The IBM Tivoli Monitoring: Active Directory Agent predefined situations describe system conditions associated with Active Directory that you want to monitor at your site. Use these situations to begin monitoring any Windows managed object quickly, or as models for customizing your own situations. In some cases, the values assigned to the predefined situations are examples only and should be modified to reflect the conditions of your distributed system.
DC_Default_First_Site_Warning monitors for Domain Controllers using default first site. Its formula is:
DCA\Site_Name EQ 'Default-First-Site-Name'
OR
DCA\Site_Name EQ 'Premier-Site-par-defaut'
OR
DCA\Site_Name EQ 'Standardname-des-ersten-Standorts'
OR
DCA\Site_Name EQ 'Nombre-Predeterminado-Primer-Sitio'
OR
DCA\Site_Name EQ 'Nome-de-primeiro-site-predefinido'
DC_Dom_Naming_Master_Def_Crit monitors Domain Naming Master role. Its formula is:
DCA\Domain_Naming_Master EQ ""
DC_Dom_Naming_Master_Ping_Crit monitors connection to the domain controller that holds the domain-naming master role. Its formula is:
DCA\Ping_Domain_Naming_Master LT 0
DC_FSMO_Server_State_Critical monitors key services for Active Directory health on a FSMO master. Its formula is:
DCA\FSMO_Role NE "none"
and
Service_Name MISSING for "Dnscache" or "IsmServ" or "Netlogon" or "NtFrs" or "RpcLocator" or "RpcSs" or "TrkSvr" or "TrkWks" or "W32Time" or "kdc" or "lanmanserver" or "lanmanworkstation"
DC_FSMO_Transfer_Warning monitors for transfer of FSMO roles. Its formula is:
DCA\RID_Master NE DCA\Prev_RID_Master
OR
DCA\Domain_Naming_Master NE DCA\Prev_Domain_Naming_Master
OR
DCA\Infrastructure_Master NE DCA\Prev_Infrastructure_Master
OR
DCA\Schema_Master NE DCA\Prev_Schema_Master
OR
DCA\PDC_Master NE DCA\Prev_PDC_Master
DC_GC_List_Critical monitors connections to GC servers. Its formula is:
DCA\GCs_Pinged EQ 0
DC_Infra_Master_Defined_Crit monitors the infrastructure master role for the domain. Its formula is:
DCA\Infrastructure_Master EQ ""
DC_Infra_Master_Ping_Crit monitors the domain controller holding the infrastructure master role. Its formula is:
DCA\Ping_Infrastructure_Master LT 0
DC_PDC_Master_Defined_Crit monitors the PDC Master role for the domain. Its formula is:
DCA\PDC_Master EQ ""
DC_PDC_Master_Ping_Critical monitors connection to the PDC Master role owner for the domain. Its formula is:
DCA\Ping_PDC_Master LT 0
DC_ReplParts_Unreachable_Crit monitors connection to site replication partners. Its formula is:
DCA\Repl_Partners NE DCA\Repl_Partners_Pinged
DC_RID_Master_Defined_Critical monitors the Relative ID (RID) master pool. Its formula is:
DCA\RID_Master EQ ""
DC_RID_Ping_Critical monitors connection to the domain controller holding the Relative ID (RID) master role in the domain. Its formula is:
DCA\Ping_RID_Master LT 0
DC_Schema_Master_Defined_Crit monitors Schema Master role. Its formula is:
DCA\Schema_Master EQ ""
DC_Schema_Master_Ping_Critical monitors connection to the domain controller holding the schema master role. Its formula is:
DCA\Ping_Schema_Master LT 0
DC_Server_FSMO_Status_Critical monitors domain controller key services for Active Directory health. Its formula is:
DCA\FSMO_Role NE "none"
and
Current_State EQ "Stopped"
and
Service_Name EQ "Dnscache" or "IsmServ" or "Netlogon" or "NtFrs" or "RpcLocator" or "RpcSs" or "TrkSvr" or "TrkWks" or "W32Time" or "kdc" or "lanmanserver" or "lanmanworkstation"
DC_Server_State_Critical monitors domain controller key services for Active Directory health. Its formula is:
DCA\FSMO_Role EQ "none"
and
Service_Name MISSING for "Dnscache" or "IsmServ" or "Netlogon" or "NtFrs" or "RpcLocator" or "RpcSs" or "TrkSvr" or "TrkWks" or "W32Time" or "kdc" or "lanmanserver" or "lanmanworkstation"
DC_Server_Status_Critical monitors domain controller key services for Active Directory health. Its formula is:
DCA\FSMO_Role EQ "none"
and
Current_State EQ "Stopped"
and
Service_Name EQ "Dnscache" or "IsmServ" or "Netlogon" or "NtFrs" or "RpcLocator" or "RpcSs" or "TrkSvr" or "TrkWks" or "W32Time" or "kdc" or "lanmanserver" or "lanmanworkstation"
DC_Site_GCs_Available_Warning monitors connection to global catalogs defined for the site. Its formula is:
DCA\GCs_In_Site_Pinged EQ 0
DC_Site_GCs_Defined_Warning monitors number of Global Catalogs in site. Its formula is:
DCA\ GCs_In_Site EQ 0
DCPerf_Cache_Page_Stalls_Warn monitors the number of page faults per second that cannot be serviced because there are no pages available for allocation from the database cache. Its formula is:
DCP\Cache_Page_Fault_Stalls_Sec GT 0
DCPerf_DB_Cache_Size_Value_Warn monitors Cache Size. Its formula is:
DCP\Cache_Size LT 2
DCPerf_DB_Cache_Size_Warning monitors database performance counters significant for cache sizing. Its formula is:
DCP\File_Bytes_Read_Sec GT 30
or
DCP\File_Bytes_Written_Sec GT 30
or
DCP\Cache_Pct_Hit LT 20
or
DCP\Cache_Page_Faults_Sec GT 30
or
DCP\File_Operations_Sec GT 100
DCPerf_DB_Tab_Cache_Size_Warn monitors table hit statistics to determine if ESE database table cache size is functionally too small. Its formula is:
DCP\Table_Open_Cache_Hits_Sec LT 1000
and
DCP\Table_Open_Cache_Misses_Sec GT 300
and
DCP\Table_Open_Cache_Pct_Hit LT 20
DCPerf_Log_Record_Stalls_Warn monitors log record stalls rate. Its formula is:
DCP\Log_Record_Stalls_Sec GT 0
DCPerf_Log_Thread_Wait_Warning monitors the number of threads waiting for data to be written to the log. Its formula is:
DCP\Log_Threads_Waiting GT 300
DCPerf_NTDS_Conn_High_Warning monitors the number of NTDS connection objects. Its formula is:
DCP\DSA_Connections GT 20
DHCP_Active_Queue_Warning monitors active queue length. Its formula is:
Active_Queue_Length GT 100
DHCP_Conflict_Queue_Warning monitors DHCP Conflict Queue length. Its formula is:
Conflict_Check_Queue_Length GT 100
DHCP_Counters_Abnormal_Inc_Warn monitors the rate of DHCP acknowledgements and the rate of requests. Its formula is:
DHCP\Acks\sec\percent_increase GT 5
or
DHCP\Requests\sec\percent_increase GT 5
DHCP_Counters_Sudden_Inc_Warn monitors the rate of DHCP acknowledgements and the rate of requests. Its formula is:
DHCP\Acks\sec\percent_increase GT 25
or
DHCP\Requests\sec\percent_increase GT 25
DHCP_Decline_Rate_Warning monitors DHCP declines rate. Its formula is:
DHCP\Declines_sec GT 100
DHCP_Dup_Drops_Rate_Warning monitors the rate at which the DHCP server receives duplicate packets. Its formula is:
DHCP\Duplicates_Dropped/sec GT 100
DHCP_Nacks_Rate_Warning monitors the rate at which the DHCP server sends negative acknowledgements. Its formula is:
DHCP\Nacks_sec GT 100
DHCP_Packs_Expired_Rate_Warning monitors the number of packets expired per second. Its formula is:
DHCP\Packets_Expired/sec GT 100
DHCP_Service_State_Critical DHCP Service is not available. Its formula is:
DHCP\DHCP_Server EQ "TRUE"
and
Service_Name MISSING
DHCP_Service_Status_Critical monitors the DHCP server. Its formula is:
DHCP\DHCP_Server EQ "TRUE"
and
Current_Server EQ "Stopped"
and
Service_Name EQ "DHCPServer"
DNS_Response_Time_Critical monitors DNS response time. Its formula is:
DNS\Response_Time GT 3
DNS_Service_State_Critical monitors the DHCP Service. Its formula is:
DNS\DNS_Server EQ "TRUE"
and
Service_Name MISSING
DNS_Service_Status_Critical monitors the DNS server. Its formula is:
DNS\DNS_Server EQ "TRUE"
and
Current_State EQ "Stopped"
and
Service_Name EQ "DNS"
DNS_Total_Dyn_Update_Warning monitors the percentage of total dynamic updates failures. Its formula is:
DNS\Dynamic_Update_Failures_Pct GT 30
DNS_Zone_Trans_Perc_Fails_Crit monitors the percentage of zone transfer failures. Its formula is:
DNS\Transfer_Failures_Percent GT 30
DNSAD_DC_SRV_Records_Bad_Warn The copy of the zone stored on the specified server contains an SRV record for a domain controller that does not correspond to any of the known domain controllers that serve the domain covered by this zone. Its formula is:
DAI\DC_SRV_Records_Bad GT 0
DNSAD_DC_SRV_Recs_Missing_Warn One of the domain controller SRV records is missing from the copy of the zone stored on the specified server. Its formula is:
DAI\DC_SRV_Records_Missing GT 0
DNSAD_GC_SRV_Records_Bad_Warn The copy of the zone stored on the specified server contains an SRV record for a global catalog that does not correspond with any of the known global catalogs that serve the forest. Its formula is:
DAI\GC_SRV_Records_Bad GT 0
DNSAD_GC_SRV_Recs_Missing_Warn monitors GC SVR records. Its formula is:
DAI\GC_SRV_Records_Missing GT 0
DNSAD_Node_Records_Missing_Crit monitors the DNS server for missing SRV records. Its formula is:
DAI\Node_Records_Missing GT 0
DNSAD_PDC_SRV_Records_Bad_Warn The copy of the zone stored on the specified server contains an SRV record for a primary domain controller that does not correspond with the known primary domain controller that serves a specified domain. Its formula is:
DAI\PDC_SRV_Records_Bad GT 0
DNSAD_PDC_SRV_Recs_Missing_Warn The PDC SRV record for the specified domain is missing from the copy of the zone stored in the specified server. Its formula is:
DAI\PDC_SRV_Records_Missing GT 0
DRA_Comp_Inbound_Bytes_Warning monitors compressed inbound bytes. Its formula is:
DRA\Inbound_Bytes\Compressed_Per_Sec_Before GT 100
DRA_Comp_Outbound_Bytes_Warning monitors compressed outbound bytes. Its formula is:
DRA\Outbound_Bytes\Compressed_Per_Sec_Before GT 100
DRA_Highest_USN_Critical monitors the High-order 32 bits of the highest USN Issued on the DSA. Its formula is:
DRA\High_USN_Committed_High GT 99,999
DRA_Inbound_Bytes_Total_Warning monitors the number of DSA (Directory Service Agent) inbound bytes/sec.
If this value greatly exceeds the baseline value that was taken when the system was running under normal conditions, it may indicate that the system should be adjusted or upgraded to accommodate the increased load. Its formula is:
DRA\Inbound_Bytes\Total_Per_Sec GT 35,000
DRA_Inbound_Obj_Appl_Pct_Warn monitors the percentage of inbound replication objects received from replication partners and applied by the local service directory. Its formula is:
DRA\Inbound_Bytes\Percent_Applied LT 70
DRA_Inbound_Obj_Filt_Pct_Warn monitors the percentage of inbound replication objects received from replication partners that contained no updates to be applied. Its formula is:
DRA\Inbound_Objects\Percent_Filtered GT 50
DRA_Inbound_ObjUp_Warning monitors the Active Directory Inbound Object Updates Remaining in Packet Performance Counter. Its formula is:
DRA\Inbound_Objects_Update\Remain_Packet GT 15
This is an arbitrary value that should be adjusted for each unique setup after setting a baseline. Administrators can use this rule to determine if the Active Directory replication is performing at their site-defined acceptable levels.
DRA_Inbound_Prop_Appl_Pct_Warn monitors the percentage of inbound replication properties received from replication partners and applied by the local service directory. Its formula is:
DRA\Inbound_Properties\Percent_Applied LT 70
DRA_Inbound_Prop_Filt_Pct_Warn monitors the percentage of inbound replication properties received from replication partners that did not contain any updates to be applied. Its formula is:
DRA\Inbound_Properties\Percent_Filtered GT 50
DRA_Intersite_Percent_High_Warn monitors the ratio of intersite to intrasite inbound bytes. Its formula is:
DRA\Inbound_Bytes\Intersite_Percent GT 70
DRA_NTP_Connection_Blocked_Warn monitors the Net Time Protocol connection. Its formula is:
DRA\NetTime_Status NE 0
DRA_Outbound_Bytes_Total_Warning monitors the number of DSA (Directory Service Agent) outbound bytes/sec.
If this value greatly exceeds the baseline value that was taken when the system was running under normal conditions, it may indicate that the system should be adjusted or upgraded to accommodate the increased load. Its formula is:
DRA\Outbound_Bytes\Total_Per_Sec GT 35,000
DRA_Outbound_Obj_Filt_Pct_Warn monitors the percentage of outbound replication objects not already received by the outbound partner.. Its formula is:
DRA\Outbound_Objects\Percent_Filtered GT 50
DRA_Pending_Rep_Sync_Warning monitors the Active Directory Pending Replications Performance Counter.
This is an arbitrary value that should be adjusted for each unique setup after setting a baseline. Administrators can use this rule to determine if the Active Directory replication is performing at their site-defined acceptable levels. Its formula, with an arbitrary value, is:
DRA\Pending_Replication_Synchronizations GT 80
DRA_Uncomp_Inbound_Bytes_Warn monitors not compressed inbound bytes rate. Its formula is:
DRA\Inbound_Bytes\Not_Compressed_Per_Sec GT 100
DRA_Uncomp_Outbound_Bytes_Warn monitors not compressed outbound bytes rate. Its formula is:
DRA\Outbound_Bytes\Not_Compressed_Per_Sec_Before GT 100
DS_Cache_Hit_rate_Critical monitors the percentage of directory object name component look-ups that are satisfied out of the DSA's name cache. Its formula is:
DS\Name_Cache_Hit_Rate LT 80
FRS_Change_Orders_Evap_Prc_Warn monitors the percentage of change notifications that have evaporated. Its formula is:
FRS\Change_Orders_Evaporated_Percent GT 30
FRS_Chng_Ordrs_Aborted_Prc_Warn monitors the percent of aborted change notifications. Its formula is:
FRS\Change_Orders_Aborted_Percent GT 30
FRS_Chng_Ordrs_Morphed_Prc_Warn monitors the percentage of change notifications morphed. Its formula is:
FRS\Change_Orders_Morphed_Percent GT 30
FRS_Chng_Ordrs_Retired_Prc_Warn monitors the percentage of change notifications that have been retired. Its formula is:
FRS\Change_Orders_Retired_Percent GT 30
FRS_DS_Bind_In_Error_Prc_Warn monitors percent of Directory Service bindings in error. Its formula is:
FRS\DS_Bindings_In_Error_Percent GT 30
FRS_Files_Instd_Error_Prc_Warn monitors the percentage of files installed with error. Its formula is:
FRS\Files_Installed_with_Error_Percent GT 30
FRS_KB_Stage_Space_Free_Warn monitors the amount of free space in the staging directory used by FRS to temporarily store files. Its formula is:
FRS\KB_Staging_Space_Free LT 660,000
FRS_KB_Stage_Space_In_Use_Warn monitors available space in the staging directory currently in use. Its formula is:
FRS\KB_Staging_Space_In_Use GT 600,000
FRS_Num_Change_Orders_Sent_Warn monitors the change notifications sent to outbound replication partners in idle state. Its formula is:
FRS\Change_Orders_Sent GT 0
and
FRS\KB_Staging_Space_In_Use EQ 0
FRS_Number_Files_Installed_Warning monitors number of files installed in idle state. Its formula is:
FRS\KB_Staging_Space_In_Use EQ 0
and
FRS\Files_Installed GT 0
FRS_Packets_Rcvd_Error_Prc_Warn monitors percent of packets received in error. Its formula is:
FRS\Packets_Received_in_Error_Percent GT 30
FRS_Packets_Received_Warning monitors the number of packets received in idle state. Its formula is:
FRS\KB_Staging_Space_In_Use EQ 0
and
FRS\Packets_Received GT 0
FRS_Packets_Sent_Error_Prc_Warn monitors percent of packets sent in error. Its formula is:
FRS\Packets_Sent_in_Error_Percent GT 30
FRS_USN_Records_Accepted_Warn monitors Usn Records Accepted. Its formula is:
FRS\Usn_Records_Accepted GT 40
GPO_Inconsistent_Warning monitors GPOs for consistency between Sysvol and Active Directory. Its formula is:
GPO\Sysvol_Version NE GPO\Version
KDC_AS_Requests monitors the number of AS requests serviced by the KDC per second. AS requests are used by client to obtain a ticket granting ticket. Its formula is:
KDC\Authentication_Server_Request GT 99,999
KDC_TGS_Requests monitors the number of TGS requests serviced by the KDC per second. TGS requests are used by the client to obtain a ticket to a resource. Its formula is:
KDC\TGS_Requests GT 99,999
Kerberos_Authentications monitors the number of times per second that clients use a ticket to this DC to authenticate to this DC.
KDC\Authentications GT 99,999
LDAP_Client_Sessions_Warning monitors the number of connected LDAP client sessions. Its formula is:
LDAP\Client_Sessions GT 1,000
NTLM_Authentications monitors the number of NTLM authentications per second serviced by a DC. Its formula is:
NTLM\Authentications GT 1,000
Rep_InterSite_Repl_Prtnrs_Warn monitors InterSite Partner count. Its formula is:
DRA\InterSite_Partner_Count EQ 0
Rep_Site_BridgeHeads_Warning monitors BridgeHead Server Count. Its formula is:
DRA\Site_BridgeHead_Count EQ 0
Rep_SiteLinks_Warning monitors Site Link Count. Its formula is:
DRA\SiteLink_Count EQ 0
Repl_Part_Inter_Site_Stat_Crit monitors InterSite Replication. Its formula is:
RPL\Partner_Last_Success_Time NE RPL\Partner_Last_Attempt_Time
and
RPL\Replication_Type EQ "InterSite"
Repl_Part_Intra_Site_Stat_Crit monitors IntraSite Replication. Its formula is:
RPL\Partner_Last_Attempt_Time NE RPL\Partner_Last_Success_Time
and
RPL\Replication_Type EQ "Intrasite"
Repl_Part_Clock_Change_Warning monitors the clock of replication partners against local system clock. Its formula is:
RLT\Clock_Change_Delta GT 0
OR
RLT\Clock_Change_Delta LT -5
Replication_Latent_Warning monitors replication time between domain controller and partners. Its formula is:
RLT\Replication_Latency GT 3600
Replication_Partner_Unsync_Warn monitors synchronization of replication partner system clock. Its formula is:
RLT\Clock_Delta GT 0
OR
RLT\Clock_Delta LT -1
Trust_Added_Warning monitors for added trust relationships. Its formula is:
Trust\Added EQ TRUE
Trust_Dropped_Warning monitors for dropped trust relationships. Its formula is:
Trust\Dropped EQ true
Trust_Failing_Critical monitors the status of a trust. Its formula is:
Trust\Status EQ Failed
See also:
Attribute Groups Used by Predefined
Workspaces
Organization of the Predefined Workspaces