0byt3m1n1
Path:
C:
/
Windows
/
PLA
/
Rules
/
[
Home
]
File: Rules.AD.xml
<?xml version="1.0" encoding="utf-8"?><Rules><Logging level="0" /><Group name="$(GroupAD.Report)"><Rule name="$(RuleDirInsertTuningParameters)" enabled="true" visible="false"><Step select="/Report/Section[last()]"><Exists><When expression="count(/Report/Section[@name='SectionActiveDirectory']) > 0"><Insert select="/Report/Section[@name='SectionActiveDirectory']" /></When><Otherwise><Insert select="."><Node axis="preceding-sibling"><Section name="SectionActiveDirectory" /></Node></Insert></Otherwise></Exists></Step><Step select="/Report/Section[@name='SectionActiveDirectory']"><Exists><Otherwise><Insert select="."><Node document="AD Registry.xml" axis="child" select="/Report/Section/Table[@name='registryKeys']" /></Insert><Insert select="Table[@name='registryKeys']"><Attribute name="name" value="TableADTuningParameters" /><Attribute name="topic" value="TopicADTuningParams" /></Insert></Otherwise></Exists></Step><Step select="/Report/Section[@name='SectionActiveDirectory']/Table[@name='TableADTuningParameters']/Header/Header"><Exists><Otherwise><Insert select="Data[@name='registryKeysKey']"><Node axis="following-sibling"><Data name="registryKeysSubKey" class="string" /></Node></Insert><Insert select="Data[@name='registryKeysKey']"><Attribute name="visible" value="false" /></Insert></Otherwise></Exists></Step><Step select="/Report/Section[@name='SectionActiveDirectory']/Table[@name='TableADTuningParameters']/Item[contains(Data[@name='registryKeysQuery'],'\\\\')]/Item" sortType="all"><Variable name="fullkey" expression="Data[@name='registryKeysKey']" /><Variable name="parentkey" expression="substring-before(../Data[@name='registryKeysQuery'],'\\\\')" /><Variable name="subkey" expression="substring-after('{fullkey}', '{parentkey}')" /><Exists><When expression="starts-with('{subkey}','\\')"><Variable name="subkey" expression="substring-after('{subkey}','\\')" /><Insert select="Data[@name='registryKeysKey']"><Node axis="following-sibling"><Data name="registryKeysSubKey">{subkey}</Data></Node></Insert></When><Otherwise><Insert select="Data[@name='registryKeysKey']"><Node axis="following-sibling"><Data name="registryKeysSubKey">{subkey}</Data></Node></Insert></Otherwise></Exists></Step><Step select="/Report/Section[@name='SectionActiveDirectory']/Table[@name='TableADTuningParameters']/Item[not(contains(Data[@name='registryKeysQuery'],'\\\\'))]/Item" sortType="all"><Variable name="fullkey" expression="Data[@name='registryKeysKey']" /><Variable name="parentkey" expression="../Data[@name='registryKeysQuery']" /><Variable name="subkey" expression="substring-after('{fullkey}', '{parentkey}')" /><Exists><When expression="starts-with('{subkey}','\\')"><Variable name="subkey" expression="substring-after('{subkey}','\\')" /><Insert select="Data[@name='registryKeysKey']"><Node axis="following-sibling"><Data name="registryKeysSubKey">{subkey}</Data></Node></Insert></When><Otherwise><Insert select="Data[@name='registryKeysKey']"><Node axis="following-sibling"><Data name="registryKeysSubKey">{subkey}</Data></Node></Insert></Otherwise></Exists></Step><Step select="/Report/Section[@name='SectionActiveDirectory']/Table[@name='TableADTuningParameters']/Item/Item" sortType="all"><Exists><Otherwise><Insert select="Data[@name='registryKeysKey']"><Attribute name="visible" value="false" /></Insert></Otherwise></Exists></Step><Step select="/Report/StringTable/String[@ID='wpdcAdvisor']"><Exists><Otherwise /></Exists><Otherwise><Variable name="stringvar"> $(wpdcAdvisor) </Variable><Insert select="/Report/StringTable"><Node axis="child"><String ID="wpdcAdvisor">{stringvar}</String></Node></Insert></Otherwise></Step><Step select="/Report/StringTable/String[@ID='TopicADTuningParams']"><Exists><Otherwise /></Exists><Otherwise><Variable name="stringvar"> $(TopicADTuningParams) </Variable><Insert select="/Report/StringTable"><Node axis="child"><String ID="TopicADTuningParams">{stringvar}</String></Node></Insert></Otherwise></Step><Step select="/Report/StringTable/String[@ID='TableADTuningParameters']"><Exists><Otherwise /></Exists><Otherwise><Variable name="stringvar"> $(TableADTuningParameters) </Variable><Insert select="/Report/StringTable"><Node axis="child"><String ID="TableADTuningParameters">{stringvar}</String></Node></Insert></Otherwise></Step></Rule></Group><StringTable><String ID="wpdcAdvisor" loc.comment="Report name seen in RPM">Active Directory Domain Services</String><String ID="TopicADTuningParams" loc.comment="Topic name seen in RPM">Tuning Parameters</String><String ID="TableADTuningParameters" loc.comment="Table name seen in RPM">Registry Settings</String><String ID="GroupAD.Report" loc.comment="Group name seen in RPM">Active Directory</String><String ID="RuleDirInsertTuningParameters" loc.comment="Rule name seen in RPM">Add Active Directory tuning parameters</String></StringTable><Group name="$(GroupAD)"><Rule name="$(RuleDirSearchLatency)"><Step select="/Report/Section/Table[@name='TableDsDirSearchForRules']/Item" fatal="true"><Exists><When expression="Data[@name='cpu'] > 1" description="Minimum CPU time for applying this rule."></When></Exists></Step><Step select="/Report/Section/Table[@name='TableDsDirSearchForRules']/Item" sortDataType="number" sortType="max" sortNode="Data[@name='responseTime']" fatal="true"><Exists><When expression="Data[@name='responseTime'] > 10000"><Variable name="result" expression="Data[@name='responseTime']" /><Variable name="internalruleindex" expression="{internalruleindex} + 1" /><Variable name="standard_symptom">$(WarnAdTopResponseTime_symptom)</Variable><Variable name="standard_details">$(WarnAdTopResponseTime_details)</Variable><Variable name="standard_res1">$(WarnAdTopResponseTime_res1)</Variable><Warning select="Data[@name='responseTime']" table="/Report/Section[@name='advice']/Table[@name='warning']" tag="standard_WarnAdTopResponseTime_{internalruleindex}"><Item><Data name="symptom" img="warning" message="standard_WarnAdTopResponseTime_{internalruleindex}" link="standard_WarnAdTopResponseTime_{internalruleindex}">{standard_symptom}</Data><Data name="details" message="standard_WarnAdTopResponseTime_{internalruleindex}">{standard_details}</Data><Data name="resolution" message="standard_WarnAdTopResponseTime_{internalruleindex}">{standard_res1}</Data></Item></Warning></When></Exists></Step></Rule><Rule name="$(RuleDirSearchAncestry)"><Step select="/Report/Section/Table[@name='TableDsDirSearchForRules']/Item" fatal="true"><Exists><When expression="Data[@name='cpu'] > 1" description="Minimum CPU time. This rule will only operate when the CPU time is above this value."></When></Exists></Step><Step select="/Report/Section/Table[@name='TableDsDirSearchForRules']/Item" sortDataType="number" sortType="max" sortNode="Data[@name='cpu']" fatal="true"><Exists><When expression="Data[@name='Index'] = 'ancestors_index'"><Variable name="internalruleindex" expression="{internalruleindex} + 1" /><Variable name="standard_symptom">$(WarnAdAncestorsIndex_symptom)</Variable><Warning select="Data[@name='cpu']" table="/Report/Section[@name='advice']/Table[@name='info']" tag="standard_WarnAdAncestorsIndex_{internalruleindex}"><Item><Data name="symptom" img="info" message="standard_WarnAdAncestorsIndex_{internalruleindex}" link="standard_WarnAdAncestorsIndex_{internalruleindex}">{standard_symptom}</Data></Item></Warning></When></Exists></Step></Rule><Rule name="$(RuleDirSearchPdnt)"><Step select="/Report/Section/Table[@name='TableDsDirSearchForRules']/Item" fatal="true"><Exists><When expression="Data[@name='cpu'] > 1" description="Minimum CPU time. This rule will only operate when the CPU time is above this value."></When></Exists></Step><Step select="/Report/Section/Table[@name='TableDsDirSearchForRules']/Item" sortDataType="number" sortType="max" sortNode="Data[@name='cpu']" fatal="true"><Exists><When expression="Data[@name='Index'] = 'pdnt_index'"><Variable name="internalruleindex" expression="{internalruleindex} + 1" /><Variable name="standard_symptom">$(WarnAdPdntIndex_symptom)</Variable><Warning select="Data[@name='cpu']" table="/Report/Section[@name='advice']/Table[@name='info']" tag="standard_WarnAdPdntIndex_{internalruleindex}"><Item><Data name="symptom" img="info" message="standard_WarnAdPdntIndex_{internalruleindex}" link="standard_WarnAdPdntIndex_{internalruleindex}">{standard_symptom}</Data></Item></Warning></When></Exists></Step></Rule><Rule name="$(RuleDirSearchDnt)"><Step select="/Report/Section/Table[@name='TableDsDirSearchForRules']/Item" fatal="true"><Exists><When expression="Data[@name='cpu'] > 1" description="Minimum CPU time. This rule will only operate when the CPU time is above this value."></When></Exists></Step><Step select="/Report/Section/Table[@name='TableDsDirSearchForRules']/Item" sortDataType="number" sortType="max" sortNode="Data[@name='cpu']" fatal="true"><Exists><When expression="Data[@name='Index'] = 'dnt_index'"><Variable name="internalruleindex" expression="{internalruleindex} + 1" /><Variable name="standard_symptom">$(WarnAdDntIndex_symptom)</Variable><Warning select="Data[@name='cpu']" table="/Report/Section[@name='advice']/Table[@name='info']" tag="standard_WarnAdDntIndex_{internalruleindex}"><Item><Data name="symptom" img="info" message="standard_WarnAdDntIndex_{internalruleindex}" link="standard_WarnAdDntIndex_{internalruleindex}">{standard_symptom}</Data></Item></Warning></When></Exists></Step></Rule><Rule name="$(RuleDirSearchNameCache)"><Step select="/Report/Section/Table[@name='DirectoryServices']/Item[Data[@name='counter']='LDAP Searches/sec']" fatal="true"><Exists><When expression="Data[@name='mean'] > 100" description="Minimum Lightweight Directory Access Protocol (LDAP) search rate. This rule will only operate when the search rate is above this value."><Variable name="searches" expression="Data[@name='mean']" /></When></Exists></Step><Step select="/Report/Section/Table[@name='DirectoryServices']/Item[Data[@name='counter']='DS Name Cache hit rate']" fatal="true"><Exists><When expression="Data[@name='mean'] < 50" description="Name cache hit rate threshold. This rule will issue a warning if the hit rate is below this value."><Variable name="dsnamecache" expression="Data[@name='mean']" /><Variable name="internalruleindex" expression="{internalruleindex} + 1" /><Variable name="standard_symptom">$(WarnAdDsNameCacheLow_symptom)</Variable><Warning select="Data[@name='counter']" table="/Report/Section[@name='advice']/Table[@name='warning']" tag="standard_WarnAdDsNameCacheLow_{internalruleindex}"><Item><Data name="symptom" img="warning" message="standard_WarnAdDsNameCacheLow_{internalruleindex}" link="standard_WarnAdDsNameCacheLow_{internalruleindex}">{standard_symptom}</Data></Item></Warning></When></Exists></Step></Rule><Rule name="$(RuleDirSearchReferrals)"><Step select="/Report/Section/Table[@name='TableDsDirSearchForRules']/Item[Data[@name='ObjDn']='CN=Schema']" fatal="true"><Exists><Variable name="visited" expression="Data[@name='ObjVisited']" /><Variable name="returned" expression="Data[@name='ObjReturned']" /><Variable name="totalobj" expression="format-number({visited}+{returned},'0')" /><Variable name="client" expression="Data[@name='Client']" /><When expression="{totalobj} = 0" /></Exists></Step><Step select="/Report/Section/Table[@name='TableDsDirSearchForRules']/Item[(Data[@name='ObjDn']='CN=Configuration') and (Data[@name='Client']='{client}')]" fatal="true"><Exists><Variable name="visited" expression="Data[@name='ObjVisited']" /><Variable name="returned" expression="Data[@name='ObjReturned']" /><Variable name="totalobj" expression="format-number({visited}+{returned},'0')" /><When expression="{totalobj} = 0" /></Exists></Step><Step select="/Report/Section/Table[@name='TableDsDirSearchForRules']/Item[(Data[@name='Client']='{client}') and (starts-with(Data[@name='ObjDn'],'dc=')) and (Data[@name='Choice']='deep')]" fatal="true"><Exists><When expression="Data[@name='cpu'] > 1" description="Minimum CPU time. This rule will only operate when the CPU time is above this value."><Variable name="internalruleindex" expression="{internalruleindex} + 1" /><Variable name="standard_symptom">$(WarnAdReferrals_symptom)</Variable><Warning select="preceding-sibling::Data[@name='Choice']" table="/Report/Section[@name='advice']/Table[@name='info']" tag="standard_WarnAdReferrals_{internalruleindex}"><Item><Data name="symptom" img="info" message="standard_WarnAdReferrals_{internalruleindex}" link="standard_WarnAdReferrals_{internalruleindex}">{standard_symptom}</Data></Item></Warning></When></Exists></Step></Rule><Rule name="$(RuleDirSearchTooManyObj)"><Step select="/Report/Section/Table[@name='TableDsDirSearchForRules']/Item" fatal="true"><Exists><When expression="Data[@name='cpu'] > 1" description="Minimum CPU time. This rule will only operate when the CPU time is above this value."></When></Exists></Step><Step select="/Report/Section/Table[@name='TableDsDirSearchForRules']/Item" sortDataType="number" sortType="max" sortNode="Data[@name='ObjVisited']" fatal="true"><Exists><When expression="Data[@name='ObjVisited'] > 10000" description="Object number threshold. This rule will issue a warning if the number of objects examined is above this value. The default value is > 10000."><Variable name="result" expression="Data[@name='ObjVisited']" /><Variable name="cpu" expression="Data[@name='cpu']" /><Variable name="internalruleindex" expression="{internalruleindex} + 1" /><Variable name="standard_symptom">$(WarnAdTopObjectVisited_symptom)</Variable><Warning select="Data[@name='ObjVisited']" table="/Report/Section[@name='advice']/Table[@name='warning']" tag="standard_WarnAdTopObjectVisited_{internalruleindex}"><Item><Data name="symptom" img="warning" message="standard_WarnAdTopObjectVisited_{internalruleindex}" link="standard_WarnAdTopObjectVisited_{internalruleindex}">{standard_symptom}</Data></Item></Warning></When></Exists></Step></Rule><Rule name="$(RuleDirSearchTooManyObjRtn)"><Step select="/Report/Section/Table[@name='TableDsDirSearchForRules']/Item" fatal="true"><Exists><When expression="Data[@name='cpu'] > 1" description="Minimum CPU time. This rule will only operate when the CPU time is above this value."></When></Exists></Step><Step select="/Report/Section/Table[@name='TableDsDirSearchForRules']/Item" sortDataType="number" sortType="max" sortNode="Data[@name='ObjReturned']" fatal="true"><Exists><When expression="Data[@name='ObjReturned'] > 1000" description="Object number threshold. This rule will issue a warning if the number of objects returned is above this value. The default value is > 1000."><Variable name="result" expression="Data[@name='ObjReturned']" /><Variable name="internalruleindex" expression="{internalruleindex} + 1" /><Variable name="standard_symptom">$(WarnAdTooManyObjectReturned_symptom)</Variable><Warning select="Data[@name='ObjReturned']" table="/Report/Section[@name='advice']/Table[@name='warning']" tag="standard_WarnAdTooManyObjectReturned_{internalruleindex}"><Item><Data name="symptom" img="warning" message="standard_WarnAdTooManyObjectReturned_{internalruleindex}" link="standard_WarnAdTooManyObjectReturned_{internalruleindex}">{standard_symptom}</Data></Item></Warning></When></Exists></Step></Rule><Rule name="$(RuleDirSearchHighCpu)"><Step select="/Report/Section/Table[@name='TableDsDirSearch']/Item" sortDataType="number" sortType="max" sortNode="Data[@name='cpu']" fatal="true"><Exists><When expression="Data[@name='cpu'] > 10" description="Maximum CPU usage threshold. This rule will issue a warning if the CPU time for a single client is above this value. The default value is > 10."><Variable name="result" expression="Data[@name='cpu']" /><Variable name="internalruleindex" expression="{internalruleindex} + 1" /><Variable name="standard_symptom">$(WarnAdTopObjectReturned_symptom)</Variable><Warning select="Data[@name='cpu']" table="/Report/Section[@name='advice']/Table[@name='warning']" tag="standard_WarnAdTopObjectReturned_{internalruleindex}"><Item><Data name="symptom" img="warning" message="standard_WarnAdTopObjectReturned_{internalruleindex}" link="standard_WarnAdTopObjectReturned_{internalruleindex}">{standard_symptom}</Data></Item></Warning></When></Exists></Step></Rule><Rule name="$(RuleDirSearchCpu)"><Step select="/Report/Section/Table[@name='TableDsDirSearchForRules']/Item" sortDataType="number" sortType="max" sortNode="Data[@name='cpu']" fatal="true"><Exists><When expression="Data[@name='cpu'] > 10" description="Maximum CPU usage threshold. This rule will issue a warning if the CPU time for a single search is above this value. The default value is > 10."><Variable name="result" expression="Data[@name='cpu']" /><Variable name="internalruleindex" expression="{internalruleindex} + 1" /><Variable name="standard_symptom">$(WarnAdTopCPUSearch_symptom)</Variable><Warning select="Data[@name='Encrypt']" table="/Report/Section[@name='advice']/Table[@name='warning']" tag="standard_WarnAdTopCPUSearch_{internalruleindex}"><Item><Data name="symptom" img="warning" message="standard_WarnAdTopCPUSearch_{internalruleindex}" link="standard_WarnAdTopCPUSearch_{internalruleindex}">{standard_symptom}</Data></Item></Warning></When></Exists></Step></Rule><Rule name="$(RuleKerbError)"><Step select="/Report/Section/Table[@name='TableKerbTgsRequestForRules']/Item" fatal="true"><Exists><When expression="Data[@name='requestRate'] > 5" description="Maximum Ticket Granting Service CPU usage threshold. This rule will issue a warning if the Ticket Granting Service usage is above this value. The default value is > 5."></When></Exists></Step><Step select="/Report/Section/Table[@name='TableKerbTgsRequestForRules']/Item" sortDataType="number" sortType="max" sortNode="Data[@name='cpu']" fatal="true"><Exists><When expression="Data[@name='StatusCode'] >< KDC_ERR_SUCCESS"><Variable name="internalruleindex" expression="{internalruleindex} + 1" /><Variable name="standard_symptom">$(WarnAdTgsFailures_symptom)</Variable><Warning select="Data[@name='cpu']" table="/Report/Section[@name='advice']/Table[@name='warning']" tag="standard_WarnAdTgsFailures_{internalruleindex}"><Item><Data name="symptom" img="warning" message="standard_WarnAdTgsFailures_{internalruleindex}" link="standard_WarnAdTgsFailures_{internalruleindex}">{standard_symptom}</Data></Item></Warning></When></Exists></Step></Rule><Rule name="$(RuleKerbMixedEncrypt)"><Step select="/Report/Section/Table[@name='TableLdapRequestForRules']/Item[Data[@name='Encrypt'] = 'Sign/Seal']" sortDataType="number" sortType="max" sortNode="Data[@name='cpu']" fatal="true"><Exists><When expression="format-number(Data[@name='cpu'] > 5,'0')" description="Minimum CPU usage threshold. This rule operates when the Encryption CPU time is above this value. The default value is > 5."><Variable name="requestrate" expression="Data[@name='requestRate']" /></When></Exists></Step><Step select="/Report/Section/Table[@name='TableLdapRequestForRules']/Item[Data[@name='Encrypt'] = 'None']" sortDataType="number" sortType="max" sortNode="Data[@name='cpu']" fatal="true"><Exists><When expression="format-number(Data[@name='cpu'] > 5,'0')" description="Maximum CPU usage threshold. This rule will issue a warning if the Non-encryption CPU time is above this value while the Encryption CPU time is above its threshold. The default value is > 5."><Variable name="requestrate" expression="Data[@name='requestRate']" /></When></Exists></Step><Step select="/Report/Section/Table[@name='TableLdapRequestForRules']/Item" fatal="true"><Exists><When expression="{requestrate} > 0"><Variable name="internalruleindex" expression="{internalruleindex} + 1" /><Variable name="standard_symptom">$(WarnAdEncryptionOverhead_symptom)</Variable><Warning select="Data[@name='Encrypt']" table="/Report/Section[@name='advice']/Table[@name='info']" tag="standard_WarnAdEncryptionOverhead_{internalruleindex}"><Item><Data name="symptom" img="info" message="standard_WarnAdEncryptionOverhead_{internalruleindex}" link="standard_WarnAdEncryptionOverhead_{internalruleindex}">{standard_symptom}</Data></Item></Warning></When></Exists></Step></Rule><Rule name="$(RuleLdapError)"><Step select="/Report/Section/Table[@name='TableLdapRequestStatus']/Item" fatal="true"><Exists><When expression="Data[@name='requestRate'] > 10" description="Minimum LDAP rate threshold. This rule operates when the LDAP rate is above this value. The default value is > 10."></When></Exists></Step><Step select="/Report/Section/Table[@name='TableLdapRequestStatus']/Item" sortDataType="number" sortType="max" sortNode="Data[@name='cpu']" fatal="true"><Exists><When expression="Data[@name='exitId'] != 0"><Variable name="internalruleindex" expression="{internalruleindex} + 1" /><Variable name="standard_symptom">$(WarnAdLdapFailures_symptom)</Variable><Warning select="Data[@name='cpu']" table="/Report/Section[@name='advice']/Table[@name='warning']" tag="standard_WarnAdLdapFailures_{internalruleindex}"><Item><Data name="symptom" img="warning" message="standard_WarnAdLdapFailures_{internalruleindex}" link="standard_WarnAdLdapFailures_{internalruleindex}">{standard_symptom}</Data></Item></Warning></When></Exists></Step></Rule><Rule name="$(RuleLdapErrorCpu)"><Step select="/Report/Section/Table[@name='TableLdapRequestStatus']/Item[Data[@name='exitId'] != 0]" fatal="true"><Exists><When expression="format-number(Data[@name='cpu'] > 5,'0')" description="Minimum CPU usage threshold. This rule operates when the CPU time is above this value. The default value is > 5."><Variable name="result" expression="Data[@name='cpu']" /><Variable name="internalruleindex" expression="{internalruleindex} + 1" /><Variable name="standard_symptom">$(WarnAdLdapExitIdFailure_symptom)</Variable><Warning select="parent::Data[@name='ExitId']" table="/Report/Section[@name='advice']/Table[@name='warning']" tag="standard_WarnAdLdapExitIdFailure_{internalruleindex}"><Item><Data name="symptom" img="warning" message="standard_WarnAdLdapExitIdFailure_{internalruleindex}" link="standard_WarnAdLdapExitIdFailure_{internalruleindex}">{standard_symptom}</Data></Item></Warning></When></Exists></Step></Rule><Rule name="$(RuleSystemHighDisk)"><Step select="/Report/Section/Table[@name='hotFile']/Item" sortDataType="number" sortType="max" sortNode="Data[@name='ioRate']" fatal="true"><Exists><When expression="not(Data[@name='file'] = 'ntds.dit' or Data[@name='file'] = 'edb.log')"><Variable name="file" expression="Data[@name='file']" /></When></Exists></Step><Step select="/Report/Section/Table[@name='hotFile']/Item[Data[@name='file'] = '{file}']" fatal="true"><Exists><When expression="Data[@name='ioRate'] > 20" description="Maximum acceptable I/O rate (operations per second) for files not related to Active Directory. This rule will issue a warning if other file activity exceeds this value. The default value is > 20."><Variable name="result" expression="Data[@name='ioRate']" /><Variable name="internalruleindex" expression="{internalruleindex} + 1" /><Variable name="standard_symptom">$(WarnAdDitFile_symptom)</Variable><Warning select="Data[@name='file']" table="/Report/Section[@name='advice']/Table[@name='warning']" tag="standard_WarnAdDitFile_{internalruleindex}"><Item><Data name="symptom" img="warning" message="standard_WarnAdDitFile_{internalruleindex}" link="standard_WarnAdDitFile_{internalruleindex}">{standard_symptom}</Data></Item></Warning></When></Exists></Step></Rule><Rule name="$(RuleSystemHighCpuNotAD)"><Step select="/Report/Section/Table[@name='imageStats']/Item[Data[@name= 'pid'] != 0]" sortDataType="number" sortType="max" sortNode="Data[@name='groupCpu']" fatal="true"><Exists><Variable name="image" expression="Data[@name='image']" /><When expression="Data[@name='groupCpu'] > 10" description="Maximum acceptable CPU time for a process other than Lsass.exe or Dsamain.exe. This rule will issue a warning if another process exceeds this value. The default value is > 10."></When></Exists></Step><Step select="/Report/Section/Table[@name='imageStats']/Item[Data[@name= 'image']='{image}']" fatal="true"><Exists><When expression="not('{image}' = 'lsass.exe' or '{image}' = 'ldifde' or '{image}' = 'dsamain.exe')"><Variable name="result" expression="Data[@name='pid']" /><Variable name="internalruleindex" expression="{internalruleindex} + 1" /><Variable name="standard_symptom">$(WarnAdWhereslsass_symptom)</Variable><Warning select="Data[@name='image']" table="/Report/Section[@name='advice']/Table[@name='warning']" tag="standard_WarnAdWhereslsass_{internalruleindex}"><Item><Data name="symptom" img="warning" message="standard_WarnAdWhereslsass_{internalruleindex}" link="standard_WarnAdWhereslsass_{internalruleindex}">{standard_symptom}</Data></Item></Warning></When></Exists></Step></Rule><Rule name="$(RuleHideNtdsCtrs)"><Step select="/Report/Section/Table[@name='DirectoryServices']/Item[Data[@name='counter']='DRA Highest USN Issued (Low part)']"><Exists><Variable name="min" expression="Data[@name='min']" /><When expression="Data[@name='max'] = {min}"><Insert select="parent::Item"><Attribute name="visible" value="false" /></Insert></When></Exists></Step><Step select="/Report/Section/Table[@name='DirectoryServices']/Item[Data[@name='counter']='DRA Highest USN Issued (High part)']"><Exists><Variable name="min" expression="Data[@name='min']" /><When expression="Data[@name='max'] = {min}"><Insert select="parent::Item"><Attribute name="visible" value="false" /></Insert></When></Exists></Step><Step select="/Report/Section/Table[@name='DirectoryServices']/Item[Data[@name='counter']='DRA Highest USN Committed (Low part)']"><Exists><Variable name="min" expression="Data[@name='min']" /><When expression="Data[@name='max'] = {min}"><Insert select="parent::Item"><Attribute name="visible" value="false" /></Insert></When></Exists></Step><Step select="/Report/Section/Table[@name='DirectoryServices']/Item[Data[@name='counter']='DRA Highest USN Committed (High part)']"><Exists><Variable name="min" expression="Data[@name='min']" /><When expression="Data[@name='max'] = {min}"><Insert select="parent::Item"><Attribute name="visible" value="false" /></Insert></When></Exists></Step><Step select="/Report/Section/Table[@name='DirectoryServices']/Item[Data[@name='counter']='DS Monitor List Size']"><Exists><Variable name="min" expression="Data[@name='min']" /><When expression="Data[@name='max'] = {min}"><Insert select="parent::Item"><Attribute name="visible" value="false" /></Insert></When></Exists></Step><Step select="/Report/Section/Table[@name='DirectoryServices']/Item[Data[@name='counter']='DS Threads in Use']"><Exists><Variable name="min" expression="Data[@name='min']" /><When expression="Data[@name='max'] = {min}"><Insert select="parent::Item"><Attribute name="visible" value="false" /></Insert></When></Exists></Step><Step select="/Report/Section/Table[@name='DirectoryServices']/Item[Data[@name='counter']='LDAP Client Sessions']"><Exists><Variable name="min" expression="Data[@name='min']" /><When expression="Data[@name='max'] = {min}"><Insert select="parent::Item"><Attribute name="visible" value="false" /></Insert></When></Exists></Step></Rule></Group><StringTable><String ID="wpdcAdvisor" loc.comment="Report name seen in RPM">Active Directory Domain Services</String><String ID="TopicADTuningParams" loc.comment="Topic name seen in RPM">Tuning Parameters</String><String ID="TableADTuningParameters" loc.comment="Table name seen in RPM">Registry Settings</String><String ID="GroupAD" loc.comment="Group name seen in RPM">Active Directory</String><String ID="RuleHideNtdsCtrs" loc.comment="Rule name seen in RPM">Hide Infrequently Used NTDS Performance Counters</String><String ID="RuleDirSearchLatency" loc.comment="Rule name seen in RPM">Directory Search - Search Latency Too High</String><String ID="RuleDirSearchAncestry" loc.comment="Rule name seen in RPM">Directory Search - Misused Ancestry Index</String><String ID="RuleDirSearchPdnt" loc.comment="Rule name seen in RPM">Directory Search - Misused PDNT Index</String><String ID="RuleDirSearchDnt" loc.comment="Rule name seen in RPM">Directory Search - Misused DNT Index Search</String><String ID="RuleDirSearchNameCache" loc.comment="Rule name seen in RPM">Directory Search - Name Cache Usage Too Low</String><String ID="RuleDirSearchReferrals" loc.comment="Rule name seen in RPM">Directory Search - Search Referrals are Occurring</String><String ID="RuleDirSearchTooManyObj" loc.comment="Rule name seen in RPM">Directory Search - Too Many Objects Visited</String><String ID="RuleDirSearchTooManyObjRtn" loc.comment="Rule name seen in RPM">Directory Search - Too Many Objects Returned</String><String ID="RuleDirSearchHighCpu" loc.comment="Rule name seen in RPM">Directory Search - Search Client Using Too Much CPU</String><String ID="RuleDirSearchCpu" loc.comment="Rule name seen in RPM">Directory Search - Search Using Too Much CPU</String><String ID="RuleKerbError" loc.comment="Rule name seen in RPM">Kerberos Protocol - High Error Rate</String><String ID="RuleKerbMixedEncrypt" loc.comment="Rule name seen in RPM">Kerberos Protocol - Kerberos Encryption Modes are Mixed</String><String ID="RuleLdapError" loc.comment="Rule name seen in RPM">LDAP - High Error Rate</String><String ID="RuleLdapErrorCpu" loc.comment="Rule name seen in RPM">LDAP - High Error Rate Based on CPU Usage</String><String ID="RuleSystemHighDisk" loc.comment="Rule name seen in RPM">System - High Disk I/O rate for a Non-Active Directory File</String><String ID="RuleSystemHighCpuNotAD" loc.comment="Rule name seen in RPM">System - High CPU utilization for a Non-Active Directory Process</String></StringTable><StringTable><String ID="WarnAdTopResponseTime_symptom" loc.comment="Symptom string for warning message: WarnAdTopResponseTime">Top directory search taking {result} milliseconds which is above the rule threshold value.</String><String ID="WarnAdTopResponseTime_details" loc.comment="Details string for warning message: WarnAdTopResponseTime">Maximum acceptable directory search response time (in milliseconds). This rule will issue a warning if the search response time exceeds this value. The default value is > 10000 (10 seconds).</String><String ID="WarnAdTopResponseTime_res1" loc.comment="Resolution string for warning message: WarnAdTopResponseTime">Examine the query details.</String><String ID="WarnAdAncestorsIndex_symptom" loc.comment="Symptom string for warning message: WarnAdAncestorsIndex">Inappropriate ancestry index searches are occurring.</String><String ID="WarnAdPdntIndex_symptom" loc.comment="Symptom string for warning message: WarnAdPdntIndex">Inappropriate Parent Distinguished Name Tag index searches are occurring</String><String ID="WarnAdDntIndex_symptom" loc.comment="Symptom string for warning message: WarnAdDntIndex">Distinguised Name Tag index searches are occurring. Because this method searches the entire directory tree, it should occur only rarely. Consider adding indexes if this query is done frequently.</String><String ID="WarnAdDsNameCacheLow_symptom" loc.comment="Symptom string for warning message: WarnAdDsNameCacheLow">The directory search name cache hit rate is low compared to the number of LDAP searches that are occurring.</String><String ID="WarnAdReferrals_symptom" loc.comment="Symptom string for warning message: WarnAdReferrals">A client application is using search referrals, indicating that its LDAP_OPT_REFERRALS option is on. LDAP client applications should explicitly disable search referrals unless their code is willing to use the referral data.</String><String ID="WarnAdTopObjectVisited_symptom" loc.comment="Symptom string for warning message: WarnAdTopObjectVisited">Top directory search visited {result} objects and consumed {cpu} percent CPU. The search may need a new index or an adjusted scope.</String><String ID="WarnAdTooManyObjectReturned_symptom" loc.comment="Symptom string for warning message: WarnAdTooManyObjectReturned">Top Directory Search returning {result} objects. Consider the use of paged searches or setting the maximum objects read per search to reduce the number of objects read.</String><String ID="WarnAdTopObjectReturned_symptom" loc.comment="Symptom string for warning message: WarnAdTopObjectReturned">Top client taking {result} percent CPU.</String><String ID="WarnAdTopCPUSearch_symptom" loc.comment="Symptom string for warning message: WarnAdTopCPUSearch">Single search taking {result} percent CPU.</String><String ID="WarnAdTgsFailures_symptom" loc.comment="Symptom string for warning message: WarnAdTgsFailures">Kerberos protocol is failing more often than succeeding.</String><String ID="WarnAdEncryptionOverhead_symptom" loc.comment="Symptom string for warning message: WarnAdEncryptionOverhead">Kerberos protocol modes are mixed.</String><String ID="WarnAdLdapFailures_symptom" loc.comment="Symptom string for warning message: WarnAdLdapFailures">More LDAP failures than successes are occurring.</String><String ID="WarnAdLdapExitIdFailure_symptom" loc.comment="Symptom string for warning message: WarnAdLdapExitIdFailure">LDAP errors are consuming {result} percent CPU.</String><String ID="WarnAdDitFile_symptom" loc.comment="Symptom string for warning message: WarnAdDitFile">On directory servers, Ntds.dit and Edb.log should be the most active files. In this case, {file} has the highest I/O rate ({result} operations/sec).</String><String ID="WarnAdWhereslsass_symptom" loc.comment="Symptom string for warning message: WarnAdWhereslsass">Process {result} has the highest CPU percent ({image}%). For this server role, the top process should be Lsass.exe (for Active Directory Domain Services) or Dsamain.exe (for Active Directory Lightweight Directory Services).</String></StringTable></Rules>