Latest Blogs

Blog: ReSearch This! KB - Alert Parameter Replacement Failure

Mon, 02 Nov 2009 20:44:56 GMT

Alert: Alert Parameter Replacement Failure

Alert: DHCP Service Running Alert

Issue: These alerts occurs when the DHCP service is stopped on a DHCP server. This occurs at the same time as the critical DHCP Service Running Alert occurs. The DHCP Service Running Alert closes itself automatically, but the Alert Parameter Replacement Failure does not.

Resolution: Restarted the DHCP server service on the system which identified the error. Manually closed the Alert Parameter Replacement Failure alert. This alert appears to be able to be disabled as the DHCP Service Running Alert provides more relevant information than the warning.

Submitted By: Alexandre Verkinderen (MVP) and Cameron Fuller (MVP)

Blog: ReSearch This! KB - NTFS - Delayed Write Lost

Thu, 22 Oct 2009 00:45:08 GMT

Alert: NTFS - Delayed Write Lost

Issue: This was occurring frequently on one server (50 times in less than 2 hours). Multiple errors are occurring in the system log from event source Disk, eventid 11 on \device\harddisk1. Used disk manager to identify which of the drives on the system is experiencing these issues. The hard drive was unallocated and not initialized. Determined that this was an HP system and the drive shown in the disk manager was a RAID configuration. Used the HP Array Configuration Utility to delete and re-create the failed drive.

Resolution: Resolved the drive array failure issue and brought the drive which was experiencing issues back online. Used disk manager to initialize the drive and configure it for the system.

Submitted By: Cameron Fuller (MVP)

Blog: ResearchThis! KB - Performance data from the Health Service could not be collected since opening the shared data failed with error 5L

Tue, 20 Oct 2009 20:37:19 GMT

ISSUE: The following error appears in the Operations Manager Event Log

Event Type: Error
Event Source: HealthService
Event Category: Health Service
Event ID: 6002
Date: 9/16/2009
Time: 2:41:31 PM
User: N/A
Computer: xxxxxx
Description:
Performance data from the Health Service could not be collected since opening the shared data failed with error "5L".

CAUSE: The issue was a problem with the .NET 1.1 Framework.

RESOLUTION:

Administrator installed a higher version of the .NET Framework. In this case, .NET 3.5 was installed and issue abated. Lower versions of .NET may work, but were not tested in this case.

Blog: ResearchThis! KB – Event ID 1207 in the Operations Manager Event Log

Fri, 09 Oct 2009 00:42:09 GMT

Here's a question that's come up a couple times in the last few weeks

Issue:

Many occurrences of Event Id 1207 appear in the Operations Manager Event Log. Multiple occurrences of this event for multiple discoveries may appear. It appears in agentless monitoring scenarios, such as with a clustered application with one or more virtual servers.

For example:
Rule/Monitor "XXXXXXDiscovery" running for remote instance "xxxxx" with id:"{06905785-3666-99A3-5681-5993343C288E}" will be disabled as it is not remotable. Management group "MG1".

Resolution:

This event is a warning that a rule that is marked as not supporting agentless management has been targeted to an agentless managed computer. The warning is just a notification that the rule isn't being run.

It's just an FYI and can be safely ignored.

Blog: ReSearch This! KB – Health Service Unloaded System Rule(s)

Wed, 07 Oct 2009 19:49:40 GMT

Alert: Health Service Unloaded System Rule(s)

Issue: Logged into the server and found the following as the start of a lot of critical events in the Operations Manager log since the approximate time that this alert was reported. Errors included a flurry of event number 4506 (HealthService).

Resolution: Restarted the System Center Management service on the server and monitored the Operations Manager event logs for recurrence. The alert closed itself after the System Center Management service was restarted on the server reporting the error.

Submitted By: Cameron Fuller (MVP)

Blog: ResearchThis! KB – Notification channel names appear as GUIDs and attempts to delete channels fails

Tue, 06 Oct 2009 23:28:11 GMT

This one has come up multiple times in the newsgroups since the release of OpsMgr 2007 R2.

Issue: The names of the notification channels in the Administration space appear as GUIDs. Attempts to delete these channels result in an error message including something along the lines of "notification endpoint is currently not deleted....etc"

Also, after you upgrade to System Center Operations Manager 2007 R2 from System Center Operations Manager 2007 Service Pack 1 (SP1), the console shows customized subscriptions. These subscriptions resemble the following under the Administration\Notifications\Subscriptions\Subscription Name node:

SMTP{GUID}

Resolution: This is a known issue in OpsMgr 2007 R2 and can be resolved by running the script contained in Knowledge Base Article 971233 - http://support.microsoft.com/kb/971233. Make sure to read the KB article completely and to set the appropriate language code at the end of the TSQL script. The KB article provides a list of language codes.

DECLARE @NotificationManagementPackId uniqueidentifier
SELECT @NotificationManagementPackId = ManagementPackId FROM ManagementPack
WHERE MPName = 'Microsoft.SystemCenter.Notifications.Internal'

SELECT ModuleTypeId, MDTName 
INTO #ActionsToRename
FROM ModuleType 
WHERE ManagementPackId = @NotificationManagementPackId
AND MDTImplementationXML LIKE '%ContentGenerator%Transport%' AND MDTName <> 'DefaultSmtpAction'

SELECT R.RuleId, M.ModuleTypeId, DSV.DisplayName 
INTO #RulesToUseToRename
FROM Rules R
JOIN Module M ON R.RuleId = M.ParentId
JOIN #ActionsToRename A ON A.ModuleTypeId = M.ModuleTypeId
JOIN DisplayStringView DSV ON DSV.MPElementId = R.RuleId 
WHERE R.ManagementPackId = @NotificationManagementPackId AND DSV.LanguageCode = 'ENU'
 

UPDATE LocalizedText 
SET LTValue = R.DisplayName
FROM #RulesToUseToRename R
WHERE R.ModuleTypeId = MPElementId AND LTStringType = 1 AND LanguageCode = 'ENU'

DROP TABLE #RulesToUseToRename
DROP TABLE #ActionsToRename

Blog: ReSearch This! KB - LSASS process high processor load detected.

Mon, 05 Oct 2009 22:28:03 GMT

Alert: LSASS process high processor load detected.

Issue: This alert monitor activates when the LSASS threshold percent goes above 80%. For our environment we have a domain controller which processes large numbers of checks and changes to active directory based upon a user provisioning process. This occurs regularly on one Windows 2003 domain controller which cannot be upgraded.

Resolution: Configured this to have a higher threshold (97%) for this server and stored it in the ActiveDirectory2003_Overrides management pack. Closed the alert to see if it would recur.

Submitted By: Cameron Fuller (MVP)

Blog: ReSearch This! KB - Database Offline

Mon, 05 Oct 2009 22:08:30 GMT

Alert: Database Offline

Issue: This issue was occurring about every two days on the WSUS database on one of our database servers. This is monitored via the Database Status monitor which checks this status on an hourly basis (every 3600 seconds). The mscuptdb (WSUS) database was reporting itself to be offline/recovery/pending/suspect/emergency. When we accessed the server the database was already online. Determined that Auto Close was set to True for the database.

Resolution: Changed this setting from True to False on the WSUS database in SQL Server Management Studio, properties of the mscuptdb database on the Options tab. Allowed this alert to auto-close after the one hour timeframe and monitored for the next week to verify that it did not recur.

Submitted By: Cameron Fuller (MVP)

Blog: ReSearch This! KB - Miscellaneous KDC Errors

Mon, 05 Oct 2009 21:44:43 GMT

Alert: Miscellaneous KDC Errors

Issue: Windows 2008 systems communicating with Windows 2003 domain controllers reporting this error. Good information on this is available at: http://technet.microsoft.com/en-us/library/cc733974(WS.10).aspx and http://www.eggheadcafe.com/software/aspnet/34270591/miscellaneous-kdc-errors.aspx. Online research on this found a resolution by Anders Bengtsson available at http://www.eggheadcafe.com/conversation.aspx?messageid=34270595&threadid=34270591.

Summary: Disable this rule and create a new one to filter it out based upon content in the description field.

In our environment, the majority of systems reporting these errors are the Windows 2008 servers in the environment. There is no way to override this alert to filter it based upon the description unfortunately.

Resolution: Disabled this rule for each of the Windows 2003 domain controllers reporting the error. Closed the alerts.

Submitted By: Cameron Fuller (MVP)

Blog: ReSearch This! KB - IIS Stop Command

Thu, 01 Oct 2009 19:59:22 GMT

Alert: IIS Stop Command

Issue: IIS was stopped on the server while a portal protection program was installed on the system. This action was performed by a system administrator. This is an alert rule so it will not close automatically.

Resolution: Created a web monitor for the SharePoint website. Changed the severity of this item from 2 to 1 (critical to warning) as this is by itself not a critical situation. If the website was down as a result that would be a critical situation but these are checked separately with web monitors.

Submitted By: Cameron Fuller (MVP)

Blog: ReSearch This! KB - Exchange 2007 ExBPA Generate Alert Rule

Thu, 01 Oct 2009 19:56:58 GMT

Alert: Exchange 2007 ExBPA Generate Alert Rule

Issue: There are multiple different alerts which are generated based upon the ExBPA. In this case the issue was that the Exchange fatal information on the server is not set to automatically send to Microsoft for analysis.

Resolution: In our environment we do not allow these servers to have Internet connectivity so we needed to disable this rule. We did this through the Console / Authoring / Management Pack Objects / Rules, look for “Exchange 2007 Best Practice” and sorting by the rule name of “Crash upload logging is disabled”. Overwrote this rule to disable it for all Exchange 2007 servers in the environment and then closed the alert.

Submitted By: Cameron Fuller (MVP)

Blog: ReSearch This KB - Failed to Process Windows Event Log

Wed, 30 Sep 2009 18:59:37 GMT

Alert: Failed to Process Windows Event Log

Issue: The server specified had a corrupted System event log (detailed in the Alert description).

Resolution: Logged into the system, opened the event viewer, and the system log. Verified that the event log was corrupt. Right-clicked and cleared all events. Verified that the system log would open without the corruption message. If this is occurring frequently this may indicate a deeper problem such as hard drive corruption. Manually closed the alert but it should have closed itself out once the healthy condition was detected.

Submitted By: Cameron Fuller (MVP)

Blog: ReSearch This! KB - Exchange 2007 ExBPA Generate Alert Rule

Mon, 28 Sep 2009 22:14:27 GMT

Alert: Exchange 2007 ExBPA Generate Alert Rule

Issue: Application log size should be increased to 40 mb.

Resolution: Logged into each system, opened the event viewer and changed the properties of the application log to 40960 and closed the alerts because they were generated by a rule not a monitor. The default domain policy was set to 12160. To change this we implemented a new group policy linked to the Exchange servers OU to set the application log file size to 40960. See http://technet.microsoft.com/en-us/library/cc778402(WS.10).aspx for details on how to configure this policy.

Submitted By: Cameron Fuller (MVP)

Blog: ReSearch This! KB – Backward Compatibility Script Error

Mon, 28 Sep 2009 18:42:37 GMT

Alert: Backward Compatibility Script Error

Additional Alert: Service Check Data Source Module Failed Execution

Issue: On the passive node of a SQL cluster, when services were moved from the B node to the A node, the B node started reporting large numbers of alerts of the two types listed above with a high repeat count. (Backward Compatibility Script Error on line 105, Description: Permission Denied: GetObject, Service Check Data Source Module Failed Execution, Error getting state of service, Details: Access is denied.)

Resolution: Logged into the passive node of the cluster (B node in this case) and restarted the System Center Management service. My theory is that the service was attempting to access and monitor resources which were no longer available on the passive node which resulted in the creation of the alerts. Resolving these will require a manual process when a cluster is moved from one node to another or disabling the alerts on the members of the cluster.

Submitted By: Cameron Fuller (MVP)

Blog: ReSearch This! KB - Exchange 2007 ExBPA Generate Alert Rule

Fri, 18 Sep 2009 00:27:25 GMT

Alert: Exchange 2007 ExBPA Generate Alert Rule

Issue: Application log size should be increased to 40 mb.

Resolution: Logged into each system, opened the event viewer and changed the properties of the application log to 40960 and closed the alerts because they were generated by a rule not a monitor.

Submitted By: Cameron Fuller (MVP)

Blog: ReSearch This! KB - DHCP IPv4 Runtime Authorization Needed Alert

Wed, 16 Sep 2009 20:50:41 GMT

Alert: DHCP IPv4 Runtime Authorization Needed Alert

Issue: DHCP scopes (both IPv4 and IPv6) were showing up as turned off offline/not authorized. This server had been authorized and then the IP address of the server was changed. The authorization was listing the previous IP address.

Resolution: Unauthorized the current server name/wrong IP address and re-authorized it with the correct IP address. This was occurring on a domain controller in a child domain. To do this change we ended up having to log into the root domain and authorize/re-authorize the server and then restart services on the domain controller after a short period of time.

Submitted By: Cameron Fuller (MVP)

Blog: ReSearch This! KB - WMI Event Module failed Execution

Wed, 16 Sep 2009 17:36:20 GMT

Alert: WMI Event Module failed Execution

Issue: Many workflows failing on the system, alert recurring extremely frequently – approximately every 5 minutes. Attempted a variety of methods to resolve the issue with no success. Determined that there was an event in the Operations Manager log of event number 10357 which was recurring every 5 minutes (event follows):

Module was unable to execute the notification query.

Error: 0x80041013

Details: Provider load failure

One or more workflows were affected by this.

Workflow name: many

Instance name: many

Instance ID: many

Management group: MG1

Also tracked down an error occurring in the application log which appears to be related (WinMgmt Event ID 40). The event follows:

WMI ADAP was unable to create the object Win32_PerfRawData_W3SVC_WebService for Performance Library W3SVC because error 0x80041001 was returned.

Resolution: The next step to resolve this solution was to rebuild the base performance counters as discussed in http://support.microsoft.com/kb/300956. The two systems reporting these errors were on the list for decommission so we chose to disable these errors for these two servers until they were decommissioned.

Submitted By: Cameron Fuller (MVP)

Blog: ResearchThis! KB - The service terminated unexpectedly.

Tue, 15 Sep 2009 19:33:50 GMT

Alert: The service terminated unexpectedly.

Issue: The service identified in the alert failed.

Resolution: Verified that the server can be pinged via the tasks on the right, and using the Computer Management task verified that the service was in a started state. Closed the alert after placing information in the company knowledge to track this for a pattern to see what is causing the service to fail. In one case the service was actually down, used the Computer Management task to restart the service.

Submitted: Cameron Fuller (MVP)

Blog: ResearchThis! KB - Event log is full

Tue, 15 Sep 2009 19:33:04 GMT

Alert: Event log is full

Issue: Alert generated by the windows server 2003 management pack from the Event Log File is Full alert rule. The alert description contains information about which event log is full (in this case it was the PowerShell log file).

Resolution: Logged into the server and verified that the log size was set to a maximum of 512 kb and to override events older than 7 days. Re-configured to increase the size to 2048 and to overwrite events as needed. Closed the alert.

Submitted: Cameron Fuller (MVP)

Blog: ResearchThis! KB - Failed to retrieve site state

Mon, 14 Sep 2009 01:32:11 GMT

Alert: Failed to retrieve site state

Issue: The web site discovered (SITE_4 in this case) was non-functional.

Resolution: Removed the website and closed the alert because this was a rule not a monitor.

Submitted: Cameron Fuller (MVP)