Key Management Events Test

The Key Management Service (KMS) activates computers on a local network, eliminating the need for individual computers to connect to Microsoft. To do this, KMS uses a client–server topology. KMS client computers can locate KMS host computers by using Domain Name System (DNS) or a static configuration. KMS clients contact the KMS host by using remote procedure call (RPC). A KMS host responds to each valid activation request from a KMS client with the count of how many computers have contacted the KMS host for activation. Clients that receive a count below their activation threshold are not activated. If a computer running Windows Server 2008 or Windows Server 2008 R2 receives an activation count that is ≥5, it is activated. If a computer running Windows 7 receives an activation count ≥25, it is activated.

If users to a Windows server are having trouble logging on, administrators may want to check the Key Management Service event log to see if it is owing to an issue with KMS. This event log tracks events related to Kerberos key distribution, when a server functions as a key distribution center. To enable administrators to rapidly capture error/warning events captured by this event log and troubleshoot logon issues that occur, administrators can run the Key Management Events test. This test monitors the Key Management Service event log and reports the count and details of errors and warning events captured by that log.

Target of the test : An Active Directory server

Agent deploying the test : An internal agent

Outputs of the test : One set of results for the server being monitored

Configurable parameters for the test
Parameters Description

Test period

This indicates how often should the test be executed.

Host

The host for which the test is to be configured.

Port

Refers to the port used by the EventLog Service.  Here it is null.

Logtype

Refers to the type of event logs to be monitored. By default, this is set to Key Management Service.

Policy Based Filter

Using this page, administrators can configure the event sources, event IDs, and event descriptions to be monitored by this test. In order to enable administrators to easily and accurately provide this specification, this page provides the following options:

  • Manually specify the event sources, IDs, and descriptions in the Filter text area, or,
  • Select a specification from the predefined filter policies listed in the Filter box

For explicit, manual specification of the filter conditions, select the No option against the Policy Based Filter field. This is the default selection. To choose from the list of pre-configured filter policies, or to create a new filter policy and then associate the same with the test, select the Yes option against this field.

Filter

If the Policy Based Filter flag is set to No, then a Filter text area will appear, wherein you will have to specify the event sources, event IDs, and event descriptions to be monitored. This specification should be of the following format: {Displayname}:{event_sources_to_be_included}:{event_sources_to_be_excluded}:{event_IDs_to_be_included}:{event_IDs_to_be_excluded}:{event_descriptions_to_be_included}:{event_descriptions_to_be_excluded}. For example, assume that the Filter text area takes the value, OS_events:all:Browse,Print:all:none:all:none. Here:

  • OS_events is the display name that will appear as a descriptor of the test in the monitor UI;
  • all indicates that all the event sources need to be considered while monitoring. To monitor specific event sources, provide the source names as a comma-separated list. To ensure that none of the event sources are monitored, specify none.
  • Next, to ensure that specific event sources are excluded from monitoring, provide a comma-separated list of source names. Accordingly, in our example, Browse and Print have been excluded from monitoring. Alternatively, you can use all to indicate that all the event sources have to be excluded from monitoring, or none to denote that none of the event sources need be excluded.
  • In the same manner, you can provide a comma-separated list of event IDs that require monitoring. The all in our example represents that all the event IDs need to be considered while monitoring.
  • Similarly, the none (following all in our example) is indicative of the fact that none of the event IDs need to be excluded from monitoring. On the other hand, if you want to instruct the eG Enterprise system to ignore a few event IDs during monitoring, then provide the IDs as a comma-separated list. Likewise, specifying all makes sure that all the event IDs are excluded from monitoring.
  • The all which follows implies that all events, regardless of description, need to be included for monitoring. To exclude all events, use none. On the other hand, if you provide a comma-separated list of event descriptions, then the events with the specified descriptions will alone be monitored. Event descriptions can be of any of the following forms - desc*, or desc, or *desc*,or desc*, or desc1*desc2, etc. desc here refers to any string that forms part of the description. A leading '*' signifies any number of leading characters, while a trailing '*' signifies any number of trailing characters.
  • In the same way, you can also provide a comma-separated list of event descriptions to be excluded from monitoring. Here again, the specification can be of any of the following forms: desc*, or desc, or *desc*,or desc*, or desc1*desc2, etc. desc here refers to any string that forms part of the description. A leading '*' signifies any number of leading characters, while a trailing '*' signifies any number of trailing characters. In our example however, none is specified, indicating that no event descriptions are to be excluded from monitoring. If you use all instead, it would mean that all event descriptions are to be excluded from monitoring.

Note:

The event sources and event IDs specified here should be exactly the same as that which appears in the Event Viewer window.  

On the other hand, if the Policy Based Filter flag is set to Yes, then a Filter list box will appear, displaying the filter policies that pre-exist in the eG Enterprise system. A filter policy typically comprises of a specific set of event sources, event IDs, and event descriptions to be monitored. This specification is built into the policy in the following format:

{Policyname}:{event_sources_to_be_included}:{event_sources_to_be_excluded}:{event_IDs_to_be_included}:{event_IDs_to_be_excluded}:{event_descriptions_to_be_included}:{event_descriptions_to_be_excluded}

To monitor a specific combination of event sources, event IDs, and event descriptions, you can choose the corresponding filter policy from the Filter list box. Multiple filter policies can be so selected. Alternatively, you can modify any of the existing policies to suit your needs, or create a new filter policy. To facilitate this, a Click here link appears just above the test configuration section, once the Yes option is chosen against the Policy Based Filter. Clicking on the Click here link leads you to a page where you can modify the existing policies or create a new one. The changed policy or the new policy can then be associated with the test by selecting the policy name from the Filter list box in this page.

Events During Restart

By default, this flag is set to Yes. This ensures that whenever the agent is stopped and later started, the events that might have occurred during the period of non-availability of the agent are included in the number of events reported by the agent. Setting the flag to No ensures that the agent, when restarted, ignores the events that occurred during the time it was not available.

Stateless Alerts

Typically, the eG manager generates email alerts only when the state of a specific measurement changes. A state change typically occurs only when the threshold of a measure is violated a configured number of times within a specified time window. While this ensured that the eG manager raised alarms only when the problem was severe enough, in some cases, it may cause one/more problems to go unnoticed, just because they did not result in a state change. For example, take the case of the EventLog test. When this test captures an error event for the very first time, the eG manager will send out a critical email alert with the details of the error event to configured recipients. Now, the next time the test runs, if a different error event is captured, the eG manager will keep the state of the measure as critical, but will not send out the details of this error event to the user; thus, the second issue will remain hidden from the user. To make sure that administrators do not miss/overlook critical issues, the eG Enterprise monitoring solution provides the stateless alerting capability. To enable this capability for this test, set the stateless alerts flag to Yes. This will ensure that email alerts are generated for this test, regardless of whether or not the state of the measures reported by this test changes.

UseWMI

The eG agent can either use WMI to extract event log statistics or directly parse the event logs using event log APIs. If this flag is Yes, then WMI is used. If not, the event log APIs are used. This option is provided because on some Windows 2000 systems (especially ones with service pack 3 or lower), the use of WMI access to event logs can cause the CPU usage of the WinMgmt process to shoot up. On such systems, set this parameter value to No.

DDforInformation

eG Enterprise also provides you with options to restrict the amount of storage required for event log tests. Towards this end, the DDforInformation and DDforWarning flags have been made available in this page. By default, both these flags are set to Yes, indicating that by default, the test generates detailed diagnostic measures for information events and warning events. If you do not want the test to generate and store detailed measures for information events, set this flag to No.

DDforWarning

To ensure that the test does not generate and store detailed measures for warning events, set this flag to No.

DD Frequency

Refers to the frequency with which detailed diagnosis measures are to be generated for this test. The default is 1:1. This indicates that, by default, detailed measures will be generated every time this test runs, and also every time the test detects a problem. You can modify this frequency, if you so desire. Also, if you intend to disable the detailed diagnosis capability for this test, you can do so by specifying none against DD frequency.

Detailed Diagnosis

To make diagnosis more efficient and accurate, the eG Enterprise embeds an optional detailed diagnostic capability. With this capability, the eG agents can be configured to run detailed, more elaborate tests as and when specific problems are detected. To enable the detailed diagnosis capability of this test for a particular server, choose the On option. To disable the capability, click on the Off option.

The option to selectively enable/disable the detailed diagnosis capability will be available only if the following conditions are fulfilled:

  • The eG manager license should allow the detailed diagnosis capability
  • Both the normal and abnormal frequencies configured for the detailed diagnosis measures should not be 0.
Measurements made by the test
Measurement Description Measurement Unit Interpretation

Key management event information messages

This refers to the number of information events that were captured by the Key Management Service log during the test's last execution.

Number

A change in value of this measure may indicate infrequent but successful operations.

Please check the Key Management Service log in the Event Log Viewer for more details.

Key management event warnings

This refers to the number of warning events captured by the Key Management Service log during the test's last execution.

Number

A high value of this measure indicates problems that may not have an immediate impact, but may cause future problems.

Please check the Key Management Service log in the Event Log Viewer for more details.

Key management event errors

This refers to the number of error events captured by the Key Management Service log during the test's last execution.

Number

A very low value (zero) is desired for this measure, as it indicates good health.

An increasing trend or a high value indicates the existence of problems.

Please check the Key Management Service log in the Event Log Viewer for more details.

Key management event critical errors

Indicates the number of critical events that were generated when the test was last executed.

Number

A critical event is one that the KMS cannot automatically recover from.

This measure is applicable only for Windows 2008/Windows Vista/Windows 7 systems.

A very low value (zero) indicates that the service is in a healthy state and is running smoothly without any potential problems.

An increasing trend or high value indicates the existence of fatal/irrepairable problems.

The detailed diagnosis of this measure describes all the critical events captured by the Key Management Service log during the last measurement period.

Please check the Key Management Service log in the Event Log Viewer for more details.

Key management event verbose messages

Indicates the number of verbose events that were generated when the test was last executed.

Number

Verbose logging provides more details in the log entry, which will enable you to troubleshoot issues better.

This measure is applicable only for Windows 2008/Windows Vista/Windows 7 systems.

The detailed diagnosis of this measure describes all the verbose events that were captured by the Key Management Service log during the last measurement period.

Please check the Key Management Service log in the Event Log Viewer for more details.