Operations performance counters are monitored by Microsoft Operations Manager (MOM) packs that check for specific threshold values. For counters with threshold values, alarms are activated after the values are crossed. For security-related counters, the counter values should be analyzed to ensure that a malicious user has not compromised the system.

Global health

Counter Name

Global health

Display Name

MEDIA– 000 – Global health

Component

Media Stack

Subcategory

Operations

Description

This server is operating at maximum capacity and audio/video quality in all conferences is degraded. Global health indicator - 0 is DISABLED, 1 is NORMAL, 2 is LIGHTLOAD, 3 is HEAVYLOAD, and 4 is OVERLOADED.

Usage

Global health indicates the state of the Media stack, if enabled:

  • 1: A/V Conferencing Server should accept new conferences and users.

  • 2: A/V Conferencing Server should accept new conferences and users. Some video and audio frames are dropped to reduce the overall load on the server.

  • 3: A/V Conferencing Server should accept new conferences and users. Additional video and audio frames are dropped to reduce the overall load.

  • 4: A/V Conferencing Server should stop accepting new users or conferences. No video is sent and the audio frame rate drops to reduce the load on the system.

Minimum Value

0

Maximum Value

4

MOM Enabled

Enabled

Warning Threshold

2

Error Threshold

3+

Resolution: This might be a temporary condition. If the problem persists, consider adding more servers to distribute the load.

TCP disconnects because remote out of sync

Counter Name

Transmission Control Protocol (TCP) disconnects because remote is not synchronized.

Display Name

MEDIA-001- TCP disconnects because remote is not synchronized.

Component

Media Stack

Subcategory

Operations

Description

Number of TCP disconnects happening because the received packet is not synchronized.

Usage

The server is under TCP data injection attack or the server cannot process the TCP channel quickly enough. If the server load is not high and there are abnormal disconnects, the server might be compromised by a malicious user.

Minimum Value

0

Maximum Value

INT_MAX

MOM Enabled

Enabled

Relay allocation failures

Counter Name

Relay allocation failures

Display Name

MEDIA-002- Relay allocation failures

Component

Media Stack

Subcategory

Operations

Description

Number of allocations on the A/V Conferencing Edge Server that have failed.

Usage

The server (A/V Conferencing Server or Mediation Server) cannot bind to local ports or cannot allocate a port on A/V Conferencing Edge Server. Determine whether the A/V Conferencing Edge Server is unavailable or the server has too many open connections.

Minimum Value

0

Maximum Value

INT_MAX

MOM Enabled

Enabled

Secure RTP failures/sec

Counter Name

Secure Real-Time Transport Protocol (RTP) failures per second.

Display Name

MEDIA-003- Number of packets dropped by Secure RTP per second.

Component

Media Stack

Subcategory

Operations

Description

The number of packets dropped by the secure RTP module per second.

Usage

The server (A/V Conferencing Server or Mediation Server) cannot authenticate/decrypt incoming RTP packets. If the problem persists, the server might be compromised by a malicious user. Consult your network security administrator.

Minimum Value

0.0

Maximum Value

FLOAT_MAX

MOM Enabled

Enabled