Pausing user XXXXXX. (MAPI error - Can not access the users mailbox due to network error.)

Good Messaging Server failed to open message store for user XXXXXX. Verify that Exchange Server is operation and accessible. Verify that GoodAdmin account has correct permission on user's mailbox.  (HRESULT:GDMAPI_OpenMsgStore failed (FormatMessage returned 0. The error was 0x80040115))

Good Messaging Server failed to login to Good Mobile Messaging Data Center as hostname XXXXXXX Error code 65547 (errNetTimeout)

Good Messaging Server failed to connect and authenticate with Good Mobile Messaging Data Center at proxy://:?????@proxyxxxx:proxyport/https://xml28.good.com:443/ with hostname XXXXXX.  Reason code 65546 (errNetRecv)

Failed to add a message to connection xxxxxxx.  Error code 65538 (errNetConnect)

Unable to batch messages towards XML gateway 65547:errNetTimeout

Timed operation failed, name:dowork-5 time (ms):1200000, thread name:dowork-5, thread state:handleMessage:svcAdmin, thread id;505861040

Timed operation failed (list of threads), name:dowork-5 time (ms):1200000, thread name:InboundMgr, thread state:starting, thread id;688420216

Stack for thread 1384 is
--# FV EIP----- RetAddr- FramePtr StackPtr Symbol0 .V 77821f46 759e338a 52d3ff88 52d3fe28 ZwWaitForWorkViaWorkerFactory +00018 bytesSig: ZwWaitForWorkViaWorkerFactoryDecl: ZwWaitForWorkViaWorkerFactory

#更改working directory
Set-Location (Get-Item ($MyInvocation.MyCommand.Definition)).DirectoryName#定义要监控的event和属性
#ID为需要监控的eventID,如果使用数组如@(xx,yy)，说明这两个EventID在统计的时候是一起算的，如xx产生了10条，yy产生了10条，加一起20再和threshold比较
#Pattern是C#中的正则表达式，用于过滤出含特定字符的event。
#MinusPattern也是正则表达式，用于过滤出含特定字符的event。
#如果Pattern和MinusPattern都有值的话，pattern匹配到了100条，而MinusPattern匹配到了90条，减一下最终为10条再和threshold比较，这样可以排除掉“自动恢复的情况”
#Threshold就是前几属性的匹配过后，与最终值的数值比较，超过threshold就发告警
$Events = @(@{ID = 3563; Pattern = '\bPausing .*MAPI error'; MinusPattern = 'Unpausing'; Threshold = 100;},@{ID = @(1299, 1300, 1301); Pattern = $null; Threshold = 100;},@{ID = 3386; Pattern = 'GDMAPI_OpenMsgStore failed'; Threshold = 100;},@{ID = @(5662, 5669); Pattern = $null; Threshold = 1;},@{ID = 5675; Pattern = 'errNetConnect'; Threshold = 1;},@{ID = 5733; Pattern = 'errNetTimeout'; Threshold = 1;}
)$Date = Get-Date
$strDate = $Date.ToString("yyyy-MM-dd")$End_time = $Date
$Start_time = $Date.AddMinutes(-15)
$strLogFile = "${strDate}.log.txt"
$strLogFile_e = "${strDate}_Error.log.txt"#定义邮件发送属性
$Mail_From = "$($env:COMPUTERNAME)@fil.com"
$Mail_To = 'xxxxx@xxx.xxx'
$Mail_Subject = 'Good event IDs warning'
$Mail_SMTPServer = 'smtpserver'Set-Content -Path $strLogFile_e -Value $null function Add-Log
{PARAM([String]$Path,[String]$Value,[String]$Type)$Type = $Type.ToUpper()Write-Host "$((Get-Date).ToString('[HH:mm:ss] '))[$Type] $Value"if($Path){Add-Content -Path $Path -Value "$((Get-Date).ToString('[HH:mm:ss] '))[$Type] $Value"}
}Add-Log -Path $strLogFile_e -Value "Catch logs after : $($Start_time.ToString('HH:mm:ss'))" -Type Info
Add-Log -Path $strLogFile_e -Value "Catch logs before: $($End_time.ToString('HH:mm:ss'))" -Type Info
Add-Log -Path $strLogFile_e -Value "Working directory: $($PWD.Path)" -Type Info$EventsCache = @(Get-EventLog -LogName Application -After $Start_time -Before $End_time.AddMinutes(5))
Add-Log -Path $strLogFile_e -Value "Total logs count : $($EventsCache.Count)" -Type Info
$Mail_Body = $null
foreach($e in $Events)
{$Events_e_ALL = $null$Events_e_Matched = $null$Events_e_NMatched = $null$Events_e_FinalCount = 0$Events_e_ALL = @($EventsCache | ?{$e.ID -contains $_.EventID})Add-Log -Path $strLogFile_e -Value "Captured [$($e.ID -join '], [')], count: $($Events_e_ALL.Count)" -Type Info$Events_e_Matched = @($Events_e_ALL | ?{$_.Message -imatch $e.Pattern})Add-Log -Path $strLogFile_e -Value "Pattern matched, count: $($Events_e_Matched.Count)" -Type Infoif($e.MinusPattern){$Events_e_NMatched = @($Events_e_ALL | ?{$_.Message -imatch $e.MinusPattern})Add-Log -Path $strLogFile_e -Value "Minus pattern matched, count: $($Events_e_NMatched.Count)" -Type Info}$Events_e_FinalCount = $Events_e_Matched.Count - [int]$Events_e_NMatched.CountAdd-Log -Path $strLogFile_e -Value "Final matched, count: $Events_e_FinalCount" -Type Infoif($Events_e_FinalCount -ge $e.Threshold){Add-Log -Path $strLogFile_e -Value "Over threshold: $($e.Threshold)" -Type Warning$Mail_Body += "Event ID: [$($e.ID -join '], [')] warning!`n"}
}Add-Log -Path $strLogFile_e -Value "===================split line====================" -Type Info
Get-Content -Path $strLogFile_e | Add-Content -Path $strLogFileIf($Mail_Body)
{try{Send-MailMessage -From $Mail_From -To $Mail_To -Subject $Mail_Subject -Body $Mail_Body -SmtpServer $Mail_SMTPServer -Attachments $strLogFile_e}catch{Add-Log -Path $strLogFile -Value "Failed to send mail, cause: $($Error[0])" -Type Error}
}