This rule measures the Process\Private Bytes utilization for all instances of the MonitoringHost.exe process. If it exceeds the configured threshold, a response attempts to restart the Health Service to ensure it doesn’t continue to overwhelm the computer.

There are different thresholds depending on the role that Health Service configured to perform. The following summarizes the default thresholds:

Below is the configuration for the response that attempts to restart the Health Service:

A brief summary of potential causes are:

This can be caused by the Health Service running many management packs. Each Management Pack may have a lot of monitoring that uses a small amount of resources. With many management packs that add up to many thousands of rules and monitors, each MonitoringHost.exe instance may start consuming more resources.

This may be expected for this Health Service depending on the type of monitoring the Health Service is performing.

Another cause could be one or more rules and monitors that are not conforming to some best practices. An example is a performance counter rule that attempts to collect performance data every 1 second. Too many rules or monitors configured this way will cause the MonitoringHoste.exe process to consume more resources.

The default action for this rule running on agents is to restart the Health Service. Because this recovery is enabled by default on agents, no user action is required.

Note that the Health Service may not restart correctly if the action account that this agent has been configured with does not have the right permissions to restart the service.

If this is the case, start the HealthService windows service.

If you feel that the resource utilization is appropriate for the amount of monitoring being performed by this agent, you can override the threshold or disable the rule.