The last query server was removed from rotation

Microsoft.Office.Sharepoint.Server.2007.The_last_query_server_was_removed_from_rotation (Rule)

This indicates that a query server has been removed from the load-balanced rotation. This means that users cannot perform search queries until this issue is resolved.

Knowledge Base article:

Summary

For load balancing purposes and to enable a higher volume of search queries, Microsoft Office SharePoint Server 2007 enables administrators to deploy multiple query servers in a server farm. If Internet Information Services (IIS) encounters errors while communicating with a particular query server, that query server is temporarily removed from the load-balanced rotation.

This alert indicates that a query server has been removed from the load-balanced rotation. Therefore users cannot perform search queries until this issue is resolved.

Causes

Possible causes include:

Network connectivity issues.
Corrupt index on a query server.

Resolutions

Check the Windows NT Event log for the cause of the problem.

If the problem is caused by network connectivity issues, then troubleshoot and resolve accordingly.
If the problem is due to a corrupt content index on the query server, use the following procedure to remove the query server from the server farm and then re-add the query server to the farm. This forces the index server to propagate the full content index from the index server to the query server.

Important: If you have only one query server, then the search service is down until propagation completes.

Force index propagation

In Central Administration, on the Operations tab, in the Topology and Services section, click Services on server.
On the Services on Server page, from the Server drop-down list, select the query server that you want to remove and re-add to the server farm.
In the Action column for the Office SharePoint Server Search service, click Stop and then click OK to confirm.
After the Status changes from Started to Stopped, in the Action column click Start.

Element properties:

Target

Microsoft.Office.Sharepoint.Server.2007.MOSS.Application

Category

EventCollection

Enabled

True

Event_ID

10040

Event Source

Office Server Search

Alert Generate

True

Alert Severity

Error

Alert Priority

Normal

Remotable

True

Alert Message

The last query server was removed from rotation

Event ID {0} from Source {2} on agent computer {3} has triggered this Alert Description : {1}

Event Log

Application

Member Modules:

ID	Module Type	TypeId	RunAs
DS	DataSource	Microsoft.Windows.EventProvider	Default
CollectData	WriteAction	Microsoft.SystemCenter.CollectEvent	Default
DataWarehousePublishData	WriteAction	Microsoft.SystemCenter.DataWarehouse.PublishEventData	Default
MOSS.GenerateAlert	WriteAction	System.Health.GenerateAlert	Default

Source Code:

<Rule ID="Microsoft.Office.Sharepoint.Server.2007.The_last_query_server_was_removed_from_rotation" Enabled="onEssentialMonitoring" Target="Microsoft.Office.Sharepoint.Server.2007.MOSS.Application" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>EventCollection</Category>

  <DataSources>

    <DataSource ID="DS" TypeID="MSWL!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Host/Property[Type="MSWL!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>Application</LogName>

      <Expression>

        <And>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="Integer">EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>10040</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="String">PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>Office Server Search</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="CollectData" TypeID="SystemCenter!Microsoft.SystemCenter.CollectEvent"/>

    <WriteAction ID="DataWarehousePublishData" TypeID="SCDW!Microsoft.SystemCenter.DataWarehouse.PublishEventData"/>

    <WriteAction ID="MOSS.GenerateAlert" TypeID="Health!System.Health.GenerateAlert">

      <Priority>1</Priority>

      <Severity>2</Severity>

      <AlertMessageId>$MPElement[Name="Microsoft.Office.Sharepoint.Server.2007.The_last_query_server_was_removed_from_rotation.AlertMessageID"]$</AlertMessageId>

      <AlertParameters>

        <AlertParameter1>$Data/EventDisplayNumber$</AlertParameter1>

        <AlertParameter2>$Data/EventDescription$</AlertParameter2>

        <AlertParameter3>$Data/PublisherName$</AlertParameter3>

        <AlertParameter4>$Target/Host/Property[Type="MSWL!Microsoft.Windows.Computer"]/NetworkName$</AlertParameter4>

      </AlertParameters>

      <Suppression>

        <SuppressionValue>$Data/EventDisplayNumber$</SuppressionValue>

        <SuppressionValue>$Data/PublisherName$</SuppressionValue>

        <SuppressionValue>$Data/LoggingComputer$</SuppressionValue>

        <SuppressionValue>$Data/EventDescription$</SuppressionValue>

      </Suppression>

    </WriteAction>

  </WriteActions>

</Rule>