Latest Blogs

Blog: ReSearch This! KB - DHCP Scope Addresses Available Monitor

Mon, 16 Nov 2009 20:00:14 GMT

Alert: DHCP Scope Addresses Available Monitor

Issue: In an environment with two DHCP servers with the scope split we had one of the DHCP scopes that were completely empty while the other scope had only three addresses in use. We determined that the IP helper information was incorrect for the second DHCP server.

Resolution: In the network environment, re-configured the iphelper configuration to point to both DHCP servers with the correct IP addresses.

Blog: ReSearch This! KB - Application of Group Policy Alert

Fri, 13 Nov 2009 15:07:42 GMT

Alert: Application of Group Policy Alert

Issue: Windows failed to apply the Folder Redirection settings. The alert context tab shows the computer logging the issue and the user account which it is occurring for. In this case it was an event number 1085 from the source of Microsoft-Windows-GroupPolicy. The alert context indicates that it failed to complete the function of folder redirection. This appears to only occur on Windows Server 2008 systems when users that have Folder Redirection settings in place log into the system. The same users do not have this issue when logging into Windows Server 2003 systems. This error is not causing the users issues when they are logged into the Windows 2008 server systems.

Resolution: Created an override to disable this alert for Windows Server 2008 Computer Group.

Submitted By: Cameron Fuller (MVP)

Blog: ReSearch This! KB - ConfigMgr 2007 Status: Distribution Manager failed to process a package

Fri, 13 Nov 2009 14:55:57 GMT

Alert: ConfigMgr 2007 Status: Distribution Manager failed to process a package

Issue:

CMSERVER

- ConfigMgr 2007 Status: Distribution Manager failed to copy a package from its source directory to its destination directory on a Distribution Point.

A new monitored SMS status message on machine CMSERVER from component SMS_DISTRIBUTION_MANAGER with message ID 2328 was found in the site ABC database.

The status message contains message properties

Machine Name:

CMSERVER

Module Name:

SMS Server

Component:

SMS_DISTRIBUTION_MANAGER

Message ID:

2328

Win32 Error:

Top Level Site Code:

ABC

Database Record ID:

1988626

This alert is critical (and probably should not be critical – it should be a warning), but it has no abilities to override this alert including no ability to change either priority or severity.

Resolution:

On the ABC site server there is a ServerUpdates folder which has been shared out for Software Update source files. The share permissions only an owner listed. The site server has been trying to access the share to copy the files to the DP. Added the Everyone Group with Read perms so the package can be successfully distributed to the DP. The package was processed successfully after changing the share permissions.

Submitted By: Cameron Fuller (MVP) & Hamid Yusuff

Blog: ReSearch This! KB - ConfigMgr 2007 Status: SMS State System error processing message file

Fri, 13 Nov 2009 14:51:30 GMT

Alert: ConfigMgr 2007 Status: SMS State System error processing message file

Issue: This alert is listed as critical and it specifies information about something occurring in configuration manager. Example details below:

CMSERVER - ConfigMgr 2007 Status: SMS State System error processing message file.

A new monitored SMS status message on machine CMSERVER from component SMS_STATE_SYSTEM with message ID 6101 was found in the site ABC database.

The status message contains message properties

Machine Name:

CMSERVER

Module Name:

SMS Server

Component:

SMS_STATE_SYSTEM

Message ID:

6101

Win32 Error:

Top Level Site Code:

Database Record ID:

998004

Resolution: This alert is critical, but it has no product knowledge and there are no abilities to override this alert including no ability to change either priority or severity. After speaking with my ConfigMgr SME we came to the same opinion and we have created an override to disable this alert.

Submitted By: Cameron Fuller (MVP) & Hamid Yusuff

Blog: ReSearch This! KB - SQL Server Assertion

Wed, 11 Nov 2009 19:35:37 GMT

Alert: SQL Server Assertion

Issue: On a SQL Server 2008 system we received this message: SQL Server Assertion: File: <"xact.cpp">, line = 1380 Failed Assertion = '!m_parNestedXactCnt' Trying to use the transaction while there are 1 parallel nested xacts outstanding. This error may be timing-related. If the error persists after rerunning the statement, use DBCC CHECKDB to check the database for structural integrity, or restart the server to ensure in-memory data structures are not corrupted.

Per our SQL SME: In our case this was a timing issue. Our SQL SME ran a CheckTable was run in the evening to check all the tables involved in the query and verified they are ok/there is no integrity problem. Additionally, we have reissued the query and the results came back OK.

Discussion which appears to be related to this topic is available at: http://www.sqlservercentral.com/Forums/Topic687082-146-1.aspx

Resolution: Initially notified the appropriate SQL personnel of the issue, they performed tests to verify the tables. Closed the alert and monitoring for recurrence.

Submitted By: Cameron Fuller (MVP) and a great SQL SME

Blog: ReSearch This! KB - DNS 2008 Correct Server IP Addresses and Interfaces Alert

Tue, 10 Nov 2009 21:14:40 GMT

Alert: DNS 2008 Correct Server IP Addresses and Interfaces Alert

Issue: This server had multiple network adapters which were teamed. The critical condition is identified by the DNS Server event log event number 408. The health condition is identified by the DNS Server event log number 7600.

Resolution: Set the properties of the DNS server to only the IP address of the teamed adapter and restarted DNS on the server. The health condition event was not found but the event 408 stopped recurring, so we closed the alert to see if it would recur on this server.

Submitted By: Cameron Fuller (MVP)

Blog: ReSearch This! KB - Exchange 2007 Test Local Mail Flow Alert

Tue, 10 Nov 2009 21:12:36 GMT

Alert: Exchange 2007 Test Local Mail Flow Alert

Issue: An Exchange 2007 mailbox server in the environment was failing when attempting to perform a local mail flow test. Logged into the server and reviewed the event logs but we found no relevant information. Opened the Exchange Management Shell and ran the “test-mailflow” command. Received a message that “No mailbox databases were found on SERVERNAME to perform the operation. Check if the user has permission to read the Exchange configuration from Active Directory.” This server does not have any user mailboxes on it (it is scheduled for decommissioning).

Resolution: Created an override to disable this alert and reset the health for this through the Exchange 2007 distributed application.

Submitted By: Cameron Fuller (MVP)

Blog: ReSearch This! LB - Failed Authentication Attempts Check

Tue, 10 Nov 2009 21:10:08 GMT

Alert: Failed Authentication Attempts Check

Issue: All servers monitored by a particular gateway started erroring with event number 20002. The servers which were monitored were reporting 20070 errors. Restarting the services on the gateway did not address the issue, and they did not fail over properly to the additional gateway server. This may have been related to a Kerberos authentication failure as this was a fully functional gateway which started reporting this: http://social.technet.microsoft.com/Forums/en-US/systemcenter/thread/2df2ab2c-c677-42dd-bf74-884c7130a2de/ and http://relatedterms.com/ViewThread.aspx?t=671914.

Resolution: Rebooted the gateway server and it came back online and started functioning correctly.

Submitted By: Cameron Fuller (MVP)

Blog: ReSearch This! KB - Replication has been aborted

Tue, 10 Nov 2009 01:17:02 GMT

Alert: Replication has been aborted

Issue: A schema change was made but it was unable to replicate out successfully throughout the environment.

Resolution: Determined that one domain controller was running at 100% processor usage. Stopped the application causing the issue, and re-ran the schema change. Used this article: http://support.microsoft.com/kb/556086/en-us?spid=3198 for details on how to determine the current schema version throughout the environment.

Submitted By: Cameron Fuller (MVP)

Blog: ReSearch This! KB - Two replication partners have an inconsistent view of the FSMO role holders

Tue, 10 Nov 2009 01:15:32 GMT

Alert: Two replication partners have an inconsistent view of the FSMO role holders

Issue: The Schema master was moved from one server to another server in the environment. These alerts occurred as the change was replicated throughout the environment.

Resolution: Closed the alerts as this move was planned and the alerts stopped occurring after a couple of hours.

Submitted By: Cameron Fuller (MVP)

Blog: ReSearch This! KB - RPC latency is above the threshold

Tue, 10 Nov 2009 01:12:16 GMT

Alert: RPC latency is above the threshold

Issue: One Exchange server in the environment was reporting this frequently and automatically closing itself as part of the IS RPC Latency Monitor alert monitor. Per the product knowledge these commonly occur due to issues communicating with the Active Directory service or due to disk bottlenecks. This specific server is experiencing high disk queue lengths on the C drive and both storage group drives.

Resolution: For this server we could not upgrade it and it is scheduled for replacement with new mailbox servers. As a result we configured an override for this object of class: Exchange IS Service and set the new threshold to 100 from the default value of 50 to minimize the number of alerts on this issue on this server. This override value will vary depending upon what the actual daily average is for this particular server which can be determined by right-clicking on the alert, opening the performance view and seeing the RPC Averaged Latency counter over a period of time.

Submitted By: Cameron Fuller (MVP)

Blog: Operations Manager 2007 SP1 Update Rollup Now Available!

Mon, 09 Nov 2009 12:42:39 GMT

The release of the SP1 Update Rollup (ENU) – KB971541 to the download center. This update provides a cumulative rollup of hotfixes for Microsoft System Center Operations Manager 2007 Service Pack 1 together with the following improvements:

Improvements and Fixes

Support for Windows 7
Support for Windows Server 2008 R2
Support for SQL Server 2008 and SQL Reporting Services 2008 Upgrade
Additional fixes and improvements

Note This update applies to System Center Operations Manager 2007 SP1 only.

The following fixes are included in this update:

Knowledge Base article	Article title
949875	When you run a task in the System Center Operations Manager 2007 Operations Console on a Russian version of Windows Server 2003, the task outputs are displayed in corrupted text
950853	A memory leak occurs when you monitor Exchange Server 2007 by using the MOM 2007 agent in System Center Operations Manager 2007
951380	Some computer properties for a cluster node may not be collected by the discovery process in System Center Operations Manager 2007 Service Pack 1
951526	The Root Management Server (RMS) of System Center Operations Manager 2007 Service Pack 1 or Essentials 2007 Service Pack 1 becomes unstable or unusable if a management pack is imported
951527	Modifications that you try to make to a Web application that was created before you upgrade Microsoft System Center Operations Manager 2007 are not saved
951529	System Center Operations Manager 2007 runs scripts in the Rule Name field or in the Description field
951979	Problems occur on a management server that is running System Center Operations Manager 2007 Service Pack 1 when certain management packs are installed
952857	The Custom Event Report does not list the GenericLog-type events in System Center Operations Manager 2007 Service Pack 1
952937	The relative date picker returns wrong dates when you run a report in a month that has less days than the previous month in System Center Operations Manager 2007
953817	The Administrator Console exits when you try to use the "Set Resolution State" option for an alert that is generated in System Center Operations Manager 2007
954049	Description of the hotfix rollup package for System Center Operations Manager 2007 Service Pack 1 and for System Center Essentials 2007 Service Pack 1: July 25, 2008
954090	Objects that are displayed in a performance view are not scoped to the specified group when they are viewed in the Web Console of Operations Manager 2007 Service Pack 1
954329	An Audit Collection Service forwarder may be unable to retrieve the distinguished name for the ObjectGUID in the collected events in System Center Operations Manager 2007 Service Pack 1
954823	A custom event report does not display events that are generated by the generic CSV text log collection rules when Parameter 1 to Parameter 20 is included in the Report Field criteria in System Center Operations Manager 2007 Service Pack 1 (SP1)
954903	The Monitoringhost.exe process may consume all the CPU resources when a large amount of performance data is created by using a managed data source module in System Center Operations Manager 2007
955523	Web console hotfix package for System Center Operations Manager 2007
956172	The CcmExec.exe process crashes on a Windows 2000-based computer if both a System Center Operations Manager 2007 Service Pack 1 agent and a System Center Configuration Manager 2007 client are installed on this computer
956240	The SQL Server process may consume lots of CPU resources on the server that hosts the Operations Manager 2007 database after you make Operations Manager 2007 configuration changes
956423	The connection settings for connectors in tiered management groups are configured incorrectly after the OpsMgr SDK Service restarts in a System Center Operations Manager 2007 SP1 environment
956446	The e-mail notifications may contain garbled subject lines if you enable the "Generate subject line with no encoding" option in System Center Operations Manager 2007 Service Pack 1
956689	A Run As account that is configured for proxy authentication in a Web application monitor is not used in System Center Operations Manager 2007 Service Pack 1
957123	Hotfix for System Center Operations Manager 2007 SP1 enables monitoring support for IIS 7.0
957135	You cannot change the alert resolution state of any alert in the Active Alerts view in System Center Operations Manager 2007 Service Pack 1
957199	The System Center Operations Manager 2007 Service Pack 1 operations console cannot display English product knowledge when you open the properties dialog box of an alert: "No product knowledge was available for this Alert"
957511	Warning alerts and warning monitor state changes do not occur as expected for a Web application that is created by using the Web application template in System Center Operations Manager 2007 Service Pack 1
958253	When you try to view the Patch List property, the list of Operations Manager agent hotfixes may be truncated on System Center Operations Manager 2007 Service Pack 1 systems
958254	You receive multiple "WMI Probe Module Failed Execution" alerts from Windows 2000-based computers after you install System Center Operations Manager 2007 SP1
958490	Dependency monitors indicate an incorrect state on a System Center Operations Manager 2007 SP1-based computer
959497	The System Center Operations Manager 2007 Service Pack 1 SDK service may stop unexpectedly, and you may receive an error message: "Specified argument is out of the range of valid values"
959865	Issues that are resolved by the Operations Manager Module rollup update for System Center Operations Manager 2007 Service Pack 1: June 10, 2009
959867	You cannot specify a management pack to store a new override of a monitor or of a rule in the Operations console in System Center Operations Manager 2007 Service Pack 1
960363	Charts in a performance report are incorrectly scaled, or a report that contains multiple charts does not display the charts in the correct order in System Center Operations Manager 2007 SP1
961363	Operations Manager 2007 Service Pack 1 may stop monitoring SNMP devices
963005	The Add Object Wizard displays only 500 objects even if more objects exist in System Center Operations Manager 2007 Service Pack 1
967843	The _PrimarySG_ security group is repopulated every hour even though the group's membership has not changed in System Center Operations Manager 2007 SP1
968082	Error message when you add an agent assignment rule in the System Center Operations Manager 2007 if an Active Directory domain name begins with a numeric digit: "XSD verification failed for management pack"
969130	The size of the System Center Operations Manager 2007 Service Pack 1 Data Warehouse database may grow if many event collection rules exist within management packs
970533	The Product Knowledge tab is displayed as the Company Knowledge tab after you import a Language Pack for System Center Operations Manager 2007 Service Pack 1

Blog: ReSearch This! KB - Alert Parameter Replacement Failure

Mon, 02 Nov 2009 20:44:56 GMT

Alert: Alert Parameter Replacement Failure

Alert: DHCP Service Running Alert

Issue: These alerts occurs when the DHCP service is stopped on a DHCP server. This occurs at the same time as the critical DHCP Service Running Alert occurs. The DHCP Service Running Alert closes itself automatically, but the Alert Parameter Replacement Failure does not.

Resolution: Restarted the DHCP server service on the system which identified the error. Manually closed the Alert Parameter Replacement Failure alert. This alert appears to be able to be disabled as the DHCP Service Running Alert provides more relevant information than the warning.

Submitted By: Alexandre Verkinderen (MVP) and Cameron Fuller (MVP)

Blog: ReSearch This! KB - NTFS - Delayed Write Lost

Thu, 22 Oct 2009 00:45:08 GMT

Alert: NTFS - Delayed Write Lost

Issue: This was occurring frequently on one server (50 times in less than 2 hours). Multiple errors are occurring in the system log from event source Disk, eventid 11 on \device\harddisk1. Used disk manager to identify which of the drives on the system is experiencing these issues. The hard drive was unallocated and not initialized. Determined that this was an HP system and the drive shown in the disk manager was a RAID configuration. Used the HP Array Configuration Utility to delete and re-create the failed drive.

Resolution: Resolved the drive array failure issue and brought the drive which was experiencing issues back online. Used disk manager to initialize the drive and configure it for the system.

Submitted By: Cameron Fuller (MVP)

Blog: ResearchThis! KB - Performance data from the Health Service could not be collected since opening the shared data failed with error 5L

Tue, 20 Oct 2009 20:37:19 GMT

ISSUE: The following error appears in the Operations Manager Event Log

Event Type: Error
Event Source: HealthService
Event Category: Health Service
Event ID: 6002
Date: 9/16/2009
Time: 2:41:31 PM
User: N/A
Computer: xxxxxx
Description:
Performance data from the Health Service could not be collected since opening the shared data failed with error "5L".

CAUSE: The issue was a problem with the .NET 1.1 Framework.

RESOLUTION:

Administrator installed a higher version of the .NET Framework. In this case, .NET 3.5 was installed and issue abated. Lower versions of .NET may work, but were not tested in this case.

Blog: ResearchThis! KB – Event ID 1207 in the Operations Manager Event Log

Fri, 09 Oct 2009 00:42:09 GMT

Here's a question that's come up a couple times in the last few weeks

Issue:

Many occurrences of Event Id 1207 appear in the Operations Manager Event Log. Multiple occurrences of this event for multiple discoveries may appear. It appears in agentless monitoring scenarios, such as with a clustered application with one or more virtual servers.

For example:
Rule/Monitor "XXXXXXDiscovery" running for remote instance "xxxxx" with id:"{06905785-3666-99A3-5681-5993343C288E}" will be disabled as it is not remotable. Management group "MG1".

Resolution:

This event is a warning that a rule that is marked as not supporting agentless management has been targeted to an agentless managed computer. The warning is just a notification that the rule isn't being run.

It's just an FYI and can be safely ignored.

Blog: ReSearch This! KB – Health Service Unloaded System Rule(s)

Wed, 07 Oct 2009 19:49:40 GMT

Alert: Health Service Unloaded System Rule(s)

Issue: Logged into the server and found the following as the start of a lot of critical events in the Operations Manager log since the approximate time that this alert was reported. Errors included a flurry of event number 4506 (HealthService).

Resolution: Restarted the System Center Management service on the server and monitored the Operations Manager event logs for recurrence. The alert closed itself after the System Center Management service was restarted on the server reporting the error.

Submitted By: Cameron Fuller (MVP)

Blog: ResearchThis! KB – Notification channel names appear as GUIDs and attempts to delete channels fails

Tue, 06 Oct 2009 23:28:11 GMT

This one has come up multiple times in the newsgroups since the release of OpsMgr 2007 R2.

Issue: The names of the notification channels in the Administration space appear as GUIDs. Attempts to delete these channels result in an error message including something along the lines of "notification endpoint is currently not deleted....etc"

Also, after you upgrade to System Center Operations Manager 2007 R2 from System Center Operations Manager 2007 Service Pack 1 (SP1), the console shows customized subscriptions. These subscriptions resemble the following under the Administration\Notifications\Subscriptions\Subscription Name node:

SMTP{GUID}

Resolution: This is a known issue in OpsMgr 2007 R2 and can be resolved by running the script contained in Knowledge Base Article 971233 - http://support.microsoft.com/kb/971233. Make sure to read the KB article completely and to set the appropriate language code at the end of the TSQL script. The KB article provides a list of language codes.

DECLARE @NotificationManagementPackId uniqueidentifier
SELECT @NotificationManagementPackId = ManagementPackId FROM ManagementPack
WHERE MPName = 'Microsoft.SystemCenter.Notifications.Internal'

SELECT ModuleTypeId, MDTName 
INTO #ActionsToRename
FROM ModuleType 
WHERE ManagementPackId = @NotificationManagementPackId
AND MDTImplementationXML LIKE '%ContentGenerator%Transport%' AND MDTName <> 'DefaultSmtpAction'

SELECT R.RuleId, M.ModuleTypeId, DSV.DisplayName 
INTO #RulesToUseToRename
FROM Rules R
JOIN Module M ON R.RuleId = M.ParentId
JOIN #ActionsToRename A ON A.ModuleTypeId = M.ModuleTypeId
JOIN DisplayStringView DSV ON DSV.MPElementId = R.RuleId 
WHERE R.ManagementPackId = @NotificationManagementPackId AND DSV.LanguageCode = 'ENU'
 

UPDATE LocalizedText 
SET LTValue = R.DisplayName
FROM #RulesToUseToRename R
WHERE R.ModuleTypeId = MPElementId AND LTStringType = 1 AND LanguageCode = 'ENU'

DROP TABLE #RulesToUseToRename
DROP TABLE #ActionsToRename

Blog: ReSearch This! KB - LSASS process high processor load detected.

Mon, 05 Oct 2009 22:28:03 GMT

Alert: LSASS process high processor load detected.

Issue: This alert monitor activates when the LSASS threshold percent goes above 80%. For our environment we have a domain controller which processes large numbers of checks and changes to active directory based upon a user provisioning process. This occurs regularly on one Windows 2003 domain controller which cannot be upgraded.

Resolution: Configured this to have a higher threshold (97%) for this server and stored it in the ActiveDirectory2003_Overrides management pack. Closed the alert to see if it would recur.

Submitted By: Cameron Fuller (MVP)

Blog: ReSearch This! KB - Database Offline

Mon, 05 Oct 2009 22:08:30 GMT

Alert: Database Offline

Issue: This issue was occurring about every two days on the WSUS database on one of our database servers. This is monitored via the Database Status monitor which checks this status on an hourly basis (every 3600 seconds). The mscuptdb (WSUS) database was reporting itself to be offline/recovery/pending/suspect/emergency. When we accessed the server the database was already online. Determined that Auto Close was set to True for the database.

Resolution: Changed this setting from True to False on the WSUS database in SQL Server Management Studio, properties of the mscuptdb database on the Options tab. Allowed this alert to auto-close after the one hour timeframe and monitored for the next week to verify that it did not recur.

Submitted By: Cameron Fuller (MVP)