Resume Key Filter

Microsoft.Windows.FileServices.Service.SMB.6.2.ResumeKeyLoad (UnitMonitor)

Monitors the status of the resume key and if the load of the resume key failed

Knowledge Base article:

Summary

Resume Key failed to load

Causes

If Resume Key failed to load inspect the cause in the event. It could be due to insufficient resources, such as memory, incompatibility with other file system filter drivers or corruption, such as missing files. In this state, Resume Key will be unable to grant continuous availability or resume any open handles.

Resolutions

Inspect and resolve the error specified in the event. Applications with continuously available handles opened on file shares on the affected volume(s) will have their handles closed. Once the issue has been resolved, the application owner will need to take recovery action to reestablish those handles . This could include restarting virtual machines, reattaching databases or restarting the application.

Element properties:

Target

Microsoft.Windows.FileServices.Service.SMB.6.2.Clustered

Parent Monitor

Microsoft.Windows.FileServices.Service.SMB.6.2.ContinuousAvailability

Category

AvailabilityHealth

Enabled

True

Alert Generate

True

Alert Severity

Error

Alert Priority

Normal

Alert Auto Resolve

True

Monitor Type

Microsoft.Windows.2SingleEventLog2StateMonitorType

Remotable

True

Accessibility

Public

Alert Message

Resume Key failed to load

RunAs

Default

Source Code:

<UnitMonitor ID="Microsoft.Windows.FileServices.Service.SMB.6.2.ResumeKeyLoad" TypeID="Windows!Microsoft.Windows.2SingleEventLog2StateMonitorType" Accessibility="Public" Target="Microsoft.Windows.FileServices.Service.SMB.6.2.Clustered" ParentMonitorID="Microsoft.Windows.FileServices.Service.SMB.6.2.ContinuousAvailability" Remotable="true">

  <Category>AvailabilityHealth</Category>

  <AlertSettings AlertMessage="Microsoft.Windows.FileServices.Service.SMB.6.2.ResumeKeyLoad.AlertMessage">

    <AlertOnState>Error</AlertOnState>

    <AutoResolve>true</AutoResolve>

    <AlertPriority>Normal</AlertPriority>

    <AlertSeverity>Error</AlertSeverity>

  </AlertSettings>

  <OperationalStates>

    <OperationalState ID="ResumeKeyLoadFailed" MonitorTypeStateID="FirstEventRaised" HealthState="Error"/>

    <OperationalState ID="ResumeKeyLoadOK" MonitorTypeStateID="SecondEventRaised" HealthState="Success"/>

  </OperationalStates>

  <Configuration>

    <FirstComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</FirstComputerName>

    <FirstLogName>Microsoft-Windows-ResumeKeyFilter/Operational</FirstLogName>

    <FirstExpression>

      <And>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="String">PublisherName</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="String">Microsoft-Windows-ResumeKeyFilter</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="UnsignedInteger">2000</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

      </And>

    </FirstExpression>

    <SecondComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</SecondComputerName>

    <SecondLogName>Microsoft-Windows-ResumeKeyFilter/Operational</SecondLogName>

    <SecondExpression>

      <And>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="String">PublisherName</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="String">Microsoft-Windows-ResumeKeyFilter</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="UnsignedInteger">1000</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

      </And>

    </SecondExpression>

  </Configuration>

</UnitMonitor>