WSRM - Unable to log accounting information

WSRM___Unable_to_log_accounting_information_1_Rule (Rule)

Knowledge Base article:

Management Pack

Summary
Windows System Resource Manager (WSRM) was unable to log accounting information into the database. The logged data provides information about resource usage by processes.

Causes
The accounting volume may be out of disk space, or the accounting database might have become corrupt.

Resolutions
Consider freeing up some disk space by archiving and deleting old accounting data. For information on how this can be done, please refer to the WSRM online help topics. If this does not work, stop and restart the WSRM service. If the problem still persists, contact the WSRM administrator.

Sample Event
Unable to log accounting information into the database.

Element properties:

Target	Microsoft.Windows.SystemResourceManager.2003.Microsoft_Windows_System_Resource_Manager_Installation
Category	EventCollection
Enabled	True
Event_ID	504
Event Source	WSRM
Alert Generate	False
Remotable	True
Event Log	Application
Comment	Mom2005ID='{4B4E9930-706F-47C9-8F16-FF8230CE9B00}';MOM2005ComputerGroupID={791B481B-0184-4791-8BE9-DEC48A385750}

Member Modules:

ID	Module Type	TypeId	RunAs
_F6DA1507_12AF_11D3_AB21_00A0C98620CE_	DataSource	Microsoft.Windows.EventProvider	Default
CollectEventData	WriteAction	Microsoft.SystemCenter.CollectEvent	Default
CollectEventDataWarehouse	WriteAction	Microsoft.SystemCenter.DataWarehouse.PublishEventData	Default
GenerateAlert	WriteAction	System.Mom.BackwardCompatibility.AlertResponse	Default

Source Code:

<Rule ID="WSRM___Unable_to_log_accounting_information_1_Rule" Target="Microsoft.Windows.SystemResourceManager.2003.Microsoft_Windows_System_Resource_Manager_Installation" Enabled="true" ConfirmDelivery="true" Comment="Mom2005ID='{4B4E9930-706F-47C9-8F16-FF8230CE9B00}';MOM2005ComputerGroupID={791B481B-0184-4791-8BE9-DEC48A385750}">

  <Category>EventCollection</Category>

  <DataSources>

    <DataSource ID="_F6DA1507_12AF_11D3_AB21_00A0C98620CE_" Comment="{F6DA1507-12AF-11D3-AB21-00A0C98620CE}" TypeID="WindowsLibrary!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Host/Property[Type="WindowsLibrary!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>Application</LogName>

      <Expression>

        <And>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="Integer">EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>504</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="String">PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>WSRM</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="GenerateAlert" TypeID="MomBackwardCompatibility!System.Mom.BackwardCompatibility.AlertResponse">

      <AlertGeneration>

        <GenerateAlert>false</GenerateAlert>

        <Owner/>

        <Description>

            $Data/EventDescription$

          </Description>

        <AlertLevel>50</AlertLevel>

        <ResolutionState/>

        <Source>

            $Data/PublisherName$

          </Source>

        <Name>WSRM - Unable to log accounting information</Name>

      </AlertGeneration>

      <InvokerType>0</InvokerType>

    </WriteAction>

    <WriteAction ID="CollectEventData" TypeID="SystemCenterLibrary!Microsoft.SystemCenter.CollectEvent"/>

    <WriteAction ID="CollectEventDataWarehouse" TypeID="DataWarehouseLibrary!Microsoft.SystemCenter.DataWarehouse.PublishEventData"/>

  </WriteActions>

</Rule>