| DisplayName | Description | ID | Target | Category | Enabled | Instance Name | Counter Name | Frequency | Event_ID | Event Source | Alert Generate | Alert Severity | Alert Priority | Remotable | Event Log |
| Access Services 2010: Machine No Longer Available | This Rule collects data when a web front end machine failed to contact a back end Access Data Services machine. All future requests to this Access Data Services machine will likely fail. Traffic may be load balanced to other Access Data Services machines if they exist. | Microsoft.SharePoint.2016.Access_Data_Services_14_Machine_No_Longer_Available | Microsoft.SharePoint.2016.SPComponentInstance.AccessPage | EventCollection | True | | | 0 | 1228 | Microsoft-SharePoint Products-Access Services 2010 | False | | | True | Application |
| Access Services 2010: Out Of Memory | This Rule collects data when the backend application server Access Data Services machine runs out of memory. | Microsoft.SharePoint.2016.Access_Data_Services_14_Out_Of_Memory | Microsoft.SharePoint.2016.SPServiceInstance.Access | EventCollection | True | | | 0 | 1216 | Microsoft-SharePoint Products-Access Services 2010 | False | | | True | Application |
| Access Services: Machine No Longer Available | This Rule collects data when a web front end machine failed to contact a back end Access Data Services machine. All future requests to this Access Data Services machine will likely fail. Traffic may be load balanced to other Access Data Services machines if they exist. | Microsoft.SharePoint.2016.Access_Data_Services_Machine_No_Longer_Available | Microsoft.SharePoint.2016.SPComponentInstance.AccessPage2 | EventCollection | True | | | 0 | 1269 | Microsoft-SharePoint Products-Access Services | True | Warning | Normal | True | Application |
| Access Services: Out Of Memory |
This Rule collects data when the backend application server Access Data Services machine runs out of memory.
Event ID: {EventID}
Event Description: {EventMessage}
| Microsoft.SharePoint.2016.Access_Data_Services_Out_Of_Memory | Microsoft.SharePoint.2016.SPServiceInstance.Access2 | EventCollection | True | | | 0 | 1258 | Microsoft-SharePoint Products-Access Services | True | Warning | Normal | True | Application |
| Access Denied For Writing To Disk | This Rule collects data when the application pool used by SharePoint attempts to update a file folder and is denied access because the service account used by the application pool has inadequate permissions. | Microsoft.SharePoint.2016.Access_denied_for_writing_to_disk | Microsoft.SharePoint.2016.SPServer | EventCollection | True | | | 0 | 6589 | Microsoft-SharePoint Products-SharePoint Foundation | False | | | True | Application |
| Access Denied For Writing To Registry | This Rule collects data when the application pool used by SharePoint attempts to update a registry key or file folder and is denied access because the service account used by the application pool has inadequate permissions. | Microsoft.SharePoint.2016.Access_denied_for_writing_to_registry | Microsoft.SharePoint.2016.SPServer | EventCollection | True | | | 0 | 6588 | Microsoft-SharePoint Products-SharePoint Foundation | False | | | True | Application |
| Access Services 2010: Cannot Create Session Cache | This Rule collects data when the back end application server Access Data Services machine is not able to create an in memory cache for a user session. Users may be unable to use that specific machine for querying data for Access Services applications. | Microsoft.SharePoint.2016.Access_Services_14_Cant_Create_Session_Cache | Microsoft.SharePoint.2016.SPServiceInstance.Access | EventCollection | True | | | 0 | 1211 | Microsoft-SharePoint Products-Access Services 2010 | False | | | True | Application |
| Access Services 2010: Failed To Access Configuration Database | This Rule collects data when the back end Access Data Services application server fails to access the configuration database and may not be able to read or save any settings. | Microsoft.SharePoint.2016.Access_Services_14_Conifguration_Database_Access_Failed | Microsoft.SharePoint.2016.SPServiceInstance.Access | EventCollection | True | | | 0 | 0 | Microsoft-SharePoint Products-Access Services 2010 | False | | | True | Application |
| Access Services 2010: Failed To Load Calculation Library | This Rule collects data when Access Services fails to load a required library, the calculation library. The server may not be able to process requests. | Microsoft.SharePoint.2016.Access_Services_14_Failed_To_Load_Calculation_Library | Microsoft.SharePoint.2016.SPServiceInstance.Access | EventCollection | True | | | 0 | 1217 | Microsoft-SharePoint Products-Access Services 2010 | False | | | True | Application |
| Access Services 2010: Template File Error | This Rule collects data when an Access template file is missing or when there was an error reading it from the hard disk or the template file wasn't valid. | Microsoft.SharePoint.2016.Access_Services_14_Template_Input_Output_Error | Microsoft.SharePoint.2016.SPComponentInstance.AccessPage | EventCollection | True | | | 0 | 0 | Microsoft-SharePoint Products-Access Services 2010 | False | | | True | Application |
| Access Services: Cannot Create Session Cache |
This Rule collects data when the back end application server Access Data Services machine is not able to create an in memory cache for a user session. Users may be unable to use that specific machine for querying data for Access Services applications.
Event ID: {EventID}
Event Description: {EventMessage}
| Microsoft.SharePoint.2016.Access_Services_Cant_Create_Session_Cache | Microsoft.SharePoint.2016.SPServiceInstance.Access2 | EventCollection | True | | | 0 | 1257 | Microsoft-SharePoint Products-Access Services | True | Warning | Normal | True | Application |
| Access Services: Failed To Access Configuration Database | This Rule collects data when the back end Access Data Services application server fails to access the configuration database and may not be able to read or save any settings. | Microsoft.SharePoint.2016.Access_Services_Conifguration_Database_Access_Failed | Microsoft.SharePoint.2016.SPServiceInstance.Access2 | EventCollection | True | | | 0 | 0 | Microsoft-SharePoint Products-Access Services | True | Warning | Normal | True | Application |
| Access Services: Failed To Load Calculation Library | This Rule collects data when Access Services fails to load a required library, the calculation library. The server may not be able to process requests. | Microsoft.SharePoint.2016.Access_Services_Failed_To_Load_Calculation_Library | Microsoft.SharePoint.2016.SPServiceInstance.Access2 | EventCollection | True | | | 0 | 1259 | Microsoft-SharePoint Products-Access Services | True | Warning | Normal | True | Application |
| Access Services: Template File Error |
This Rule collects data when an Access template file is missing or when there was an error reading it from the hard disk or the template file wasn't valid.
Event ID: {EventID}
Event Description: {EventMessage}
| Microsoft.SharePoint.2016.Access_Services_Template_Input_Output_Error | Microsoft.SharePoint.2016.SPComponentInstance.AccessPage2 | EventCollection | True | | | 0 | 0 | Microsoft-SharePoint Products-Access Services | True | Warning | Normal | True | Application |
| Alternate Access Mapping Update Failed | This Rule collects data when the timer job used to update alternate access mappings failed on the specified server. | Microsoft.SharePoint.2016.Alternate_access_mapping_update_failed | Microsoft.SharePoint.2016.SPServer | EventCollection | True | | | 0 | 6397 | Microsoft-SharePoint Products-SharePoint Foundation | False | | | True | Microsoft-SharePoint Products-Shared/Operational |
| An Error Occurred While Communicating With The SMTP Server | This Rule collects data when an error occurs while trying to communicate with the SMTP server. | Microsoft.SharePoint.2016.An_error_occurred_while_communicating_with_the_SMTP_server | Microsoft.SharePoint.2016.SPServer | EventCollection | True | | | 0 | 6858 | Microsoft-SharePoint Products-SharePoint Foundation | False | | | True | Application |
| Backup Failed Due To Insufficient Permissions | This Rule collects data when the backup of a website fails due to the administrator having inadequate permissions to perform a backup to a file share or folder on the local server, or to the SQL Server database. | Microsoft.SharePoint.2016.Backup_failed_due_to_insufficient_permissions | Microsoft.SharePoint.2016.SPServer | EventCollection | True | | | 0 | 3353 | Microsoft-SharePoint Products-SharePoint Foundation | False | | | True | Application |
| Backup Failed Due To Timer Job Failure | This Rule collects data when the SharePoint timer job used to perform the backup of a site failed. | Microsoft.SharePoint.2016.Backup_failed_due_to_timer_job_failure | Microsoft.SharePoint.2016.SPServiceInstance.Timer | EventCollection | True | | | 0 | 7035 | Microsoft-SharePoint Products-SharePoint Foundation | False | | | True | Application |
| Cannot Connect To SMTP Host | This Rule collects data when SharePoint cannot connect to the Simple Mail Transfer Protocol (SMTP) host. | Microsoft.SharePoint.2016.Cannot_connect_to_SMTP_host | Microsoft.SharePoint.2016.SPServer | EventCollection | True | | | 0 | 6857 | Microsoft-SharePoint Products-SharePoint Foundation | False | | | True | Application |
| Cannot Connect To SQL Server | This Rule collects data when SharePoint could not connect to the SQL Server database. | Microsoft.SharePoint.2016.Cannot_connect_to_SQL_Server | Microsoft.SharePoint.2016.SPServer | EventCollection | True | | | 0 | 3355 | Microsoft-SharePoint Products-SharePoint Foundation | False | | | True | Application |
| Cannot Resolve Name Of The Outbound SMTP Server | This Rule collects data when SharePoint cannot resolve the name of the Simple Mail Transfer Protocol (SMTP) server. This can happen because the name of the SMTP mail server is incorrect or the Domain Name Server (DNS) server is unavailable. | Microsoft.SharePoint.2016.Cannot_resolve_name_of_the_outbound_SMTP_server | Microsoft.SharePoint.2016.SPServer | EventCollection | True | | | 0 | 6856 | Microsoft-SharePoint Products-SharePoint Foundation | False | | | True | Application |
| User Profile Service Commit User Profile Failure | This Rule collects data when User Profile fails to commit a User Profile. | Microsoft.SharePoint.2016.Core.CommitUserProfileFailure | Microsoft.SharePoint.2016.SPServiceInstance.UserProfile | EventCollection | True | | | 0 | 5188 | Microsoft-SharePoint Products-SharePoint Portal Server | False | | | True | Application |
| User Profile Service Create MySite Failure | This Rule collects data when User Profile fails to create a MySite. | Microsoft.SharePoint.2016.Core.CreateMySiteFailure | Microsoft.SharePoint.2016.SPServiceInstance.UserProfile | EventCollection | True | | | 0 | 5187 | Microsoft-SharePoint Products-SharePoint Portal Server | False | | | True | Application |
| Enterprise Content Management Deployment Failed | This Rule collects data when Enterprise Content Management deployment has failed. | Microsoft.SharePoint.2016.ECM.ContentDeploymentFailed | Microsoft.SharePoint.2016.SPServiceInstance.Taxonomy | EventCollection | True | | | 0 | 0 | Microsoft-SharePoint Products-Web Content Management | False | | | True | Application |
| Enterprise Managed Metadata Service Is Inaccessible | This Rule collects data when Enterprise Managed Metadata Service is inaccessible. | Microsoft.SharePoint.2016.ECM.EcmMetadataServiceOfflineFailure | Microsoft.SharePoint.2016.SPServiceInstance.Taxonomy | EventCollection | True | | | 0 | 8088 | Microsoft-SharePoint Products-SharePoint Server | False | | | True | Application |
| Enterprise Content Management Disk Based Cache Is At Critical Capacity | This Rule collects data on Blob Cache Fill Ratio counter to measure the ratio of amount of disk occupied to max disk-based cache size configured. | Microsoft.SharePoint.2016.ECM_Disk_Based_Cache_Is_At_Critical_Capacity | Microsoft.SharePoint.2016.SPServiceInstance.Taxonomy | PerformanceCollection | True | SharePoint Disk-Based Cache | Blob Cache fill ratio | 300 | 0 | | False | | | True | |
| Enterprise Content Management Disk-Based Cache Is Compacting | This Rule collects data on Total Number Of Cache Compactions counter to measure the total number of times the disk-based cache has compacted due to size. | Microsoft.SharePoint.2016.ECM_Disk_Based_Cache_Is_Compacting | Microsoft.SharePoint.2016.SPServiceInstance.Taxonomy | PerformanceCollection | True | SharePoint Disk-Based Cache | Total number of cache compactions | 300 | 0 | | False | | | True | |
| Enterprise Content Management Disk-Based Cache Is Flushing | This Rule collects data on Blob Cache Flushes / Second counter to measure the rate at which the disk-based cache is updating due to site changes. | Microsoft.SharePoint.2016.ECM_Disk_Based_Cache_Is_Flushing | Microsoft.SharePoint.2016.SPServiceInstance.Taxonomy | PerformanceCollection | True | SharePoint Disk-Based Cache | Blob cache flushes / second | 300 | 0 | | False | | | True | |
| Enterprise Content Management Disk-Based Cache Is Misconfigured | This Rule collects data when Enterprise Content Management Disk-Based Cache is misconfigured. | Microsoft.SharePoint.2016.ECM_Disk_Based_Cache_Is_Misconfigured | Microsoft.SharePoint.2016.SPServiceInstance.Taxonomy | EventCollection | True | | | 0 | 5787 | Microsoft-SharePoint Products-Web Content Management | False | | | True | Microsoft-SharePoint Products-Shared/Operational |
| Event Log Flooding Protection Activated | This Rule collects data when Event Log Flood Protection was activated because an event was fired more than 5 times in 2 minutes. | Microsoft.SharePoint.2016.EventLogFlooding | Microsoft.SharePoint.2016.SPServer | EventCollection | True | | | 0 | 0 | Microsoft-SharePoint Products-SharePoint Server | False | | | True | Application |
| Event Receiver Failed | This Rule collects data when the event receiver failed. | Microsoft.SharePoint.2016.EventReceiverFailed | Microsoft.SharePoint.2016.SPServer | EventCollection | True | | | 0 | 6875 | Microsoft-SharePoint Products-SharePoint Foundation | False | | | True | Application |
| Event Handler Failed To Load | This Rule collects data when the specified event handler failed to load. This can happen because the event receiver assembly is missing or the assembly does not have the event receiver class. | Microsoft.SharePoint.2016.Event_handler_failed_to_load | Microsoft.SharePoint.2016.SPServer | EventCollection | True | | | 0 | 6644 | Microsoft-SharePoint Products-SharePoint Foundation | False | | | True | Application |
| Exception In Execute Method Of Job Definition | This Rule collects data when an exception occurred in the execute method of the job definition for a particular timer job. | Microsoft.SharePoint.2016.Exception_in_execute_method_of_job_definition | Microsoft.SharePoint.2016.SPServiceInstance.Timer | EventCollection | True | | | 0 | 6398 | Microsoft-SharePoint Products-SharePoint Foundation | False | | | True | Application |
| Access Services: Failed To Contact Access Application Server | This Rule collects data when a web front end machine was unable to communicate with a specific back end Access Data Services application server. Traffic will be load balanced to another server if one is available. | Microsoft.SharePoint.2016.Failed_To_Contact_Access_Data_Services | Microsoft.SharePoint.2016.SPComponentInstance.AccessPage2 | EventCollection | True | | | 0 | 0 | Microsoft-SharePoint Products-Access Services | True | Warning | Normal | True | Application |
| Access Services 2010: Failed To Contact Access Application Server | This Rule collects data when a web front end machine was unable to communicate with a specific back end Access Data Services application server. Traffic will be load balanced to another server if one is available. | Microsoft.SharePoint.2016.Failed_To_Contact_Access_Data_Services_14 | Microsoft.SharePoint.2016.SPComponentInstance.AccessPage | EventCollection | True | | | 0 | 0 | Microsoft-SharePoint Products-Access Services 2010 | False | | | True | Application |
| Failed To Create Site | This Rule collects data when an attempt to create a new SharePoint site has failed. | Microsoft.SharePoint.2016.Failed_to_create_a_SharePoint_site | Microsoft.SharePoint.2016.SPServer | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | True | Application |
| Mail Service Cannot Deliver Email Rule | This Rule collects data when a large number of Incoming Email Service lookup fails. | Microsoft.SharePoint.2016.IncomingMail_CannotDeliverEmail | Microsoft.SharePoint.2016.SPServiceInstance.IncomingMail | EventCollection | True | | | 0 | 6873 | Microsoft-SharePoint Products-SharePoint Foundation | False | | | True | Microsoft-SharePoint Products-Shared/Operational |
| SharePoint Lists Cannot Receive Email Rule | This Rule collects data when SharePoint Lists cannot receive email. | Microsoft.SharePoint.2016.IncomingMail_ListsCannotReceiveEmail | Microsoft.SharePoint.2016.SPServiceInstance.IncomingMail | EventCollection | True | | | 0 | 6872 | Microsoft-SharePoint Products-SharePoint Foundation | False | | | True | Application |
| Windows SMTP Service Is Not Running Rule | This Rule collects data when Windows SMTP Service is not running. | Microsoft.SharePoint.2016.IncomingMail_STMPServiceIsNotRunning | Microsoft.SharePoint.2016.SPServiceInstance.IncomingMail | EventCollection | True | | | 0 | 6599 | Microsoft-SharePoint Products-SharePoint Foundation | False | | | True | Application |
| Insufficient SQL Server Database Permissions | This Rule collects data when insufficient privileges have been granted in the SQL Server database to the service account specified in SharePoint. | Microsoft.SharePoint.2016.Insufficient_SQL_Server_database_permissions | Microsoft.SharePoint.2016.SPServer | EventCollection | True | | | 0 | 5214 | Microsoft-SharePoint Products-SharePoint Foundation | False | | | True | Application |
| InfoPath Forms Services Business Logic Exceeded The Maximum Limit Of Operations | This Rule collects data when an error occurred in the business logic of a form. | Microsoft.SharePoint.2016.IPFSBusinessLogicExceededReentrantCount | Microsoft.SharePoint.2016.SPServiceInstance.Forms | EventCollection | True | | | 0 | 5340 | Microsoft-SharePoint Products-InfoPath Forms Services | False | | | True | Application |
| InfoPath Forms Services Business Logic Failed Due To An Exception | This Rule collects data when Business Logic in a form template failed due to an exception. | Microsoft.SharePoint.2016.IPFSBusinessLogicFailed | Microsoft.SharePoint.2016.SPServiceInstance.Forms | EventCollection | True | | | 0 | 5337 | Microsoft-SharePoint Products-InfoPath Forms Services | False | | | True | Microsoft-SharePoint Products-Shared/Operational |
| InfoPath Forms Services Business Logic Exception Occurred While Loading A Form Template | This Rule collects data when a form template cannot be loaded by InfoPath Forms Services due to a business logic exception. | Microsoft.SharePoint.2016.IPFSBusinessLogicLoadException | Microsoft.SharePoint.2016.SPServiceInstance.Forms | EventCollection | True | | | 0 | 5343 | Microsoft-SharePoint Products-InfoPath Forms Services | False | | | True | Application |
| InfoPath Forms Services Business Logic Out Of Memory | This Rule collects data when a memory allocation made by business logic could not be satisfied. | Microsoft.SharePoint.2016.IPFSBusinessLogicOutOfMemory | Microsoft.SharePoint.2016.SPServiceInstance.Forms | EventCollection | True | | | 0 | 5342 | Microsoft-SharePoint Products-InfoPath Forms Services | False | | | True | Application |
| InfoPath Forms Services Form Templates Have Conflicting Business Logic Assembly Identities | This Rule collects data when conflicting assemblies are identified, an entry is logged in the Windows Event log. | Microsoft.SharePoint.2016.IPFSConflictingAssemblyIdentitiesFound | Microsoft.SharePoint.2016.SPServiceInstance.Forms | EventCollection | True | | | 0 | 5733 | Microsoft-SharePoint Products-InfoPath Forms Services | False | | | True | Application |
| InfoPath Forms Services An Illegal Cross-Domain Query Data Connection Was Attempted | This Rule collects data when a form could not retrieve data from a data source because it would violate cross-domain restrictions. | Microsoft.SharePoint.2016.IPFSDataAdapterSecurityErrorQuery | Microsoft.SharePoint.2016.SPServiceInstance.Forms | EventCollection | True | | | 0 | 6932 | Microsoft-SharePoint Products-InfoPath Forms Services | False | | | True | Microsoft-SharePoint Products-Shared/Operational |
| InfoPath Forms Services An Illegal Cross-Domain Submit Data Connection Was Attempted | This Rule collects data when a form could not be submitted to a data source by InfoPath Forms Services because this action would violate cross-domain security restrictions. | Microsoft.SharePoint.2016.IPFSDataAdapterSecurityErrorSubmit | Microsoft.SharePoint.2016.SPServiceInstance.Forms | EventCollection | True | | | 0 | 5758 | Microsoft-SharePoint Products-InfoPath Forms Services | False | | | True | Microsoft-SharePoint Products-Shared/Operational |
| InfoPath Forms Services Business Logic Attempted To Store A Non-Serializable Object | This Rule collects data when InfoPath Forms Services Business Logic attempts to store a non-serialized object. | Microsoft.SharePoint.2016.IPFSNonSerializableBusinessLogic | Microsoft.SharePoint.2016.SPServiceInstance.Forms | EventCollection | True | | | 0 | 5734 | Microsoft-SharePoint Products-InfoPath Forms Services | False | | | True | Application |
| InfoPath Forms Services Postback Failure | This Rule collects data when an error occurred while a form request was being processed by InfoPath Forms Services. | Microsoft.SharePoint.2016.IPFSPostbackFailure | Microsoft.SharePoint.2016.SPServiceInstance.Forms | EventCollection | True | | | 0 | 5374 | Microsoft-SharePoint Products-InfoPath Forms Services | False | | | True | Application |
| InfoPath Forms Services Form Templates Are Being Reloaded Frequently In Memory | This Rule collects data when Form Templates are being reloaded frequently in memory. | Microsoft.SharePoint.2016.IPFSSolutionCacheChurning | Microsoft.SharePoint.2016.SPServiceInstance.Forms | EventCollection | True | | | 0 | 5759 | Microsoft-SharePoint Products-InfoPath Forms Services | False | | | True | Microsoft-SharePoint Products-Shared/Operational |
| InfoPath Forms Services Failed To Load A Form Template | This Rule collects data when a form template could not be loaded by InfoPath Forms Services. | Microsoft.SharePoint.2016.IPFSSolutionLoadFailure | Microsoft.SharePoint.2016.SPServiceInstance.Forms | EventCollection | True | | | 0 | 7056 | Microsoft-SharePoint Products-InfoPath Forms Services | False | | | True | Application |
| Access Services 2010: Machine Is Not Available | This Rule collects data when no Access Data Services machines are available. All requests for Access Service applications that consume any data will fail. | Microsoft.SharePoint.2016.No_Access_Data_Services_14_Machine_Is_Available | Microsoft.SharePoint.2016.SPComponentInstance.AccessPage | EventCollection | True | | | 0 | 1229 | Microsoft-SharePoint Products-Access Services 2010 | False | | | True | Application |
| Access Services: Machine Is Not Available | This Rule collects data when no Access Data Services machines are available. All requests for Access Service applications that consume any data will fail. | Microsoft.SharePoint.2016.No_Access_Data_Services_Machine_Is_Available | Microsoft.SharePoint.2016.SPComponentInstance.AccessPage2 | EventCollection | True | | | 0 | 1270 | Microsoft-SharePoint Products-Access Services | True | Error | High | True | Application |
| Page Response Time | This Rule collects data on Executing Time/Page Request counter which counts the amount of time application is taking to render a webpage. | Microsoft.SharePoint.2016.Responsetime | Microsoft.SharePoint.2016.SPServer | PerformanceCollection | False | SharePoint Foundation | Executing Time/Page Request | 300 | 0 | | False | | | True | |
| Service Instance Provisioning Failed | This Rule collects data when an attempt to start or stop a service instance on a server in the server farm has failed. Additional details about why the service could not be started or stopped are included in the exception message of the Windows NT Event log. | Microsoft.SharePoint.2016.Service_instance_provisioning_failed | Microsoft.SharePoint.2016.SPServer | EventCollection | True | | | 0 | 7034 | Microsoft-SharePoint Products-SharePoint Foundation | False | | | True | Application |
| SharePoint Administration Service Is Disabled | This Rule collects data when the SharePoint timer job is executed and discovers that the SharePoint Administration service is disabled. | Microsoft.SharePoint.2016.SharePoint_Administration_service_is_disabled | Microsoft.SharePoint.2016.SPServiceInstance.Admin | EventCollection | True | | | 0 | 7399 | Microsoft-SharePoint Products-SharePoint Foundation | False | | | True | Microsoft-SharePoint Products-Shared/Operational |
| Server Is About To Enter Into Throttling State | This Rule collects data when the Server is about to enter into throttling state. | Microsoft.SharePoint.2016.SPServer_ThrottlingState | Microsoft.SharePoint.2016.SPServer | EventCollection | True | | | 0 | 8032 | Microsoft-SharePoint Products-SharePoint Foundation | False | | | True | Application |
| Collect Usage table exceeded max bytes limit event | Collect Usage table exceeded max bytes limit event. | Microsoft.SharePoint.2016.SPServiceInstance.Usage.CollectUsageTableExceededMaxBytesEvent | Microsoft.SharePoint.2016.SPServiceInstance.Usage | EventCollection | True | | | 0 | 8319 | Microsoft-SharePoint Products-SharePoint Foundation | False | | | True | Application |
| SQL Server Database Is Full | This Rule collects data when a SQL Server error occurred because the database size limit has been reached. | Microsoft.SharePoint.2016.SQL_Server_database_is_full | Microsoft.SharePoint.2016.SPServer | EventCollection | True | | | 0 | 3758 | Microsoft-SharePoint Products-SharePoint Foundation | False | | | True | Application |
| SQL Server Database Login Failed | This Rule collects data when the user name or password for the SharePoint account was invalid before the session or became invalid during the session. | Microsoft.SharePoint.2016.SQL_Server_database_login_failed | Microsoft.SharePoint.2016.SPServer | EventCollection | True | | | 0 | 3351 | Microsoft-SharePoint Products-SharePoint Foundation | False | | | True | Application |
| The Active Directory Organization Unit Registered In SharePoint Does Not Exist | This Rule collects data when the Active Directory organizational unit that was created for account creation mode does not exist. This condition can occur due to a provisioning-time error or a runtime error. | Microsoft.SharePoint.2016.The_Active_Directory_organization_unit_registered_in_Windows | Microsoft.SharePoint.2016.SPServer | EventCollection | True | | | 0 | 3360 | Microsoft-SharePoint Products-SharePoint Foundation | False | | | True | Application |
| The Application Pool Account Has Insufficient Permissions To Add User Accounts To Active Directory | This Rule collects data when the application pool account used by a SharePoint site lacks permissions to add user information to the Active Directory. | Microsoft.SharePoint.2016.The_application_pool_account_has_insufficient_permissions_to_add_user_accounts_to_Active_Directory | Microsoft.SharePoint.2016.SPServer | EventCollection | True | | | 0 | 3359 | Microsoft-SharePoint Products-SharePoint Foundation | False | | | True | Application |
| The Application Pool Account Must Be Registered As A Kerberos Service Provider | This Rule collects data when the application pool account has insufficient permissions to add user accounts to Active Directory. When using Kerberos authentication, the service account used by the Internet Information Services (IIS) application pool for your Web application must be registered in Active Directory as a Service Principal Name (SPN) on the domain on which the Web front-end is a member. | Microsoft.SharePoint.2016.The_application_pool_account_must_be_registered_as_a_Kerberos | Microsoft.SharePoint.2016.SPServer | EventCollection | True | | | 0 | 6590 | Microsoft-SharePoint Products-SharePoint Foundation | True | Warning | Normal | True | Microsoft-SharePoint Products-Shared/Operational |
| Timer Job To Update Central Admin Failed | This Rule collects data when the SharePoint timer job to update central administration on a particular URL failed. | Microsoft.SharePoint.2016.TimerJobToUpdateCentralAdminFailed | Microsoft.SharePoint.2016.SPServer | EventCollection | True | | | 0 | 7037 | Microsoft-SharePoint Products-SharePoint Foundation | False | | | True | Microsoft-SharePoint Products-Shared/Operational |
| Unable To Load Authentication Provider | This Rule collects data when the Role Manager or Membership Provider that is specified for a particular web application is incorrectly configured. | Microsoft.SharePoint.2016.Unable_to_load_authentication_provider | Microsoft.SharePoint.2016.SPServer | EventCollection | True | | | 0 | 6143 | Microsoft-SharePoint Products-SharePoint Foundation | False | | | True | Application |
| Unable To Write To Trace Log | This Rule collects data when the SharePoint cannot write to the Windows Trace log. This can happen because the hard drive on which the Trace log is located is full or the permissions on the trace logging directory are not set correctly. | Microsoft.SharePoint.2016.Unable_to_write_to_trace_log | Microsoft.SharePoint.2016.SPServiceInstance.Trace | EventCollection | True | | | 0 | 5401 | Microsoft-SharePoint Products-SharePoint Foundation | False | | | True | Application |
| Visio Graphics Services: Can't connect to the application server | This rule collects data when the Visio Graphics Service cannot connect to the application server. | Microsoft.SharePoint.2016.VGSApplicationProxyInvalidEndpoint | Microsoft.SharePoint.2016.SPServiceInstance.Visio | EventCollection | True | | | 0 | 8049 | Microsoft-SharePoint Products-Visio Graphics Service | False | | | True | Application |
| Visio Graphics Services: Can't find configuration manager | This rule collects data when the Visio Graphics Service cannot find the configuration manager. | Microsoft.SharePoint.2016.VGSConfigurationManagerNotFound | Microsoft.SharePoint.2016.SPServiceInstance.Visio | EventCollection | True | | | 0 | 8040 | Microsoft-SharePoint Products-Visio Graphics Service | False | | | True | Application |
| Visio Graphics Services: Unable to connect to a requested data provider | This rule collects data when Visio Graphics Service was unable to connect to a requested data provider. | Microsoft.SharePoint.2016.VGSDataProviderNotFound | Microsoft.SharePoint.2016.SPServiceInstance.Visio | EventCollection | True | | | 0 | 8050 | Microsoft-SharePoint Products-Visio Graphics Service | False | | | True | Application |
| Visio Graphics Services: Failed to initialize the rasterizer | This rule collects data when the Visio Graphics Service failed to initialize the rasterizer. | Microsoft.SharePoint.2016.VGSFailedToInitializeRasterizer | Microsoft.SharePoint.2016.SPServiceInstance.Visio | EventCollection | True | | | 0 | 8076 | Microsoft-SharePoint Products-Visio Graphics Service | False | | | True | Application |
| Visio Graphics Services: Requested data from a non-trusted provider | This rule collects data when Visio Graphics Service tried to get data from a provider that is not in the trusted provider's list. | Microsoft.SharePoint.2016.VGSUntrustedDataProviderRequest | Microsoft.SharePoint.2016.SPServiceInstance.Visio | EventCollection | True | | | 0 | 8041 | Microsoft-SharePoint Products-Visio Graphics Service | False | | | True | Application |