Alerting when performance counters cannot be resolved by SCOM

First published on TECHNET on Feb 03, 2015

A customer of mine is seeing some random issues with not being able to resolve Exchange performance counters and would like to get an alert when this happens so we can right away.

When cannot resolve a performance counter, it will log one of two events:

  • Event ID 10102 (could not resolve counter)
  • Event ID 10103 (could not resolve counter instance)

I created a simple Management Pack with an Alert Rule to alert on these events. The attached MP contains one Rule with the following criteria:

Name: Alert on Missing Performance Counters
Target: Health Service
Event log:
Event Source: Health Service Modules
Event ID: 10102 / 10103

The Rule will generate an alert when event ID 10102 (could not resolve counter) or 10103 (could not resolve counter instance) are logged.  Alert suppression is enabled for the Object, Counter, and Instance parameters so it will generate a separate alert for each counter that cannot be resolved on a monitored computer.

The Rule is disabled by default…I would generally recommend only enabling it on computers that you are having problems with at first, then on others if needed.

Here is a screen shot of the Alert:



This article was originally published by Microsoft's Core Infrastructure and Security Blog. You can find the original article here.