Forensic: Failed to retrieve the monitoring states or state change events for a monitoring object. This is usually a transient issue.

_1C56328B_E3CF_4EF3_ACA6_4B8137B8310D_ (UnitMonitor)

Knowledge Base article:

Element properties:

Source Code:

<UnitMonitor ID="_1C56328B_E3CF_4EF3_ACA6_4B8137B8310D_" Enabled="onEssentialMonitoring" Target="Microsoft.Exchange.2010.MonitoringCorrelationEngine" ParentMonitorID="Microsoft.Exchange.2010.MonitoringCorrelationEngine.ForensicMonitorsContainerAvailabilityHealth" Accessibility="Public" TypeID="Correlation.StatefulWindowsEventTimerMonitorType" Comment="EscalationTeam='Datacenter'">

  <Category>AvailabilityHealth</Category>

  <OperationalStates>

    <OperationalState ID="Success" MonitorTypeStateID="TimerEventRaised" HealthState="Success"/>

    <OperationalState ID="Warning" MonitorTypeStateID="EventRaised" HealthState="Warning"/>

  </OperationalStates>

  <Configuration>

    <MonitorType>Forensic</MonitorType>

    <ComputerName>.</ComputerName>

    <LogName>Application</LogName>

    <Expression>

      <And>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="UnsignedInteger">721</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="String">PublisherName</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="String">MSExchangeMonitoringCorrelation</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

      </And>

    </Expression>

    <TimerWaitInSeconds>300</TimerWaitInSeconds>

  </Configuration>

</UnitMonitor>