Current state entries at warning level

Network_Security_StateUtil_Warning (UnitMonitor)

This is a warning alarm generated because "Current State Entries" counter (under the object "IPSec DOS Protection" in the performance monitor tool) exceeded warning levels. "Current state Entries" is the number of active state entries in the table. A state entry is a pair of IPv6 addresses that is authorized to pass through from a public to an internal interface. This alarm is cleared when the counter returns to healthy levels.

Knowledge Base article:

Summary

This is a warning alarm generated because the "Current State Entries" counter (under the object "IPSec DOS Protection" in the performance monitor tool) exceeded warning levels. "Current state Entries" is the number of active state entries in the table. A state entry is a pair of IPv6 addresses that is authorized to pass through from a public to an internal interface. This alarm is cleared when the counter returns to healthy levels.

Resolutions

To perform this procedure, you must be a member of the Administrators group, or you must have been delegated the appropriate authority.

Use the following netsh command to adjust the maximum number of active sessions defined in this server:

netsh ipsecdosprotection set miscellaneous maxentries=<no. of entries>

Maxentries can range from 1 to 4294967295.

Element properties:

Target	Network_Security_Class
Parent Monitor	System.Health.ConfigurationState
Category	ConfigurationHealth
Enabled	True
Instance Name	IPsec DOS Protection
Counter Name	Current State Entries
Frequency	300
Alert Generate	False
Alert Auto Resolve	True
Monitor Type	System.Performance.ConsecutiveSamplesThreshold
Remotable	True
Accessibility	Public
RunAs	Default

Source Code:

<UnitMonitor ID="Network_Security_StateUtil_Warning" Accessibility="Public" Enabled="true" Target="Network_Security_Class" ParentMonitorID="Health!System.Health.ConfigurationState" Remotable="true" Priority="Normal" TypeID="Performance!System.Performance.ConsecutiveSamplesThreshold" ConfirmDelivery="false">

  <Category>ConfigurationHealth</Category>

  <OperationalStates>

    <OperationalState ID="ConditionFalse" MonitorTypeStateID="ConditionFalse" HealthState="Success"/>

    <OperationalState ID="ConditionTrue" MonitorTypeStateID="ConditionTrue" HealthState="Warning"/>

  </OperationalStates>

  <Configuration>

    <ComputerName>$Target/Host/Host/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

    <CounterName>Current State Entries</CounterName>

    <ObjectName>IPsec DOS Protection</ObjectName>

    <InstanceName/>

    <AllInstances>false</AllInstances>

    <Frequency>300</Frequency>

    <Threshold>1000</Threshold>

    <Direction>greaterequal</Direction>

    <NumSamples>5</NumSamples>

  </Configuration>

</UnitMonitor>