Forensic: Detected catalog corruption.

_165DF048_FCC7_40a0_90A3_4028332F122C_ (UnitMonitor)

Knowledge Base article:

External Knowledge Sources

For more information, see the respective topic at the Microsoft Exchange Server TechCenter

Element properties:

Target	Microsoft.Exchange.2010.Mailbox.DatabaseSearchCopy
Parent Monitor	Microsoft.Exchange.2010.Mailbox.DatabaseSearchCopy.ForensicMonitorsContainerAvailabilityHealth
Category	AvailabilityHealth
Enabled	True
Alert Generate	False
Alert Auto Resolve	True
Monitor Type	Correlation.StatefulWindowsEventMonitorType
Remotable	True
Accessibility	Public
RunAs	Default
Comment	EscalationTeam='Content Indexing'

Source Code:

<UnitMonitor ID="_165DF048_FCC7_40a0_90A3_4028332F122C_" Target="Microsoft.Exchange.2010.Mailbox.DatabaseSearchCopy" Enabled="onEssentialMonitoring" Accessibility="Public" ParentMonitorID="Microsoft.Exchange.2010.Mailbox.DatabaseSearchCopy.ForensicMonitorsContainerAvailabilityHealth" TypeID="Correlation.StatefulWindowsEventMonitorType" Comment="EscalationTeam='Content Indexing'">

  <Category>AvailabilityHealth</Category>

  <OperationalStates>

    <OperationalState ID="OperationalGoodState" MonitorTypeStateID="SecondEventRaised" HealthState="Success"/>

    <OperationalState ID="OperationalProblemState" MonitorTypeStateID="FirstEventRaised" HealthState="Warning"/>

  </OperationalStates>

  <Configuration>

    <MonitorType>Forensic</MonitorType>

    <FirstComputerName>.</FirstComputerName>

    <FirstLogName>Application</FirstLogName>

    <FirstExpression>

      <And>

        <Expression>

          <And>

            <Expression>

              <RegExExpression>

                <ValueExpression>

                  <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                </ValueExpression>

                <Operator>MatchesRegularExpression</Operator>

                <Pattern>^(5301|5003|5005)$</Pattern>

              </RegExExpression>

            </Expression>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="String">PublisherName</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="String">CI Troubleshooter</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="String">Params/Param[2]</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="String">$Target/Property[Type='Microsoft.Exchange.2010.Component']/InstanceName$</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

          </And>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="UnsignedInteger">5301</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

      </And>

    </FirstExpression>

    <SecondComputerName>.</SecondComputerName>

    <SecondLogName>Application</SecondLogName>

    <SecondExpression>

      <And>

        <Expression>

          <And>

            <Expression>

              <RegExExpression>

                <ValueExpression>

                  <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                </ValueExpression>

                <Operator>MatchesRegularExpression</Operator>

                <Pattern>^(5301|5003|5005)$</Pattern>

              </RegExExpression>

            </Expression>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="String">PublisherName</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="String">CI Troubleshooter</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="String">Params/Param[2]</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="String">$Target/Property[Type='Microsoft.Exchange.2010.Component']/InstanceName$</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

          </And>

        </Expression>

        <Expression>

          <Not>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="UnsignedInteger">5301</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

          </Not>

        </Expression>

      </And>

    </SecondExpression>

  </Configuration>

</UnitMonitor>