KHI: The Microsoft Search (Exchange) service (msftesql-Exchange) has restarted more than 5 times within 30 minutes.

_310ecf22_a0b9_4cb1_9742_3336f7f72e5c_ (UnitMonitor)

Knowledge Base article:

External Knowledge Sources

For more information, see the respective topic at the Microsoft Exchange Server TechCenter

Element properties:

TargetMicrosoft.Exchange.2010.Mailbox.ContentIndexingService
Parent MonitorSystem.Health.AvailabilityState
CategoryAvailabilityHealth
EnabledTrue
Alert GenerateFalse
Alert Auto ResolveTrue
Monitor TypeCorrelation.StatefulRepeatedWindowsEventTimerMonitorType
RemotableTrue
AccessibilityPublic
RunAsDefault
CommentActionable='False';Urgent='False';EscalationTeam='Content Indexing'

Source Code:

<UnitMonitor ID="_310ecf22_a0b9_4cb1_9742_3336f7f72e5c_" Target="Microsoft.Exchange.2010.Mailbox.ContentIndexingService" Enabled="onEssentialMonitoring" Accessibility="Public" Remotable="true" ParentMonitorID="SystemHealth!System.Health.AvailabilityState" TypeID="Correlation.StatefulRepeatedWindowsEventTimerMonitorType" Comment="Actionable='False';Urgent='False';EscalationTeam='Content Indexing'">
<Category>AvailabilityHealth</Category>
<OperationalStates>
<OperationalState ID="Success" MonitorTypeStateID="TimerEventRaised" HealthState="Success"/>
<OperationalState ID="Warning" MonitorTypeStateID="EventRaised" HealthState="Warning"/>
</OperationalStates>
<Configuration>
<MonitorType>KHI</MonitorType>
<TimeWindowInSeconds>1800</TimeWindowInSeconds>
<RepeatThreshold>5</RepeatThreshold>
<ComputerName>.</ComputerName>
<LogName>Application</LogName>
<Expression>
<And>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="UnsignedInteger">1003</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="String">PublisherName</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="String">MSFTESQL-Exchange</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</And>
</Expression>
<TimerWaitInSeconds>14400</TimerWaitInSeconds>
</Configuration>
</UnitMonitor>