| | DisplayName | Description | ID | Target | Category | Enabled | Instance Name | Counter Name | Frequency | Event_ID | Event Source | Alert Generate | Alert Severity | Alert Priority | Remotable | Event Log |
|---|
 | Access denied for writing to disk | The application pool used by Windows SharePoint Services uses a service account when writing to a registry key or a file folder in the Windows file system. | Microsoft.Windows.SharePoint.Services.3.0.Access_denied_for_writing_to_disk | Microsoft.Windows.SharePoint.Services.3.0.WSS.Application | EventCollection | True | | | 0 | 6589 | Windows SharePoint Services 3 | True | Warning | Normal | True | Application |
| Access denied for writing to registry | The application pool used by Windows SharePoint Services uses a service account when writing to a registry key or a file folder in the Windows file system. | Microsoft.Windows.SharePoint.Services.3.0.Access_denied_for_writing_to_registry | Microsoft.Windows.SharePoint.Services.3.0.WSS.Application | EventCollection | True | | | 0 | 6588 | Windows SharePoint Services 3 | True | Warning | Normal | True | Application |
| Alternate access mapping update failed | Alternate access mapping is a feature of Windows SharePoint Services 3.0 that enables administrators to configure a load-balanced system by mapping an incoming URL to alternate URLs used by Windows SharePoint Services. | Microsoft.Windows.SharePoint.Services.3.0.Alternate_access_mapping_update_failed | Microsoft.Windows.SharePoint.Services.3.0.WSS.Application | EventCollection | True | | | 0 | 6397 | Windows SharePoint Services 3 | True | Warning | Normal | True | Application |
| An error occurred while communicating with the SMTP server | Microsoft Windows SharePoint Services sends alerts and other administration messages by using an SMTP mail server. You can specify which SMTP server to use, and you can set the e-mail address to use for sending alerts and receiving replies for all sites, by using the Outgoing E-Mail Settings page in Central Administration. | Microsoft.Windows.SharePoint.Services.3.0.An_error_occurred_while_communicating_with_the_SMTP_server | Microsoft.Windows.SharePoint.Services.3.0.WSS.Application | EventCollection | True | | | 0 | 6858 | Windows SharePoint Services 3 | True | Error | Normal | True | Application |
| An RMS server refused access to a computer running Windows SharePoint Services | This alert indicates that a front-end Web server contacted the RMS server but the RMS server denied access to the Web server. Generally, this error occurs when an administrator is first enabling IRM for the Web farm in Central Administration. If this is the case, IRM cannot be enabled in Central Administration, and list administrators will not be able to enable IRM on a document library or list until the error is resolved. If this error occurs after IRM is enabled, downloads from a rights-managed list or library will fail until the error is resolved. | Microsoft.Windows.SharePoint.Services.3.0.An_RMS_server_refused_access_to_a_computer_running_Windows_SharePoint_Services | Microsoft.Windows.SharePoint.Services.3.0.WSS.Application | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | True | Application |
| ASP.NET worker process restarts on the Web server | This rule collects and reports performance data from the Windows Server 2003 performance counter that indicates the number of times a worker process has restarted on the server. | Microsoft.Windows.SharePoint.Services.3.0.ASP.NET_worker_process_restarts_on_the_Web_server | Microsoft.Windows.SharePoint.Services.3.0.WSS.Server | PerformanceCollection | True | ASP.NET | Worker Process Restarts | 3600 | 0 | | False | | | True | |
| Backup failed due to insufficient permissions | When you back up a Web site, you back up the content database for the site, including all pages in the site, files in document libraries, files attached to lists, security and permission settings, and feature settings. The backup process creates a single file that contains all of this data. | Microsoft.Windows.SharePoint.Services.3.0.Backup_failed_due_to_insufficient_permissions | Microsoft.Windows.SharePoint.Services.3.0.WSS.Application | EventCollection | True | | | 0 | 3353 | Windows SharePoint Services 3 | True | Error | Normal | True | Application |
| Backup failed due to timer job failure | In Windows SharePoint Services, administrators can configure and schedule a timer job to create a backup of a site. | Microsoft.Windows.SharePoint.Services.3.0.Backup_failed_due_to_timer_job_failure | Microsoft.Windows.SharePoint.Services.3.0.WSS.Application | EventCollection | True | | | 0 | 7035 | Windows SharePoint Services 3 | True | Error | Normal | True | Application |
| Cannot connect to SMTP host |
Microsoft Windows SharePoint Services uses an SMTP mail server to send alerts and other administration messages to users. You can specify which SMTP server to use, and you can specify the e-mail address to use for sending alerts and receiving replies for all sites, by using the Outgoing E-Mail Settings page in Central Administration.
| Microsoft.Windows.SharePoint.Services.3.0.Cannot_connect_to_SMTP_host | Microsoft.Windows.SharePoint.Services.3.0.WSS.Application | EventCollection | True | | | 0 | 6857 | Windows SharePoint Services 3 | True | Warning | Normal | True | Application |
| Cannot connect to SQL Server |
Windows SharePoint Services uses SQL Server to store most of the content for the Web site as well as configuration settings. For example, all pages in the site, files in document libraries, files attached to lists, and information in lists are stored in the content database, and security and permission settings along with other configuration settings are stored in the configuration database in SQL Server.
| Microsoft.Windows.SharePoint.Services.3.0.Cannot_connect_to_SQL_Server | Microsoft.Windows.SharePoint.Services.3.0.WSS.Application | EventCollection | True | | | 0 | 3355 | Windows SharePoint Services 3 | True | Error | Normal | True | Application |
| Cannot establish a connection with a Windows Rights Management Services (RMS) server |
Information Rights Management (IRM) relies on a Windows Rights Management Services (RMS) server (or server farm) to generate the keys for rights-managed documents. This alert indicates that Windows SharePoint Services could not connect to the specified RMS server. Although a connection to the RMS server is not required for every IRM transaction, loss of a connection to an RMS server generally causes downloads from, and uploads to, a rights-managed document library to fail.
| Microsoft.Windows.SharePoint.Services.3.0.Cannot_establish_a_connection_with_a_Windows_Rights_Management_Services__RMS__server | Microsoft.Windows.SharePoint.Services.3.0.WSS.Application | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | True | Application |
| Cannot resolve name of the outbound SMTP server |
Microsoft Windows SharePoint Services sends alerts and other administration messages by using an SMTP mail server. You can specify which SMTP server to use, and you can set the e-mail address to use for sending alerts and receiving replies for all sites, by using the Outgoing E-Mail Settings page in Central Administration.
| Microsoft.Windows.SharePoint.Services.3.0.Cannot_resolve_name_of_the_outbound_SMTP_server | Microsoft.Windows.SharePoint.Services.3.0.WSS.Application | EventCollection | True | | | 0 | 6856 | Windows SharePoint Services 3 | True | Warning | Normal | True | Application |
| Crawler cannot read from registry |
The crawler component of search uses the Windows SharePoint Services Search (SPSearch) service to read its settings from the Windows registry of the search server. This alert indicates that the crawler was unable to read from the registry in order to load configuration information needed by the SPSearch service.
| Microsoft.Windows.SharePoint.Services.3.0.Crawler_cannot_read_from_registry | Microsoft.Windows.SharePoint.Services.3.0.WSS.Application | EventCollection | True | | | 0 | 2438 | Windows SharePoint Services 3 Search | True | Warning | Normal | True | Application |
| Crawler exception |
The crawler component of search uses the Windows SharePoint Services Search (SPSearch) service to read its settings from the Windows registry of the search server. This alert indicates that an unexpected error has occurred in the crawler.
| Microsoft.Windows.SharePoint.Services.3.0.Crawler_exception | Microsoft.Windows.SharePoint.Services.3.0.WSS.Application | EventCollection | True | | | 0 | 2414 | Windows SharePoint Services 3 Search | True | Warning | Normal | True | Application |
| Current ISAPI request per sec to the SharePoint server |
This rule collects and reports performance data from the Windows Server 2003 performance counter that indicates the rate of ISAPI Extension requests received by Windows SharePoint Services.
| Microsoft.Windows.SharePoint.Services.3.0.Current_ISAPI_request_per_sec_to_the_SharePoint_server | Microsoft.Windows.SharePoint.Services.3.0.WSS.Server | PerformanceCollection | True | Web Service | ISAPI Extension Requests/sec | 3600 | 0 | | False | | | True | |
| Current total ISAPI connections to the SharePoint server |
This rule collects and reports performance data from Windows Server 2003 performance counter that indicates the current number of ISAPI requests that Windows SharePoint Services is processing simultaneously.
| Microsoft.Windows.SharePoint.Services.3.0.Current_total_ISAPI_connections_to_the_SharePoint_server | Microsoft.Windows.SharePoint.Services.3.0.WSS.Server | PerformanceCollection | True | Web Service | Current ISAPI Extension Requests | 3600 | 0 | | False | | | True | |
| Event handler failed to load |
Microsoft Windows SharePoint Services enables you to bind an event handler to an event host (such as an entire SharePoint site), a list, or a document library. For example, with this feature, you can use document library events to start other processes, such as workflow processes. You can develop managed code that takes advantage of document library events and create an application based on Windows SharePoint Services to perform whatever actions you need. When you combine document libraries, your own event-handling managed code, and (possibly) XML forms, you can create complex workflow processes that are easy for users to work with.
| Microsoft.Windows.SharePoint.Services.3.0.Event_handler_failed_to_load | Microsoft.Windows.SharePoint.Services.3.0.WSS.Application | EventCollection | True | | | 0 | 6644 | Windows SharePoint Services 3 | True | Warning | Normal | True | Application |
| Exception in execute method of job definition |
Several features of Microsoft Windows SharePoint Services rely on scheduled background processes called timer jobs. Administrators can configure and schedule timer jobs by using HTML Administration pages in Central Administration.
| Microsoft.Windows.SharePoint.Services.3.0.Exception_in_execute_method_of_job_definition | Microsoft.Windows.SharePoint.Services.3.0.WSS.Application | EventCollection | True | | | 0 | 6398 | Windows SharePoint Services 3 | True | Warning | Normal | True | Application |
| Exception loading timer job definition |
Several features of Microsoft Windows SharePoint Services rely on scheduled background processes called timer jobs. Administrators can configure, schedule, and view the status of timer jobs by using HTML Administration pages in Central Administration.
| Microsoft.Windows.SharePoint.Services.3.0.Exception_loading_timer_job_definition | Microsoft.Windows.SharePoint.Services.3.0.WSS.Application | EventCollection | True | | | 0 | 6396 | Windows SharePoint Services 3 | True | Warning | Normal | True | Application |
| Excessive CPU Utilization | This rule collects and reports performance data of \% Processor Time of the Process. This rule uses the \% Processor Time counter to calculate the percentage of the elapsed time of all of the process threads used by the processor to execute instructions. An instruction is the basic unit of execution in a computer, a thread is the object that executes instructions, and a process is the object created when a program is run. Code executed to handle some hardware interrupts and trap conditions are included in this count. | Microsoft.Windows.SharePoint.Services.3.0.Excessive_CPU_Utilization | Microsoft.Windows.SharePoint.Services.3.0.WSS.Server | PerformanceCollection | True | Process | \% Processor Time | 3600 | 0 | | False | | | True | |
| Excessive Usage | This rule collects and reports performance data of \% Processor Time of the Processor. This rule uses the \% Processor Time counter to calculate the percentage of the elapsed time that the processor spends to execute a non-Idle thread. The calculation measures the duration that the idle thread is active in the sample interval, and subtracts that time from the interval duration. (Each processor has an idle thread that consumes cycles when no other threads are ready to run.) This counter is the primary indicator of processor activity, and displays the average percentage of busy time observed during the sample interval. It is calculated by monitoring the time that the service is inactive, and subtracting that value from 100\%. | Microsoft.Windows.SharePoint.Services.3.0.Excessive_Usage | Microsoft.Windows.SharePoint.Services.3.0.WSS.Server | PerformanceCollection | True | Processor | \% Processor Time | 3600 | 0 | | False | | | True | |
| Failed to create a SharePoint site |
Windows SharePoint Services enables administrators to create new SharePoint sites. Site owners and (depending upon the site settings) site visitors can also create subsites.
| Microsoft.Windows.SharePoint.Services.3.0.Failed_to_create_a_SharePoint_site | Microsoft.Windows.SharePoint.Services.3.0.WSS.Application | EventCollection | True | | | 0 | 6141 | Windows SharePoint Services 3 | True | Warning | Normal | True | Application |
| Failed to load index |
This alert indicates that the Windows SharePoint Services Search (SPSearch) service could not load the index.
| Microsoft.Windows.SharePoint.Services.3.0.Failed_to_load_index | Microsoft.Windows.SharePoint.Services.3.0.WSS.Application | EventCollection | True | | | 0 | 7043 | Windows SharePoint Services 3 Search | True | Error | Normal | True | Application |
| Failed to load protocol handler |
Windows SharePoint Services uses protocol handlers to access the content that you want to crawl. This alert indicates that the protocol handler cannot be loaded. This means that documents that require the protocol handler cannot be crawled.
| Microsoft.Windows.SharePoint.Services.3.0.Failed_to_load_protocol_handler | Microsoft.Windows.SharePoint.Services.3.0.WSS.Application | EventCollection | True | | | 0 | 0 | Windows SharePoint Services 3 Search | True | Warning | Normal | True | Application |
| Failed to load safe control assembly path |
A Web Part can be registered as a safe control for use in Windows SharePoint Services. To register a Web Part as a safe control, in the SafeControls block, add a SafeControl element that specifies the Web Part in the top-level web.config file of the virtual server. When you add and delete Web Part packages or solutions using the stsadm.exe tool, this registration is usually handled during the deployment process.
| Microsoft.Windows.SharePoint.Services.3.0.Failed_to_load_safe_control_assembly_path | Microsoft.Windows.SharePoint.Services.3.0.WSS.Application | EventCollection | True | | | 0 | 6611 | Windows SharePoint Services 3 | True | Warning | Normal | True | Application |
| Failed to load word breaker |
A word breaker is a component that determines where the word boundaries are in the stream of characters in the query or document being crawled. A separate word breaker is required for each language installed on the server farm. For example, the English and German languages each require a separate word breaker.
| Microsoft.Windows.SharePoint.Services.3.0.Failed_to_load_word_breaker | Microsoft.Windows.SharePoint.Services.3.0.WSS.Application | EventCollection | True | | | 0 | 2462 | Windows SharePoint Services 3 Search | True | Warning | Normal | True | Application |
| IIS Start Command | This rule alerts the user when IIS is started. | Microsoft.Windows.SharePoint.Services.3.0.IIS_Start_Command | Microsoft.Windows.SharePoint.Services.3.0.WSS.Application | EventCollection | True | | | 0 | 1 | IISCTLS | True | Information | Normal | True | System |
| IIS Stop Command | This rule alerts the user when IIS is stopped. | Microsoft.Windows.SharePoint.Services.3.0.IIS_Stop_Command | Microsoft.Windows.SharePoint.Services.3.0.WSS.Application | EventCollection | True | | | 0 | 2 | IISCTLS | True | Error | Normal | True | System |
| Index is corrupt |
The Windows SharePoint Services Search (SPSearch) service has detected that the content index is corrupted. This can occur on either an index server or a query server. When this error occurs on an index server, the SPSearch service automatically attempts to reset and start a full update of the content index.
| Microsoft.Windows.SharePoint.Services.3.0.Index_is_corrupt | Microsoft.Windows.SharePoint.Services.3.0.WSS.Application | EventCollection | True | | | 0 | 4138 | Windows SharePoint Services 3 Search | True | Error | Normal | True | Application |
| Instance of search could not be initialized |
As instances of the Windows SharePoint Services Search (SPSearch) service start up, they must read configuration information from the Windows registry. The registry keys that store configuration information for search are backed up to the SQL Server database. If these registry keys are not present in the registry when the SPSearch service starts up, the service attempts to read this configuration information from the SQL Server database.
| Microsoft.Windows.SharePoint.Services.3.0.Instance_of_search_could_not_be_initialized | Microsoft.Windows.SharePoint.Services.3.0.WSS.Application | EventCollection | True | | | 0 | 2458 | Windows SharePoint Services 3 Search | True | Warning | Normal | True | Application |
| Insufficient disk space |
When crawling one or more content sources, the Windows SharePoint Services Search (SPSearch) service updates the index, which is stored in the file system of the search server. If a hard disk that contains this index has inadequate free space to update the index, this alert occurs and the crawl is paused.
| Microsoft.Windows.SharePoint.Services.3.0.Insufficient_disk_space | Microsoft.Windows.SharePoint.Services.3.0.WSS.Application | EventCollection | True | | | 0 | 7013 | Windows SharePoint Services 3 Search | True | Error | Normal | True | Application |
| Insufficient permissions to write to the configuration data cache |
To improve the performance of Windows SharePoint Services, much of the data in the configuration database is kept in a local file-system cache, called the configuration data cache. Windows SharePoint Services uses the timer service to keep this cache synchronized with the configuration database.
| Microsoft.Windows.SharePoint.Services.3.0.Insufficient_permissions_to_write_to_the_configuration_data_cache | Microsoft.Windows.SharePoint.Services.3.0.WSS.Application | EventCollection | True | | | 0 | 6395 | Windows SharePoint Services 3 | True | Warning | Normal | True | Application |
| Insufficient SQL Server database permissions |
Windows SharePoint Services uses a service account to communicate with the database on behalf of a user request. This service account can be either a specific user name and password (domain name and password) or a predefined system account, such as Local System or Network Service.
| Microsoft.Windows.SharePoint.Services.3.0.Insufficient_SQL_Server_database_permissions | Microsoft.Windows.SharePoint.Services.3.0.WSS.Application | EventCollection | True | | | 0 | 5214 | Windows SharePoint Services 3 | True | Error | Normal | True | Application |
| Internal plug-in error |
A plug-in is a component of the search server that is used to process content and properties from crawled items. When this error occurs, a Dr. Watson report is usually created and an entry that contains the call stack of the exception is written to the Windows NT Event log.
| Microsoft.Windows.SharePoint.Services.3.0.Internal_plug_in_error | Microsoft.Windows.SharePoint.Services.3.0.WSS.Application | EventCollection | True | | | 0 | 9502 | Windows SharePoint Services 3 Search | True | Warning | Normal | True | Application |
| IRM manifests are invalid |
In order for Windows SharePoint Services to use Windows Rights Management Services (RMS), the RMS client application must be installed on every front-end Web server in the Web farm.
| Microsoft.Windows.SharePoint.Services.3.0.IRM_manifests_are_invalid | Microsoft.Windows.SharePoint.Services.3.0.WSS.Application | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | True | Application |
| Locale ID has changed |
Every Web site based on Microsoft Windows SharePoint Services can be customized to use specific regional settings that apply to the users of your site. One of these settings, Locale ID, controls the numbering, sorting, calendar, and time formatting for the Web site
| Microsoft.Windows.SharePoint.Services.3.0.Locale_ID_has_changed | Microsoft.Windows.SharePoint.Services.3.0.WSS.Application | EventCollection | True | | | 0 | 2486 | Windows SharePoint Services 3 Search | True | Warning | Normal | True | Application |
| Master merge error |
A master merge is the process of merging a group of indexes into a single index. If this alert occurs repeatedly, the Windows SharePoint Services Search (SPSearch) service will eventually be unable to index new documents.
| Microsoft.Windows.SharePoint.Services.3.0.Master_merge_error | Microsoft.Windows.SharePoint.Services.3.0.WSS.Application | EventCollection | True | | | 0 | 0 | Windows SharePoint Services 3 Search | True | Warning | Normal | True | Application |
| One or more file types cannot be rights-managed because an IRM protector registered an error |
To manage rights for a particular type of file that is stored in a SharePoint list or document library, an IRM protector must be registered on each front-end Web server in the Web farm for that file type. Microsoft Office SharePoint Server 2007 provides protectors for the following file types: InfoPath forms; Word 2003, Excel 2003, and PowerPoint 2003 file formats; and Open XML file formats for Word, Excel, and PowerPoint. Third-party protectors can also be installed.
| Microsoft.Windows.SharePoint.Services.3.0.One_or_more_file_types_cannot_be_rights_managed_because_an_IRM_protector_registered_an_error | Microsoft.Windows.SharePoint.Services.3.0.WSS.Application | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | True | Application |
| Plug-in failed to connect to SQL Server |
A plug-in is a component of the search server that is used to process content and properties from crawled items. This alert indicates that an error occurred in the Windows SharePoint Services Search (SPSearch) service. The plug-in did not connect to the SQL Server instance listed in the Windows NT Event log, and the update of the content source cannot continue.
| Microsoft.Windows.SharePoint.Services.3.0.Plug_in_failed_to_connect_to_SQL_Server | Microsoft.Windows.SharePoint.Services.3.0.WSS.Application | EventCollection | True | | | 0 | 0 | Windows SharePoint Services 3 Search | True | Warning | Normal | True | Application |
| Service instance provisioning failed |
When you use the Services on Server page in Central Administration to start or stop a service, a timer job is used to perform this action. This error indicates that the service could not be started or stopped.
| Microsoft.Windows.SharePoint.Services.3.0.Service_instance_provisioning_failed | Microsoft.Windows.SharePoint.Services.3.0.WSS.Application | EventCollection | True | | | 0 | 7034 | Windows SharePoint Services 3 | True | Warning | Normal | True | Application |
| SharePoint Administration service is disabled |
Several features of Microsoft Windows SharePoint Services rely on scheduled background processes called timer jobs. Administrators can configure and schedule timer jobs by using Central Administration.
| Microsoft.Windows.SharePoint.Services.3.0.SharePoint_Administration_service_is_disabled | Microsoft.Windows.SharePoint.Services.3.0.WSS.Application | EventCollection | True | | | 0 | 7399 | Windows SharePoint Services 3 | True | Warning | Normal | True | Application |
| SQL Server Database Error |
In a search-enabled server farm, the search server periodically writes to or reads from the SQL Server database. This alert indicates that an unexpected SQL Server database error occurred while the Windows SharePoint Services Search (SPSearch) attempted to communicate with the database.
| Microsoft.Windows.SharePoint.Services.3.0.SQL_Server_Database_Error | Microsoft.Windows.SharePoint.Services.3.0.WSS.Application | EventCollection | True | | | 0 | 9511 | Windows SharePoint Services 3 Search | True | Warning | Normal | True | Application |
| SQL Server database is full |
When a SQL Server database is created, a value for the maximum database size is set. Each database has a separate database size setting. Note that a Web application may be associated with one or many databases.
| Microsoft.Windows.SharePoint.Services.3.0.SQL_Server_database_is_full | Microsoft.Windows.SharePoint.Services.3.0.WSS.Application | EventCollection | True | | | 0 | 3758 | Windows SharePoint Services 3 | True | Error | Normal | True | Application |
| SQL Server database login failed |
When Windows SharePoint Services is installed, the administrator configures either a specific user name and password or a predefined system account, such as Local System or Network Service, that Windows SharePoint Services uses when communicating with the database. This is referred to as the service account that SharePoint runs as.
| Microsoft.Windows.SharePoint.Services.3.0.SQL_Server_database_login_failed | Microsoft.Windows.SharePoint.Services.3.0.WSS.Application | EventCollection | True | | | 0 | 3351 | Windows SharePoint Services 3 | True | Error | Normal | True | Application |
| The Active Directory organization unit registered in Windows SharePoint Services does not exist |
When Windows SharePoint Services is in Active Directory account creation mode, any user added to a site is automatically added to the Active Directory organizational unit identified for use by SharePoint.
| Microsoft.Windows.SharePoint.Services.3.0.The_Active_Directory_organization_unit_registered_in_Windows_SharePoint_Services_does_not_exist | Microsoft.Windows.SharePoint.Services.3.0.WSS.Application | EventCollection | True | | | 0 | 3360 | Windows SharePoint Services 3 | True | Error | Normal | True | Application |
| The application pool account has insufficient permissions to add user accounts to Active Directory |
When running in Active Directory account creation mode, every application pool that contains one or more SharePoint sites must use an account that has permissions to create, read, and update accounts in the Active Directory organizational unit that the domain administrator configured for Windows SharePoint Services.
| Microsoft.Windows.SharePoint.Services.3.0.The_application_pool_account_has_insufficient_permissions_to_add_user_accounts_to_Active_Directory | Microsoft.Windows.SharePoint.Services.3.0.WSS.Application | EventCollection | True | | | 0 | 3359 | Windows SharePoint Services 3 | True | Error | Normal | True | Application |
| The application pool account has insufficient permissions to read user data from Active Directory |
When running in Active Directory account creation mode, every application pool that runs a SharePoint site must use an account that has permissions to create, read, and update accounts in the Active Directory organizational unit that the domain administrator configured for Windows SharePoint Services.
| Microsoft.Windows.SharePoint.Services.3.0.The_application_pool_account_has_insufficient_permissions_to_read_user_data_from_Active_Directory | Microsoft.Windows.SharePoint.Services.3.0.WSS.Application | EventCollection | True | | | 0 | 6142 | Windows SharePoint Services 3 | True | Error | Normal | True | Application |
| The application pool account must be registered as a Kerberos service provider |
When using Kerberos authentication, the service account used by the Internet Information Services (IIS) application pool for your Web application must be registered in Active Directory as a Service Principal Name (SPN) on the domain on which the Web front-end is a member.
| Microsoft.Windows.SharePoint.Services.3.0.The_application_pool_account_must_be_registered_as_a_Kerberos_service_provider | Microsoft.Windows.SharePoint.Services.3.0.WSS.Application | EventCollection | True | | | 0 | 6590 | Windows SharePoint Services 3 | True | Information | Normal | True | Application |
| The Microsoft Internet Information Services State | The Microsoft Internet Information Services State is used to display the health rollup of the IIS. | Microsoft.Windows.SharePoint.Services.3.0.The_Microsoft_Internet_Information_Services_State | Microsoft.Windows.SharePoint.Services.3.0.WSS.Application | EventCollection | True | | | 0 | 0 | | True | Error | Normal | True | Application |
| The Rights Management Services (RMS) client on a computer running Windows SharePoint Services registered an error with its environment |
Information Rights Management (IRM) relies on the underlying Rights Management Services (RMS) framework, which includes the Windows RMS client application, to create issuance licenses and perform the actual encryption and decryption of rights-managed content. Every front-end Web server in a Windows SharePoint Services Web farm must have the Windows RMS client installed to access the RMS APIs.
| Microsoft.Windows.SharePoint.Services.3.0.The_Rights_Management_Services__RMS__client_on_a_computer_running_Windows_SharePoint_Services_registered_an_error_with_its_environment | Microsoft.Windows.SharePoint.Services.3.0.WSS.Application | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | True | Application |
| The Windows SharePoint Services Search service State | The Windows SharePoint Services Search (SPSearch) service is used by Windows SharePoint Services to provide full text indexing and search to SharePoint user and help content. | Microsoft.Windows.SharePoint.Services.3.0.The_Windows_SharePoint_Services_Search_service_State | Microsoft.Windows.SharePoint.Services.3.0.WSS.Application | EventCollection | True | | | 0 | 0 | | True | Error | Normal | True | Application |
| The Windows SharePoint Services Timer service State |
The Windows SharePoint Services Timer (SPTimer) service is used by Windows SharePoint Services to manage schedule jobs in the system. Timer will handle any schedule process and execute it without user interaction, examples of schedule jobs are Automatic Site Deletion, Search Crawling, Recycle Bin cleanup, Usage analysis.
| Microsoft.Windows.SharePoint.Services.3.0.The_Windows_SharePoint_Services_Timer_service_State | Microsoft.Windows.SharePoint.Services.3.0.WSS.Application | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | True | Application |
| The Windows SharePoint Services Tracing service State |
The Windows SharePoint Services Tracing (SPTrace) service is used by Windows SharePoint Services to manage trace output of the call stack. When trace logging is enabled, administrators can specify the path that is used to store the trace logs
| Microsoft.Windows.SharePoint.Services.3.0.The_Windows_SharePoint_Services_Tracing_service_State | Microsoft.Windows.SharePoint.Services.3.0.WSS.Application | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | True | Application |
| Unable to create a log file | Unable to create a log file from windows sharepoint services | Microsoft.Windows.SharePoint.Services.3.0.Unable_to_create_a_log_file | Microsoft.Windows.SharePoint.Services.3.0.WSS.Application | EventCollection | True | | | 0 | 3250 | Windows SharePoint Services 3 | True | Warning | Normal | True | Application |
| Unable to load authentication provider |
Windows SharePoint Services leverages the authentication providers that are provided by Windows Server 2003, such as forms authentication or Web Single Sign-On authentication, to authenticate users.
| Microsoft.Windows.SharePoint.Services.3.0.Unable_to_load_authentication_provider | Microsoft.Windows.SharePoint.Services.3.0.WSS.Application | EventCollection | True | | | 0 | 6143 | Windows SharePoint Services 3 | True | Warning | Normal | True | Application |
| Unable to write to trace log |
Windows SharePoint Services writes to a specific instance of the Windows trace log. This log file is reused by many applications that are built on top of Windows SharePoint Services.
| Microsoft.Windows.SharePoint.Services.3.0.Unable_to_write_to_trace_log | Microsoft.Windows.SharePoint.Services.3.0.WSS.Application | EventCollection | True | | | 0 | 5401 | Windows SharePoint Services 3 | True | Warning | Normal | True | Application |
| Unknown SQL Exceptions | This rule triggers an alert whenever any Unknown SQL Exceptions occur and accordingly display the details in the alert. | Microsoft.Windows.SharePoint.Services.3.0.Unknown_SQL_Exceptions | Microsoft.Windows.SharePoint.Services.3.0.WSS.Application | EventCollection | True | | | 0 | 5586 | Windows SharePoint Services 3 | True | Warning | Normal | True | Application |
| WFE Disk Space | This rule collects and reports performance data of \% Free Space of the logical disk. This rule uses the \% Free Space counter to calculate the percentage of total usable space on the selected logical disk drive. | Microsoft.Windows.SharePoint.Services.3.0.WFE_Disk_Space | Microsoft.Windows.SharePoint.Services.3.0.WSS.Server | PerformanceCollection | True | LogicalDisk | \% Free Space | 3600 | 0 | | False | | | True | |
Home