| DisplayName | Description | ID | Target | Category | Enabled | Instance Name | Counter Name | Frequency | Event_ID | Event Source | Alert Generate | Alert Severity | Alert Priority | Remotable | Event Log |
| Access Denied For Writing To Disk | This Rule collects data when the application pool used by SharePoint Foundation 2010 attempts to update a file folder and is denied access because the service account used by the application pool has inadequate permissions. | Microsoft.SharePoint.Foundation.2010.Access_denied_for_writing_to_disk | Microsoft.SharePoint.Foundation.2010.SPServer | EventCollection | True | | | 0 | 6589 | Microsoft-SharePoint Products-SharePoint Foundation | False | | | True | Application |
| Access Denied For Writing To Registry | This Rule collects data when the application pool used by SharePoint Foundation 2010 attempts to update a registry key or file folder and is denied access because the service account used by the application pool has inadequate permissions. | Microsoft.SharePoint.Foundation.2010.Access_denied_for_writing_to_registry | Microsoft.SharePoint.Foundation.2010.SPServer | EventCollection | True | | | 0 | 6588 | Microsoft-SharePoint Products-SharePoint Foundation | False | | | True | Application |
| Alternate Access Mapping Update Failed | This Rule collects data when the timer job used to update alternate access mappings failed on the specified server. | Microsoft.SharePoint.Foundation.2010.Alternate_access_mapping_update_failed | Microsoft.SharePoint.Foundation.2010.SPServer | EventCollection | True | | | 0 | 6397 | Microsoft-SharePoint Products-SharePoint Foundation | False | | | True | Microsoft-SharePoint Products-Shared/Operational |
| An Error Occurred While Communicating With The SMTP Server | This Rule collects data when an error occurs while trying to communicate with the SMTP server. | Microsoft.SharePoint.Foundation.2010.An_error_occurred_while_communicating_with_the_SMTP_server | Microsoft.SharePoint.Foundation.2010.SPServer | EventCollection | True | | | 0 | 6858 | Microsoft-SharePoint Products-SharePoint Foundation | False | | | True | Application |
| Backup Failed Due To Insufficient Permissions | This Rule collects data when the backup of a website fails due to the administrator having inadequate permissions to perform a backup to a file share or folder on the local server, or to the SQL Server database. | Microsoft.SharePoint.Foundation.2010.Backup_failed_due_to_insufficient_permissions | Microsoft.SharePoint.Foundation.2010.SPServer | EventCollection | True | | | 0 | 3353 | Microsoft-SharePoint Products-SharePoint Foundation | False | | | True | Application |
| Backup Failed Due To Timer Job Failure | This Rule collects data when the SharePoint Foundation 2010 timer job used to perform the backup of a site failed. | Microsoft.SharePoint.Foundation.2010.Backup_failed_due_to_timer_job_failure | Microsoft.SharePoint.Foundation.2010.SPServiceInstance.Timer | EventCollection | True | | | 0 | 7035 | Microsoft-SharePoint Products-SharePoint Foundation | False | | | True | Application |
| Cannot Connect To SMTP Host | This Rule collects data when SharePoint Foundation 2010 cannot connect to the Simple Mail Transfer Protocol (SMTP) host. | Microsoft.SharePoint.Foundation.2010.Cannot_connect_to_SMTP_host | Microsoft.SharePoint.Foundation.2010.SPServer | EventCollection | True | | | 0 | 6857 | Microsoft-SharePoint Products-SharePoint Foundation | False | | | True | Application |
| Cannot Connect To SQL Server | This Rule collects data when SharePoint Foundation 2010 could not connect to the SQL Server database. | Microsoft.SharePoint.Foundation.2010.Cannot_connect_to_SQL_Server | Microsoft.SharePoint.Foundation.2010.SPServer | EventCollection | True | | | 0 | 3355 | Microsoft-SharePoint Products-SharePoint Foundation | False | | | True | Application |
| Cannot Resolve Name Of The Outbound SMTP Server | This Rule collects data when SharePoint Foundation 2010 cannot resolve the name of the Simple Mail Transfer Protocol (SMTP) server. This can happen because the name of the SMTP mail server is incorrect or the Domain Name Server (DNS) server is unavailable. | Microsoft.SharePoint.Foundation.2010.Cannot_resolve_name_of_the_outbound_SMTP_server | Microsoft.SharePoint.Foundation.2010.SPServer | EventCollection | True | | | 0 | 6856 | Microsoft-SharePoint Products-SharePoint Foundation | False | | | True | Application |
| Event Log Flooding Protection Activated | This Rule collects data when Event Log Flood Protection was activated because an event was fired more than 5 times in 2 minutes. | Microsoft.SharePoint.Foundation.2010.EventLogFlooding | Microsoft.SharePoint.Foundation.2010.SPServer | EventCollection | True | | | 0 | 0 | Microsoft-SharePoint Products-SharePoint Foundation | False | | | True | Application |
| Event Receiver Failed | This Rule collects data when the event receiver failed. | Microsoft.SharePoint.Foundation.2010.EventReceiverFailed | Microsoft.SharePoint.Foundation.2010.SPServer | EventCollection | True | | | 0 | 6875 | Microsoft-SharePoint Products-SharePoint Foundation | False | | | True | Application |
| Event Handler Failed To Load | This Rule collects data when the specified event handler failed to load. This can happen because the event receiver assembly is missing or the assembly does not have the event receiver class. | Microsoft.SharePoint.Foundation.2010.Event_handler_failed_to_load | Microsoft.SharePoint.Foundation.2010.SPServer | EventCollection | True | | | 0 | 6644 | Microsoft-SharePoint Products-SharePoint Foundation | False | | | True | Application |
| Exception In Execute Method Of Job Definition | This Rule collects data when an exception occurred in the execute method of the job definition for a particular timer job. | Microsoft.SharePoint.Foundation.2010.Exception_in_execute_method_of_job_definition | Microsoft.SharePoint.Foundation.2010.SPServiceInstance.Timer | EventCollection | True | | | 0 | 6398 | Microsoft-SharePoint Products-SharePoint Foundation | False | | | True | Application |
| Failed To Create Site | This Rule collects data when an attempt to create a new SharePoint site has failed. | Microsoft.SharePoint.Foundation.2010.Failed_to_create_a_SharePoint_site | Microsoft.SharePoint.Foundation.2010.SPServer | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | True | Application |
| Mail Service Cannot Deliver Email Rule | This Rule collects data when a large number of Incoming Email Service lookup fails. | Microsoft.SharePoint.Foundation.2010.IncomingMail_CannotDeliverEmail | Microsoft.SharePoint.Foundation.2010.SPServiceInstance.IncomingMail | EventCollection | True | | | 0 | 6873 | Microsoft-SharePoint Products-SharePoint Foundation | False | | | True | Microsoft-SharePoint Products-Shared/Operational |
| SharePoint Lists Cannot Receive Email Rule | This Rule collects data when SharePoint Lists cannot receive email. | Microsoft.SharePoint.Foundation.2010.IncomingMail_ListsCannotReceiveEmail | Microsoft.SharePoint.Foundation.2010.SPServiceInstance.IncomingMail | EventCollection | True | | | 0 | 6872 | Microsoft-SharePoint Products-SharePoint Foundation | False | | | True | Application |
| Windows SMTP Service Is Not Running Rule | This Rule collects data when Windows SMTP Service is not running. | Microsoft.SharePoint.Foundation.2010.IncomingMail_STMPServiceIsNotRunning | Microsoft.SharePoint.Foundation.2010.SPServiceInstance.IncomingMail | EventCollection | True | | | 0 | 6599 | Microsoft-SharePoint Products-SharePoint Foundation | False | | | True | Application |
| Insufficient Permissions To Write To The Configuration Data Cache | This Rule collects data when the permissions on the \%systemdrive\%\inetpub\wwwroot\wss\config folder where the SharePoint Foundation 2010 configuration data cache is stored has been changed. | Microsoft.SharePoint.Foundation.2010.Insufficient_permissions_to_write_to_the_configuration_data_cache | Microsoft.SharePoint.Foundation.2010.SPServer | EventCollection | True | | | 0 | 6395 | Microsoft-SharePoint Products-SharePoint Foundation | False | | | True | Application |
| Insufficient SQL Server Database Permissions | This Rule collects data when insufficient privileges have been granted in the SQL Server database to the service account specified in SharePoint Foundation 2010. | Microsoft.SharePoint.Foundation.2010.Insufficient_SQL_Server_database_permissions | Microsoft.SharePoint.Foundation.2010.SPServer | EventCollection | True | | | 0 | 5214 | Microsoft-SharePoint Products-SharePoint Foundation | False | | | True | Application |
| Page Response Time | This Rule collects data on Executing Time/Page Request counter which counts the amount of time application is taking to render a webpage. | Microsoft.SharePoint.Foundation.2010.Responsetime | Microsoft.SharePoint.Foundation.2010.SPServer | PerformanceCollection | True | SharePoint Foundation | Executing Time/Page Request | 300 | 0 | | False | | | True | |
| Service Instance Provisioning Failed | This Rule collects data when an attempt to start or stop a service instance on a server in the server farm has failed. Additional details about why the service could not be started or stopped are included in the exception message of the Windows NT Event log. | Microsoft.SharePoint.Foundation.2010.Service_instance_provisioning_failed | Microsoft.SharePoint.Foundation.2010.SPServer | EventCollection | True | | | 0 | 7034 | Microsoft-SharePoint Products-SharePoint Foundation | False | | | True | Application |
| SharePoint Administration Service Is Disabled | This Rule collects data when the SharePoint Foundation 2010 timer job is executed and discovers that the SharePoint Foundation 2010 Administration service is disabled. | Microsoft.SharePoint.Foundation.2010.SharePoint_Administration_service_is_disabled | Microsoft.SharePoint.Foundation.2010.SPServiceInstance.Admin | EventCollection | True | | | 0 | 7399 | Microsoft-SharePoint Products-SharePoint Foundation | False | | | True | Microsoft-SharePoint Products-Shared/Operational |
| Server Is About To Enter Into Throttling State | This Rule collects data when the Server is about to enter into throttling state. | Microsoft.SharePoint.Foundation.2010.SPServer_ThrottlingState | Microsoft.SharePoint.Foundation.2010.SPServer | EventCollection | True | | | 0 | 8032 | Microsoft-SharePoint Products-SharePoint Foundation | False | | | True | Application |
| SQL Server Database Is Full | This Rule collects data when a SQL Server error occurred because the database size limit has been reached. | Microsoft.SharePoint.Foundation.2010.SQL_Server_database_is_full | Microsoft.SharePoint.Foundation.2010.SPServer | EventCollection | True | | | 0 | 3758 | Microsoft-SharePoint Products-SharePoint Foundation | False | | | True | Application |
| SQL Server Database Login Failed | This Rule collects data when the user name or password for the SharePoint Foundation 2010 account was invalid before the session or became invalid during the session. | Microsoft.SharePoint.Foundation.2010.SQL_Server_database_login_failed | Microsoft.SharePoint.Foundation.2010.SPServer | EventCollection | True | | | 0 | 3351 | Microsoft-SharePoint Products-SharePoint Foundation | False | | | True | Application |
| The Active Directory Organization Unit Registered In SharePoint Foundation 2010 Does Not Exist | This Rule collects data when the Active Directory organizational unit that was created for account creation mode does not exist. This condition can occur due to a provisioning-time error or a runtime error. | Microsoft.SharePoint.Foundation.2010.The_Active_Directory_organization_unit_registered_in_Windows | Microsoft.SharePoint.Foundation.2010.SPServer | EventCollection | True | | | 0 | 3360 | Microsoft-SharePoint Products-SharePoint Foundation | False | | | True | Application |
| The Application Pool Account Has Insufficient Permissions To Add User Accounts To Active Directory | This Rule collects data when the application pool account used by a SharePoint site lacks permissions to add user information to the Active Directory. | Microsoft.SharePoint.Foundation.2010.The_application_pool_account_has_insufficient_permissions_to_add_user_accounts_to_Active_Directory | Microsoft.SharePoint.Foundation.2010.SPServer | EventCollection | True | | | 0 | 3359 | Microsoft-SharePoint Products-SharePoint Foundation | False | | | True | Application |
| The Application Pool Account Must Be Registered As A Kerberos Service Provider | This Rule collects data when the application pool account has insufficient permissions to add user accounts to Active Directory. When using Kerberos authentication, the service account used by the Internet Information Services (IIS) application pool for your Web application must be registered in Active Directory as a Service Principal Name (SPN) on the domain on which the Web front-end is a member. | Microsoft.SharePoint.Foundation.2010.The_application_pool_account_must_be_registered_as_a_Kerberos | Microsoft.SharePoint.Foundation.2010.SPServer | EventCollection | True | | | 0 | 6590 | Microsoft-SharePoint Products-SharePoint Foundation | True | Warning | Normal | True | Microsoft-SharePoint Products-Shared/Operational |
| Timer Job To Update Central Admin Failed | This Rule collects data when the SharePoint Foundation 2010 timer job to update central administration on a particular URL failed. | Microsoft.SharePoint.Foundation.2010.TimerJobToUpdateCentralAdminFailed | Microsoft.SharePoint.Foundation.2010.SPServer | EventCollection | True | | | 0 | 7037 | Microsoft-SharePoint Products-SharePoint Foundation | False | | | True | Microsoft-SharePoint Products-Shared/Operational |
| Unable To Load Authentication Provider | This Rule collects data when the Role Manager or Membership Provider that is specified for a particular web application is incorrectly configured. | Microsoft.SharePoint.Foundation.2010.Unable_to_load_authentication_provider | Microsoft.SharePoint.Foundation.2010.SPServer | EventCollection | True | | | 0 | 6143 | Microsoft-SharePoint Products-SharePoint Foundation | False | | | True | Application |
| Unable To Write To Trace Log | This Rule collects data when the SharePoint Foundation 2010 cannot write to the Windows Trace log. This can happen because the hard drive on which the Trace log is located is full or the permissions on the trace logging directory are not set correctly. | Microsoft.SharePoint.Foundation.2010.Unable_to_write_to_trace_log | Microsoft.SharePoint.Foundation.2010.SPServiceInstance.Trace | EventCollection | True | | | 0 | 5401 | Microsoft-SharePoint Products-SharePoint Foundation | False | | | True | Application |