detection.wiki

Microsoft-Exchange-ManagedAvailability

EventTitleChannelSampleRule
1Message.MonitoringNN
4Message.MonitoringNN
10Startup notification Id 'NotificationId' inserted.StartupNotificationNN
20BaseConfig: Identity = PropertiesXml.ThrottlingConfigNN
21GlobalOverride: Identity = PropertiesXml.ThrottlingConfigNN
22LocalOverride: Identity = PropertiesXml.ThrottlingConfigNN
23Effective: Identity = PropertiesXml.ThrottlingConfigNN
250Bugcheck action reported by server 'ReportingServer' initiated by responder …RemoteActionLogsNN
500Recovery Action Started.RecoveryActionResultsNN
501Recovery Action Succeeded.RecoveryActionResultsNN
502Recovery Action Failed.RecoveryActionResultsNN
1000TypeName-Requester: Arbitration Succeeded.RecoveryActionLogsNN
1001TypeName-Requester: Arbitration Failed.RecoveryActionLogsNN
1010ActionId-ResourceName-RequesterName: Throttling allowed the operation to …RecoveryActionLogsNN
1011ActionId-ResourceName-RequesterName: Throttling rejected the operation.RecoveryActionLogsNN
1012ActionId-ResourceName-RequesterName: Throttling is waiting for previous action …RecoveryActionLogsNN
1020Starting recovery action (Action=ActionId, Resource=ResourceName, …RecoveryActionLogsNN
1022Recovery action succeeded.RecoveryActionLogsNN
1023Recovery action failed.RecoveryActionLogsNN
1024The 'ResourceName' component was set online.RecoveryActionLogsNN
1030Arbitration Quota Info.RecoveryActionLogsNN
1031Recovery action 'ActionId' is disabled by registry override (ResourceName: …RecoveryActionLogsNN
1500Attempting to kill process.RecoveryActionLogsNN
1501Failed to kill the process.RecoveryActionLogsNN
1502Successfuly killed the process.RecoveryActionLogsNN
1503Activemonitoring encountered an unexpected error.RecoveryActionLogsNN
1504Bugcheck is running in a simulated mode.RecoveryActionLogsNN
1505Operation completed in Duration.RecoveryActionLogsNN
2001InvokeNow request.InvokeNowRequestNN
2002InvokeNow definition upload started.InvokeNowResultNN
2003InvokeNow definition upload succeeded.InvokeNowResultNN
2004InvokeNow definition upload failed.InvokeNowResultNN
2005InvokeNow succeeded.InvokeNowResultNN
2006InvokeNow failed.InvokeNowResultNN
2050ActionId-ResourceName-RequesterName: Throttling allowed the operation to …RecoveryActionLogsNN
2051ActionId-ResourceName-RequesterName: Throttling rejected the operation.RecoveryActionLogsNN
2052Recovery actions cache successfuly initialized (Elapsed: Elapsed).RecoveryActionLogsNN
2053Recovery actions cache failed to initialize (Elapsed: Elapsed).RecoveryActionLogsNN
2060Starting service ServiceName without using up throttling quota since the service …RecoveryActionLogsNN
2061Attempt start service ServiceName without using up throttling quota failed with …RecoveryActionLogsNN
2062Attempt to publish recovery action entry for responder 'RequestorName' failed …RecoveryActionLogsNN

Event ID 1: Message.

#
Channel
Monitoring

Fields #

NameDescription
HealthSet
Subject
Message

Event ID 4: Message.

#
Channel
Monitoring

Fields #

NameDescription
HealthSet
Subject
Message
Monitor

Event ID 10: Startup notification Id 'NotificationId' inserted.

#
Channel
StartupNotification

Fields #

NameDescription
NotificationId

Event ID 20: BaseConfig: Identity = PropertiesXml.

#
Channel
ThrottlingConfig

Fields #

NameDescription
Identity
RecoveryActionId
ResponderCategory
ResponderTypeName
ResponderName
ResourceName
PropertiesXml

Event ID 21: GlobalOverride: Identity = PropertiesXml.

#
Channel
ThrottlingConfig

Fields #

NameDescription
Identity
RecoveryActionId
ResponderCategory
ResponderTypeName
ResponderName
ResourceName
PropertiesXml

Event ID 22: LocalOverride: Identity = PropertiesXml.

#
Channel
ThrottlingConfig

Fields #

NameDescription
Identity
RecoveryActionId
ResponderCategory
ResponderTypeName
ResponderName
ResourceName
PropertiesXml

Event ID 23: Effective: Identity = PropertiesXml.

#
Channel
ThrottlingConfig

Fields #

NameDescription
Identity
RecoveryActionId
ResponderCategory
ResponderTypeName
ResponderName
ResourceName
PropertiesXml

Event ID 250: Bugcheck action reported by server 'ReportingServer' initiated by responder 'RequesterName'.

#
Channel
RemoteActionLogs

Fields #

NameDescription
ReportingServer
ActionId
RequesterName
Context
TimeStamp

Event ID 500: Recovery Action Started.

#
Channel
RecoveryActionResults

Description

Recovery Action Started. (ActionId=Id, ResourceName=ResourceName, Requester=RequestorName, InstanceId=InstanceId, ExpectedToFinishAt=EndTime

Fields #

NameDescription
Id
InstanceId
ResourceName
StartTime
EndTime
State
Result
RequestorName
ExceptionName
ExceptionMessage
Context
CustomArg1
CustomArg2
CustomArg3
LamProcessStartTime
ThrottleIdentity
ThrottleParametersXml
TotalLocalActionsInOneHour
TotalLocalActionsInOneDay
TotalGroupActionsInOneDay

Event ID 501: Recovery Action Succeeded.

#
Channel
RecoveryActionResults

Description

Recovery Action Succeeded. (ActionId=Id, ResourceName=ResourceName, Requester=RequestorName, InstanceId=InstanceId, ActualStartTime=StartTime, ActualEndTime=EndTime)

Fields #

NameDescription
Id
InstanceId
ResourceName
StartTime
EndTime
State
Result
RequestorName
ExceptionName
ExceptionMessage
Context
CustomArg1
CustomArg2
CustomArg3
LamProcessStartTime
ThrottleIdentity
ThrottleParametersXml
TotalLocalActionsInOneHour
TotalLocalActionsInOneDay
TotalGroupActionsInOneDay

Event ID 502: Recovery Action Failed.

#
Channel
RecoveryActionResults

Description

Recovery Action Failed. (ActionId=Id, ResourceName=ResourceName, Requester=RequestorName, InstanceId=InstanceId, ActualStartTime=StartTime, ActualEndTime=EndTime, ErrorMessage=ExceptionMessage)

Fields #

NameDescription
Id
InstanceId
ResourceName
StartTime
EndTime
State
Result
RequestorName
ExceptionName
ExceptionMessage
Context
CustomArg1
CustomArg2
CustomArg3
LamProcessStartTime
ThrottleIdentity
ThrottleParametersXml
TotalLocalActionsInOneHour
TotalLocalActionsInOneDay
TotalGroupActionsInOneDay

Event ID 1000: TypeName-Requester: Arbitration Succeeded.

#
Channel
RecoveryActionLogs

Description

TypeName-Requester: Arbitration Succeeded (TotalRequests: TotalRequested, TotalReady: TotalReady, TotalOffline: TotalOffline, TotalArbitrating: TotalInArbitration, MinimumReadyRequired: MinimumRequiredRead MaximumBusyAllowed: MaximumAllowedBusy)

Fields #

NameDescription
TypeName
Requester
TotalRequested
TotalReady
TotalInArbitration
TotalMaintenance
TotalUnknown
MinimumRequiredRead
MaximumAllowedBusy
ReadyResources
ArbitratingResource
InMaintenanceResources
UnknownResources
Message
TotalOffline
OfflineResources

Event ID 1001: TypeName-Requester: Arbitration Failed.

#
Channel
RecoveryActionLogs

Description

TypeName-Requester: Arbitration Failed (TotalRequests: TotalRequested, TotalReady: TotalReady, TotalOffline: TotalOffline, TotalArbitrating: TotalInArbitration, MinimumReadyRequired: MinimumRequiredRead, MaximumBusyAllowed: MaximumAllowedBusy, Error: Message)

Fields #

NameDescription
TypeName
Requester
TotalRequested
TotalReady
TotalInArbitration
TotalMaintenance
TotalUnknown
MinimumRequiredRead
MaximumAllowedBusy
ReadyResources
ArbitratingResource
InMaintenanceResources
UnknownResources
Message
TotalOffline
OfflineResources

Event ID 1010: ActionId-ResourceName-RequesterName: Throttling allowed the operation to execute.

#
Channel
RecoveryActionLogs

Fields #

NameDescription
ActionId
ResourceName
RequesterName
LowestQueryTime
IsMinimumSecondsCheckPassed
MinmumSecondsCheckStartTime
ConfiguredMinimumSecondsBetweenAttempts
IsMaximumInHourCheckPassed
MaximumInHourCheckStartTime
AttempstInHourCount
ConfiguredMaximumAllowedAttemptsInAnHour
IsMaximumInDayCheckPassed
MaximumInDayCheckStartTime
AttempstInDayCount
ConfiguredMaximumAllowedAttemptsInAnDay

Event ID 1011: ActionId-ResourceName-RequesterName: Throttling rejected the operation.

#
Channel
RecoveryActionLogs

Fields #

NameDescription
ActionId
ResourceName
RequesterName
LowestQueryTime
IsMinimumSecondsCheckPassed
MinmumSecondsCheckStartTime
ConfiguredMinimumSecondsBetweenAttempts
IsMaximumInHourCheckPassed
MaximumInHourCheckStartTime
AttempstInHourCount
ConfiguredMaximumAllowedAttemptsInAnHour
IsMaximumInDayCheckPassed
MaximumInDayCheckStartTime
AttempstInDayCount
ConfiguredMaximumAllowedAttemptsInAnDay

Event ID 1012: ActionId-ResourceName-RequesterName: Throttling is waiting for previous action to complete (Pening => Requester: PreviousRequesterName, StartTime: PreviousStartTime, ExpectedToEndBefore: ExpectedTo...

#
Channel
RecoveryActionLogs

Description

ActionId-ResourceName-RequesterName: Throttling is waiting for previous action to complete (Pening => Requester: PreviousRequesterName, StartTime: PreviousStartTime, ExpectedToEndBefore: ExpectedToEndBefore)

Fields #

NameDescription
ActionId
ResourceName
RequesterName
PreviousRequesterName
PreviousStartTime
ExpectedToEndBefore

Event ID 1020: Starting recovery action (Action=ActionId, Resource=ResourceName, Requester=RequesterName, ThrottlingMode=ThrottlingMode).

#
Channel
RecoveryActionLogs

Fields #

NameDescription
ActionId
ResourceName
RequesterName
ThrottlingMode

Event ID 1022: Recovery action succeeded.

#
Channel
RecoveryActionLogs

Description

Recovery action succeeded. (Action=ActionId, Resource=ResourceName, Requester=RequesterName)

Fields #

NameDescription
ActionId
ResourceName
RequesterName
Exception
ThrottleIdentity
ThrottleParameters

Event ID 1023: Recovery action failed.

#
Channel
RecoveryActionLogs

Description

Recovery action failed. (Action=ActionId, Resource=ResourceName, Requester=RequesterName, Error=Exception)

Fields #

NameDescription
ActionId
ResourceName
RequesterName
Exception
ThrottleIdentity
ThrottleParameters

Event ID 1024: The 'ResourceName' component was set online.

#
Channel
RecoveryActionLogs

Description

The 'ResourceName' component was set online. (Action=ActionId, Resource=ResourceName, Requester=RequesterName)

Fields #

NameDescription
ActionId
ResourceName
RequesterName
Exception
ThrottleIdentity
ThrottleParameters

Event ID 1030: Arbitration Quota Info.

#
Channel
RecoveryActionLogs

Description

Arbitration Quota Info (TypeName: TypeName, IsQuotaComputationConcluded: IsQuotaComputationConcluded, IsQuotaExhausted: IsQuotaExhausted, IsActionAttemptedBeforeMinimumTime: IsActionAttemptedBeforeMinimumTime, TotalQuotaExhaustedAcrossGroup: TotalQuotaExhaustedAcrossGroup, MaximumAllowedTotalActionsAcrossGroup: MaximumAllowedTotalActionsAcrossGroup)

Fields #

NameDescription
TypeName
IsQuotaComputationConcluded
IsQuotaExhausted
IsActionAttemptedBeforeMinimumTime
TotalQuotaExhaustedAcrossGroup
MaximumAllowedTotalActionsAcrossGroup

Event ID 1031: Recovery action 'ActionId' is disabled by registry override (ResourceName: ResourceName, RequesterName: RequesterName).

#
Channel
RecoveryActionLogs

Fields #

NameDescription
ActionId
ResourceName
RequesterName

Event ID 1500: Attempting to kill process.

#
Channel
RecoveryActionLogs

Description

Attempting to kill process. (Id=ProcessId, Name=ProcessName, IsChild=IsChildProcess, Context=Context)

Fields #

NameDescription
ProcessId
ProcessName
IsChildProcess
Context

Event ID 1501: Failed to kill the process.

#
Channel
RecoveryActionLogs

Description

Failed to kill the process. (Id=ProcessId, Name=ProcessName, IsChild=IsChildProcess, Context=Context, Error=Error)

Fields #

NameDescription
ProcessId
ProcessName
IsChildProcess
Context
Error

Event ID 1502: Successfuly killed the process.

#
Channel
RecoveryActionLogs

Description

Successfuly killed the process. (Id=ProcessId, Name=ProcessName, IsChild=IsChildProcess, Context=Context)

Fields #

NameDescription
ProcessId
ProcessName
IsChildProcess
Context

Event ID 1503: Activemonitoring encountered an unexpected error.

#
Channel
RecoveryActionLogs

Description

Activemonitoring encountered an unexpected error. (Reason: InitiatedBy, Error: Error).

Fields #

NameDescription
InitiatedBy
Error

Event ID 1504: Bugcheck is running in a simulated mode.

#
Channel
RecoveryActionLogs

Description

Bugcheck is running in a simulated mode. (Duration: Duration, IsOneShot: IsOneShot, SimlatedBootTime: SimlatedBootTime, IsExitProcess: IsExitProcess)

Fields #

NameDescription
Duration
IsOneShot
SimlatedBootTime
IsExitProcess

Event ID 1505: Operation completed in Duration.

#
Channel
RecoveryActionLogs

Description

Operation completed in Duration. (ReturnHint=ReturnHint, Error=Error)

Fields #

NameDescription
Operation
Duration
ReturnHint
Error

Event ID 2001: InvokeNow request.

#
Channel
InvokeNowRequest

Fields #

NameDescription
Id
TypeName
AssemblyPath
PropertyBag
MonitorIdentity
ExtensionAttributes
RequestTime
State
Result
ErrorMessage
WorkDefinitionId

Event ID 2002: InvokeNow definition upload started.

#
Channel
InvokeNowResult

Fields #

NameDescription
Id
TypeName
AssemblyPath
PropertyBag
MonitorIdentity
ExtensionAttributes
RequestTime
State
Result
ErrorMessage
WorkDefinitionId

Event ID 2003: InvokeNow definition upload succeeded.

#
Channel
InvokeNowResult

Fields #

NameDescription
Id
TypeName
AssemblyPath
PropertyBag
MonitorIdentity
ExtensionAttributes
RequestTime
State
Result
ErrorMessage
WorkDefinitionId

Event ID 2004: InvokeNow definition upload failed.

#
Channel
InvokeNowResult

Fields #

NameDescription
Id
TypeName
AssemblyPath
PropertyBag
MonitorIdentity
ExtensionAttributes
RequestTime
State
Result
ErrorMessage
WorkDefinitionId

Event ID 2005: InvokeNow succeeded.

#
Channel
InvokeNowResult

Fields #

NameDescription
Id
TypeName
AssemblyPath
PropertyBag
MonitorIdentity
ExtensionAttributes
RequestTime
State
Result
ErrorMessage
WorkDefinitionId

Event ID 2006: InvokeNow failed.

#
Channel
InvokeNowResult

Fields #

NameDescription
Id
TypeName
AssemblyPath
PropertyBag
MonitorIdentity
ExtensionAttributes
RequestTime
State
Result
ErrorMessage
WorkDefinitionId

Event ID 2050: ActionId-ResourceName-RequesterName: Throttling allowed the operation to execute.

#
Channel
RecoveryActionLogs

Fields #

NameDescription
InstanceId
ActionId
ResourceName
RequesterName
ExceptionMessage
LocalThrottleResult
GroupThrottleResult
TotalServersInGroup
TotalServersInCompatibleVersion

Event ID 2051: ActionId-ResourceName-RequesterName: Throttling rejected the operation.

#
Channel
RecoveryActionLogs

Fields #

NameDescription
InstanceId
ActionId
ResourceName
RequesterName
ExceptionMessage
LocalThrottleResult
GroupThrottleResult
TotalServersInGroup
TotalServersInCompatibleVersion

Event ID 2052: Recovery actions cache successfuly initialized (Elapsed: Elapsed).

#
Channel
RecoveryActionLogs

Fields #

NameDescription
Elapsed
EntriesCount
FromTime
ToTime
Timeout
Exception

Event ID 2053: Recovery actions cache failed to initialize (Elapsed: Elapsed).

#
Channel
RecoveryActionLogs

Fields #

NameDescription
Elapsed
EntriesCount
FromTime
ToTime
Timeout
Exception

Event ID 2060: Starting service ServiceName without using up throttling quota since the service is already stopped.

#
Channel
RecoveryActionLogs

Fields #

NameDescription
ServiceName

Event ID 2061: Attempt start service ServiceName without using up throttling quota failed with Error.

#
Channel
RecoveryActionLogs

Fields #

NameDescription
ServiceName
Error

Event ID 2062: Attempt to publish recovery action entry for responder 'RequestorName' failed with error: ErrorMessage.

#
Channel
RecoveryActionLogs

Fields #

NameDescription
Id
InstanceId
ResourceName
RequestorName
ErrorMessage