter failed to attach to one or more volumes.

RunAs

Default

Source Code:

<UnitMonitor ID="Microsoft.Windows.FileServices.Service.SMB.6.2.ResumeKeyFilterAttach" TypeID="Windows!Microsoft.Windows.2SingleEventLog2StateMonitorType" Accessibility="Public" Target="Microsoft.Windows.FileServices.Service.SMB.6.2.Clustered" ParentMonitorID="Microsoft.Windows.FileServices.Service.SMB.6.2.ContinuousAvailability" Remotable="true">

  <Category>AvailabilityHealth</Category>

  <AlertSettings AlertMessage="Microsoft.Windows.FileServices.Service.SMB.6.2.ResumeKeyFilterAttach.AlertMessage">

    <AlertOnState>Error</AlertOnState>

    <AutoResolve>true</AutoResolve>

    <AlertPriority>Normal</AlertPriority>

    <AlertSeverity>Error</AlertSeverity>

  </AlertSettings>

  <OperationalStates>

    <OperationalState ID="ResumeKeyFilterAttachFailed" MonitorTypeStateID="FirstEventRaised" HealthState="Error"/>

    <OperationalState ID="ResumeKeyFilterAttachOK" MonitorTypeStateID="SecondEventRaised" HealthState="Success"/>

  </OperationalStates>

  <Configuration>

    <FirstComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</FirstComputerName>

    <FirstLogName>Microsoft-Windows-ResumeKeyFilter/Operational</FirstLogName>

    <FirstExpression>

      <And>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="String">PublisherName</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="String">Microsoft-Windows-ResumeKeyFilter</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="UnsignedInteger">2001</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

      </And>

    </FirstExpression>

    <SecondComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</SecondComputerName>

    <SecondLogName>Microsoft-Windows-ResumeKeyFilter/Operational</SecondLogName>

    <SecondExpression>

      <And>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="String">PublisherName</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="String">Microsoft-Windows-ResumeKeyFilter</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="UnsignedInteger">1001</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

      </And>

    </SecondExpression>

  </Configuration>

</UnitMonitor>