Knowledge Base

Here are the results of a form posted 07/15/2008 3:58PM:

Alert: Script or Executable Failed to run

Issue: Forced to terminate the following process started at 1:58:31 PM because it ran past the configured timeout 300 seconds. Command executed: \”C:\\WINDOWS\\system32\\cscript.exe\” /nologo \”DiscoverSQL2005DBEngineDiscovery.vbs\”

Resolution: The discovery failed because the timeout was too low. 300 seconds was not enough to discover all de DBs that are on the server. We increased the timeout to 900 seconds with an override on the discovery and now the scripts has enough time to execute.

Submitted By: AlanZ

Here are the results of a form posted 06/16/2008 5:27AM:

Alert: Health Service Heartbeat Failure

Issue: Database corruption in “C:\Program Files\System Center Operations Manager 2007\Health Service State\Health Service Store\HealthServiceStore.edb\”.

Services tries to rebuild the database but failes.

Resolution: Delete the EDB and LOG files in the directory and restart the service.

Submitted By: Mirco Wilhelm

We mentioned a few months ago the Dell Management Pack issues running on Operations Manager 2007 SP1. As it turns out, Microsoft discovered an issue SNMP networking module that causes the HealthService to become unstable when there is a rule configured to use SNMP within a discovery. They  have developed a  hotfix to  address the problem.

Where to get the fix:

The fix is described in KB951526. I do not see this KB on the MS support site yet, so call Microsoft support to obtain the fix.

NOTE: The patch applies to System Center Operations Manager 2007 SP1 only

Symptoms

You will see this event in the Operations Manager event log on the server that has the rule which is using our SNMP networking module in a discovery rule:

Event Type: Error

Event Source: HealthService

Event Category: Health Service

Event ID: 4000

Date: 4/22/2008

Time: 1:32:13PM

User: N/A

Computer: OPSMGRSRV1

Description:

A monitoring host is unresponsive or has crashed. The status code for the host

failure was 2164195371.

For more information, see Help and Support Center at

http://go.microsoft.com/fwlink/events.asp.

Affected Files

This hotfix impacts the following installed files: MomNetworkModules.dll (Version 6.0.6278.24)

Additional Information

For additional information about this issue, see KB article KB951526 at <http://support.microsoft.com/>. For additional information and downloads, see <http://www.microsoft.com/mom>.

This is one you need to be aware of if your running Exchange 2007. The patch is titled “A memory leak occurs when you monitor Exchange Server 2007 by using the MOM 2007 agent in System Center Operations Manager 2007″

The short version of the problem is:

1. You load Operations Manager 2007 SP1
2. You load the Opsmgr SP1 agent on an Exchange computer
3. A memory leak occurs on the Exchange 2007 computer.

Instructions on how to get the patch HERE.

Update your MOM skills to Operations Manager 2007 at the Operations Manager 2007 Bootcamp! Check the 2008 Bootcamp Schedule and request pricing and availability HERE.

Alert: The File Replication Service is not running on Domain Controller

Issue: File replication service constantly stopps and restarts, providing the following Event:

ntfrs (2224) A bad page link (error -338) has been detected in a B-Tree (ObjectId: 31, PgnoRoot: 139) of database c:\windows\ntfrs\jet\ntfrs.jdb (6587 => 6904, 6905).

and

The File Replication Service failed a consistency check
(!\”ISCU_INS_OUTLOG failed\”)
in \”ChgOrdIssueCleanup:\” at line 8306.

Resolution: Event ID 447 indicates that the logical database structure has become corrupted. This may occur for one or more of the following reasons:
• Disk caching has not committed transactions to the hard disk and the server has stopped responding (crashed).
• Incorrect log files were replayed during a database restoration.
• The server has a defective hard disk controller.
• Database log files have been removed that were not fully committed to the database.

http://support.microsoft.com/kb/810190/en-us

copied the ESEUTIL files to the Server and ran ESUTIL /p on the database to repair it.

Submitted By: Mirco Wilhelm

Alert: Network Adapter Disconnected

Issue: Network adapter is not connected

Resolution: Either disable this monitor for this specific instance on this specific server, or determine why it has been disconnected.

Submitted By: Cade

A couple of articles showed up as new or updated this week.

946428 - The Health Service does not process configuration files, and events 7022 and 1220 are logged every 30 minutes on a domain controller on which you installed the Operations Manager 2007 agent

945312 - The OpsMgr Health service may incorrectly display the health state of the cluster nodes in System Center Operations Manager 2007

949875 - When you run a task in the System Center Operations Manager 2007 Operations Console on a Russian version of Windows Server 2003, the task outputs are displayed in corrupted text

There seems to be a  small bit of errata in the TechNet documentation for the Set-ManagementServer cmdlet, used in setting primary and failover management servers for the Gateway.

URL: http://technet.microsoft.com/en-us/library/bb381392.aspx

Issue: The -ManagementServer parameter should be -PrimaryManagementServer.

I suspect this may have changed somewhere between Beta 2 and SP1, as my notes show I used this successfully as well, (and saw no complaints until recently), but hard to be sure. I’ll also update the PKI and Gateway document also to reflect this shortly. 

Here are the results of a form posted 03/27/2008 9:38AM:

Alert: WMI Probe Module Failed Execution

Issue: Object enumeration failed Query: ‘SELECT * FROM MSCLUSTER_Resource where Name=”*** *** *** E:\”‘ HRESULT: 0×80041017 Details: Invalid query One or more workflows were affected by this. Workflow name: Microsoft.Windows.Cluster.Resource.StateMonitoring Instance name: *** *** *** E:\ Instance ID: {CB737B6D-72C4-A00B-B858-04E04EF6A422} Management group: ***

Resolution: http://www.microsoft.com/communities/newsgroups/en-us/default.aspx?dg=microsoft.public.opsmgr.sp1&tid=94c39ab4-ad17-4b43-9029-e9edf7e881d4&cat=35313A04-C7CB-4422-86A1-8D1135E1FA95&lang=en&cr=US&sloc=&p=1

Submitted By: jgraham

A couple of additional KB articles for Operations Manager 2007 not in last weeks summary.

949454 - Error message when you try to open a report from a link in the scheduled report e-mail notification in System Center Operations Manager 2007: “An internal error occurred on the report server”

949452 - Event 4618 is logged when you use the AdtSetup.exe program to update an Audit Collection Services installation in System Center Operations Manager 2007

949451 - The ScheduleFilter module is removed from a rule in System Center Operations Manager 2007

Only 1 article popped up on the radar this week:

946423 - How to install a System Center Essentials 2007 agent on a computer that is running ISA Server 2006 or ISA Server 2004

Alert: Script or Executable Failed to run

Issue: there is a bug in the MOSS 2007 MP that causes this warning whenever discovery is run on each server that is discovered. The error references \”getservernames.vbs\”

The process started at 16:12:46 failed to create
System.Discovery.Data, no errors detected in the output. The process
exited with 4294967295

Command executed: \”C:\\WINDOWS\\system32\\cscript.exe\” /nologo
\”GetServerNames.vbs\” {A18B826D-DFA9-DC21-F94C-68A8A95ADD4C} {D289112E-
EC4F-295D-0A9B-4AC755ECC4F0} E2K3.xxx.xxxxxxxxx
Working Directory: C:\\Program Files\\System Center Operations Manager
2007\\Health Service State\\Monitoring Host Temporary Files 1\\12487\\

One or more workflows were affected by this.

Workflow name: Microsoft.Office.Sharepoint.Server.
2007.MOSS.Server.Discovery

Instance name: E2K3.xxx.xxxxxxxx

Instance ID: {D289112E-EC4F-295D-0A9B-4AC755ECC4F0}

Management group: XXX

Resolution: disable the rule.

http://www.microsoft.com/communities/newsgroups/list/en-us/default.aspx?dg=microsoft.public.opsmgr.managementpacks&tid=c2719164-4ae2-4ec8-aae4-663d48dc0aba&cat=〈=&cr=&sloc=&p=1

Submitted By: Ron Williams

Here are the results of a form posted 03/21/2008 10:58AM:

Alert: WMI Probe Module Failed Execution

Issue: The WMI Probe module encountered an unexpected runtime error. This error could happen while processing a data item or an asynchronous operation.

Resolution: from http://forums.microsoft.com/TechNet/ShowPost.aspx?PostID=3005952&SiteID=17

This is a known issue, which is under investigation and will be fixed in the future. You can just safely ignore the alerts. You can also disable the Rule which generates the alerts by following these steps:

1. Open console and navigate to Authoring pane;

2. Expand Rules and find a rule named \”WMI Probe Module Execution Failure\”;

3. Right-click it and choose Overrides -> Disable the Rule -> For all objects of type: Agent.

Submitted By: Ron Williams

Alert: Failure DSNs Total - increase over 60 minutes - Red(>40) - Hub Transport

Issue: DSN value being gathered from cumulative number of failures since the server was restarted, not within the last hour.

Resolution: Management pack bug which is confirmed in the newsgroups this is scheduled to be resolved in the next update of the management pack scheduled for April-June 2008.

Submitted By: Cameron Fuller [MVP]

Alert: The share configuration was invalid . The share is unavailable.

Issue: The share within the alert was a user share on a system.

Resolution: Determined that the user did still exist in Active Directory (AD Users and computers, validated that the user name was the same). Re-created the user folder per the product knowledge.If the user no longer existed, the share would have been removed using the net share /delete option presented in the product knowledge.

Submitted By: Cameron Fuller [MVP]

Alert: HP Agent: HP Insight Event Notifier Status

Issue: The HP Insight Event Notifier service would not start (it started and immediately stopped) on the server. There was a incorrect SMTP server defined for the event notifier configuration for CIM.

Resolution: This was fixed by logging into the system and running the Start/Programs/HP Management Agents/Event Notifier Config program and setting it to the correct value for the SMTP server.

Submitted By: Cameron Fuller [MVP]

Alert: The MOM Server received data that does not match the MOM Agent identifier

Issue: The agent configuration did not match the MOM server configuration. Mutual authentication was turned off in the MOM environment, but the agent was configured as if mutual authentication was turned on.

Resolution: Logged into the agent (shown in the description field of the alert) and through add/remove programs modified the MOM configuration on the agent to match the correct configuration.

Submitted By: Cameron Fuller [MVP]

Alert: Active Directory lookup for user failed with error.

Issue: The Exchange front-end server had the diagnostic logging set to maximum for the Authentication on the POP3 service. This error is recorded when the Mailbox Alias does not match the User Logon Name (Pre-Windows 2000) value.

Resolution: Changed the diagnostic logging from Maximum to None as the number of POP3 servers where the User Logon Name (Pre-Windows 2000) does not match the Mailbox Alias is very common in the environment. Details on how to fix the issue are available at http://support.microsoft.com/kb/296387.

Submitted By: Cameron Fuller [MVP]

Alert: SDK SPN Not Registered

Issue: This warning alert (Operations Manager SDK services failed to register an SPN) occurred each time the SDK Service on my RMS restarted.

Resolution: from http://blogs.technet.com/jonathanalmquist/archive/2008/03/12/sdk-spn-not-registered.aspx

Open ADSIEdit.msc on your DC.
Navigate to the account you created for your SDK Service.
Right-click > Properties.
Click Security tab.
Click Advanced > Click add > type in SELF > Click OK.
Click Properties tab.
Open the Apply Onto drop-down list > select This object only.
Scroll the properties list down until you find Read servicePrincipalName and writeServicePrincipalName.
Select Allow for both.
Click OK until all dialogue boxes are closed. Restart the SDK Service on the RMS.

Submitted By: Ron Williams

A couple of setup-related KB articles released this week for System Center Essentials 2007.

949448 - Error message in System Center Operations Manager 2007 or in System Center Essentials 2007: “The setup wizard was interrupted before System Center Operations Manager 2007 could be installed” or “The client has been disconnected from the server”

946418 - Error message when you install the System Center Operations Manager 2007 reporting feature: “SRS Server Validation Error”

Lots of KB articles released for Operations Manager 2007 this week, which are listed below with a link to the KB on the Microsoft website.

949455 - System Center Operations Manager 2007 Reporting installation fails on a Windows Server 2008 computer if IIS 6.0 Management Compatibility is not installed

949453 - The state calculation may be delayed when a new group or a distributed application is created in System Center Operations Manager 2007

949450- You cannot add required permissions to the share when you run the “fix permissions” task in System Center Operations Manager 2007

949449 - The Client Monitoring Configuration Wizard fails with an unknown error that occurs together with the 80FF002B code when you enable the client monitoring feature in System Center Operations Manager 2007

949447 - You may have to restart the computer when you install the security update that Microsoft Knowledge Base article 933579 describes

949446 - The mouse pointer disappears and the mouse rotation operation is unpredictable in System Center Operations Manager 2007

946426 - You are not prompted that a computer is shut down after the Maintenance Mode window expires in System Center Operations Manager 2007

948559 - AEM does not work when the management server action account is a low-permission account in System Center Operations Manager 2007

I was working with a custom runtime script the other day and received an ambiguous error message when I executed the script on my development workstation. (Incidentally, if you’re developing custom runtime scripts for Operations  Manager and Essentials 2007 check out our Scripting Series, which is 3 installments and counting.

Error: Microsoft VBScript runtime error: Subscript out of range

Issue: The Event ID I was using was actually an invalid event number!

Workaround: The .LogScriptEvent method only accepts event IDs from 1 to 20000. 20001 and higher result in the error above.

 Here are the most recent KB’s for System Center Operations Manager 2007

946424 - How to move the OperationsManager database from a computer that is running SQL Server 2005 to another computer that is running SQL Server 2005

946437 - How to disable the use of certificates that are imported by using the MOMCertImport.exe tool in System Center Operations Manager 2007

946433 - Description of the mode that GSM modems must support to work with SMS notifications in System Center Operations Manager 2007

948730 - WMI does not work correctly after you install the Microsoft System Center Operations Manager 2007 agent on a Dell computer

946435 - Error message when you configure Agent Exception Monitoring to use a remote file share in System Center Operations Manager 2007: “A file share could not be created”

939606 - Agent approval problems may occur when you run System Center Essentials 2007 in Service Provider mode

Update your MOM 2005 skills to Operations Manager 2007 at the  Operations Manager Bootcamp! 

Check the 2008 Bootcamp Schedule and request pricing and availability HERE.

Here are the most recent KB’s for System Center Essentials

949389 - Issues that are fixed in System Center Essentials 2007 Service Pack 1

937467 - Updates cannot be distributed to managed hosts, or you cannot import updates directly from partners when you import updates from partner catalogs in System Center Essentials 2007

939606 - Agent approval problems may occur when you run System Center Essentials 2007 in Service Provider mode

948731 - Error message when you try to start the Opsmgr Health service on a Windows Server 2003-based computer: “Could not start the Opsmgr health service on Local computer. Error 0×8004005″

Just ahead of SP1, a  bunch of new knowledge  base articles for Operations Manager and Essentials 2007 just showed up. I’ve got them broken out by product below.

Essentials 2007

938509 - You cannot approve pending actions for servers in the “Agent License Limit Exceeded” state even after you add more server licenses in System Center Essentials 2007 

 Operations Manager and Essentials

938510 - You cannot obtain elevated user rights in management servers and in agents in System Center Operations Manager 2007 or System Center Essentials 2007 environments

 Operations Manager 2007

941943 - The HealthServiceStore.edb file size grows to several gigabytes over time in an agent that is running System Center Operations Manager 2007

940224 - The Optimized Performance Counter Collection rule collects multiple values of 0 (zero) in System Center Operations Manager 2007

938507 - Report scheduling fails in System Center Operations Manager 2007 when the regional settings on the client computer differ from the regional settings on the server

941307 - A health monitor may display state changes in an incorrect order in System Center Operations Manager 2007

939769 - You experience a delay in fetching “Actions for Tasks” and “Actions for Reports” for a selected row in System Center Operations Manager 2007

948069 - Error message when you try to run reports in System Center Operations Manager 2007: “Cannot open Database ‘OperationsManagerDW’ requested by the login”

Here’s another issue I just read on Dustin’s blog. This is related to signing validation failure and a hotfix is forthcoming. Life will be interesting for sure for Essentials admins over the next few weeks.

Click  HERE for more info.  

You may know IE 7 is planned to be distributed as a rollup package in February 08. Dustin Jones on the SCE team mentions there may be administrator action required to complete the rollout via Essentials 2007.

Click HERE for more details.

Microsoft KB articles posted for System Center Operations Manager 2007 this week: 

948096 - SCOM 2007: Exchange MP Reports - “Top 100″ Returns ‘Blank’

948097 - SCOM 2007: The CPU percentage Utilization monitors do not work on a Windows 2003 server.

948095 - SCOM 2007 Exchange 2003 management pack: Exchange server cannot be detected as “back-end” server

948098 - SCOM 2007: Gateway server is not working properly after installation.

Here are the results of a form posted 01/21/2008 2:10PM:

Alert: DFS Domain Root: Link Unavailable

Issue: The DFS links on the DFS Root servers could not be successfully queried by MOM after an upgrade on the DFS Root servers from Windows Server 2003 Service Pack 1 to Service Pack 2.

Resolution: The script used by the alert utilizes the dfsutil.exe program, included with the Windows Server 2003 Support Tools. Upon installation of the Support Tools for Windows Server 2003 Service Pack2 on the DFS Root server, which updates the dfsutil.exe program, MOM is able to successfully query the links on the Root servers.

Submitted By: Brendon McCaulley

Here’s a list of Operations Manager 2007 KB’s released last week

946427 Even though you install the agent on the physical nodes of an SQL cluster, the cluster resource does not appear in the System Center Operations Manager 2007

946436 Error message when you use the Command Shell utility for the first time in System Center Operations Manager 2007: “Can not find Operations Manager Management Server name for current user”

946432 Registry entry names that contain a backslash character (\) are considered as part of the registry path when you use Registry probe

 Here’s a list of Essentials 2007 KB’s released last week

946432 Registry entry names that contain a backslash character (\) are considered as part of the registry path when you use Registry probe

946422 The reporting console stops responding when you generate a report in System Center Operations Manager 2007 or in System Center Essentials 2007

944693 Software updates cannot be deployed if the software update catalogs that are imported by System Center Updates Publisher 3.0 contain a /qn switch in the command line

946420 The background color of a System Center Operations Manager 2007 report or of a System Center Essentials 2007 report may be black

I posted links to several Operations Manager and Essentials KB articles at the end of last week, but several more showed up over the weekend…see below

Essentials 2007

• 946422 - The reporting console stops responding when you generate a report in System Center Operations Manager 2007 or in System Center Essentials 2007
• 944693 - Software updates cannot be deployed if the software update catalogs that are imported by System Center Updates Publisher 3.0 contain a /qn switch in the command line
• 946420 - The background color of a System Center Operations Manager 2007 report or of a System Center Essentials 2007 report may be black

Operations Manager 2007

Alert: Total CPU Utilization Percentage is too high

Issue: Most likely the processor on the system is currently over-utilized and is indicating a bottleneck condition. Common potential causes for this include:
• Misconfigured anti-virus can cause high processor utilization if files which should be excluded from scanning are not (such as for Exchange databases, logs, and the bin directory).
• Hardware failure is another possibility that should be considered and research through the hardware vendor.
• A hung process may be consuming resources to the exclusion of all others.
• A large portion of the time the system actually is bottlenecked. This can be verified either by checking in the processor performance counters gathered by OpsMgr to determine if there is a consistent bottleneck. This can also be checked by logging into the system and using task manager to determine what is using up CPU cycles. Most likely it is a process running on the system which is using too much processing.
• A great Microsoft discussion on Processor Bottlenecks is available at http://technet.microsoft.com/en-us/library/aa995907.aspx

Resolution: Add more processing resources (faster processors, additional processors), replace the system with stronger processor(s), split the load through network load balancing, or move off programs/services creating load to the system. Until the processing bottleneck can be addressed, determine from the trending of the performance counters what an acceptable level is for this particular system in your organization and set an override so that alerts will be generated only if the system goes beyond the levels identified for the server.

Submitted By: Cameron Fuller

Alert: Total Percentage Interrupt Time is too high

Issue: Most likely the processor on the system is currently over-utilized and is indicating a bottleneck condition. Common potential causes for this include:
• Misconfigured anti-virus can cause high processor utilization if files which should be excluded from scanning are not (such as for Exchange databases, logs, and the bin directory).
• Hardware failure is another possibility that should be considered and research through the hardware vendor.
• A hung process may be consuming resources to the exclusion of all others.
• A large portion of the time the system actually is bottlenecked. This can be verified either by checking in the processor performance counters gathered by OpsMgr to determine if there is a consistent bottleneck. This can also be checked by logging into the system and using task manager to determine what is using up CPU cycles. Most likely it is a process running on the system which is using too much processing.
• A great Microsoft discussion on Processor Bottlenecks is available at http://technet.microsoft.com/en-us/library/aa995907.aspx

Resolution: Add more processing resources (faster processors, additional processors), replace the system with stronger processor(s), split the load through network load balancing, or move off programs/services creating load to the system. Until the processing bottleneck can be addressed, determine from the trending of the performance counters what an acceptable level is for this particular system in your organization and set an override so that alerts will be generated only if the system goes beyond the levels identified for the server.

Submitted By: Cameron Fuller

Alert: Total Percentage Interrupt Time is too high

Issue: Most likely the processor on the system is currently over-utilized and is indicating a bottleneck condition. Common potential causes for this include:
• Misconfigured anti-virus can cause high processor utilization if files which should be excluded from scanning are not (such as for Exchange databases, logs, and the bin directory).
• Hardware failure is another possibility that should be considered and research through the hardware vendor.
• A hung process may be consuming resources to the exclusion of all others.
• A large portion of the time the system actually is bottlenecked. This can be verified either by checking in the processor performance counters gathered by OpsMgr to determine if there is a consistent bottleneck. This can also be checked by logging into the system and using task manager to determine what is using up CPU cycles. Most likely it is a process running on the system which is using too much processing.
• A great Microsoft discussion on Processor Bottlenecks is available at http://technet.microsoft.com/en-us/library/aa995907.aspx

Resolution: Add more processing resources (faster processors, additional processors), replace the system with stronger processor(s), split the load through network load balancing, or move off programs/services creating load to the system. Until the processing bottleneck can be addressed, determine from the trending of the performance counters what an acceptable level is for this particular system in your organization and set an override so that alerts will be generated only if the system goes beyond the levels identified for the server.

Submitted By: Cameron Fuller

Alert: Total Percentage Interrupt Time is too high

Issue: Most likely the processor on the system is currently over-utilized and is indicating a bottleneck condition. Common potential causes for this include:
• Misconfigured anti-virus can cause high processor utilization if files which should be excluded from scanning are not (such as for Exchange databases, logs, and the bin directory).
• Hardware failure is another possibility that should be considered and research through the hardware vendor.
• A hung process may be consuming resources to the exclusion of all others.
• A large portion of the time the system actually is bottlenecked. This can be verified either by checking in the processor performance counters gathered by OpsMgr to determine if there is a consistent bottleneck. This can also be checked by logging into the system and using task manager to determine what is using up CPU cycles. Most likely it is a process running on the system which is using too much processing.
• A great Microsoft discussion on Processor Bottlenecks is available at http://technet.microsoft.com/en-us/library/aa995907.aspx

Resolution: Add more processing resources (faster processors, additional processors), replace the system with stronger processor(s), split the load through network load balancing, or move off programs/services creating load to the system. Until the processing bottleneck can be addressed, determine from the trending of the performance counters what an acceptable level is for this particular system in your organization and set an override so that alerts will be generated only if the system goes beyond the levels identified for the server.

Submitted By: Cameron Fuller

A couple of new KB articles for Essentials 2007 this week…

946419 The System Center Operations Manager 2007 reporting feature and the System Center Essentials 2007 reporting feature do not work correctly when you configure SQL Server 2005 Reporting Services to run in SharePoint integrated mode

946417 When you restart Root Management Server, the Health Service does not start in System Center Operations Manager 2007

A couple of new KB articles to be aware of this week…

946425 … Error message when you try to remove the System Center Operations Manager 2007 database role: “Error 1324. The folder path ‘Microsoft SQL Server’ contains an invalid character”

945946 … Event ID 2115 is logged, and a management server generates an “unable to write data to the Data Warehouse” alert in System Center Operations Manager 2007

946419 The System Center Operations Manager 2007 reporting feature and the System Center Essentials 2007 reporting feature do not work correctly when you configure SQL Server 2005 Reporting Services to run in SharePoint integrated mode

946417 When you restart Root Management Server, the Health Service does not start in System Center Operations Manager 2007

Alert: The AD Last Bind latency is above the configured threshold.

Issue: To determine the historical values of the setting open the Operations console / Monitoring / Active Directory Server 2003/Performance and view the OP Master bind time performance counters. Note: In OpsMgr 2007 RC0 SP1 version, there was a bug where a factor 1000 is added when the SP1 RC agent does the monitoring. If you run the diagnostic tasks inside the alerts you see the correct response values. This should be resolved when SP1 goes RTM.

Resolution: Determine acceptable levels of performance for this counter in your organization and override the thresholds to match those levels for the system(s) identified by this alert.
Information gathered from Pontus Blomqvist\’s and Anders Bengtsson\’s newsgroup posts.

Submitted By: Cameron Fuller

Here are the results of a form posted 01/11/2008 2:33PM:

Alert: Total CPU Utilization Percentage is too high

Issue: Most likely the processor on the system is currently over-utilized and is indicating a bottleneck condition. Common potential causes for this include:
• Misconfigured anti-virus can cause high processor utilization if files which should be excluded from scanning are not (such as for Exchange databases, logs, and the bin directory).
• Hardware failure is another possibility that should be considered and research through the hardware vendor.
• A hung process may be consuming resources to the exclusion of all others.
• A large portion of the time the system actually is bottlenecked. This can be verified either by checking in the processor performance counters gathered by OpsMgr to determine if there is a consistent bottleneck. This can also be checked by logging into the system and using task manager to determine what is using up CPU cycles. Most likely it is a process running on the system which is using too much processing.
• A great Microsoft discussion on Processor Bottlenecks is available at http://technet.microsoft.com/en-us/library/aa995907.aspx

Resolution: Add more processing resources (faster processors, additional processors), replace the system with stronger processor(s), split the load through network load balancing, or move off programs/services creating load to the system. Until the processing bottleneck can be addressed, determine from the trending of the performance counters what an acceptable level is for this particular system in your organization and set an override so that alerts will be generated only if the system goes beyond the levels identified for the server.

Submitted By: Cameron Fuller

Alert: The Op Master RID Master Last Bind latency is above the configured threshold

Issue: Bind from the domain controller identified in the alert to the RID Master is slower than 5 seconds for a warning and slower than 15 seconds for an error. This occurred in a remote site connecting to a central site with the RID master role.

Resolution: The alert appears to be due to a slowness in the link between the two locations, or a condition where one of the two servers identified may have been overloaded. In this particular case it was caused by a domain controller which was overloaded due to insufficient hardware, which had to be decommissioned.

Submitted By: Cameron Fuller

Here are the results of a form posted 01/04/2008 1:28PM:

Alert: Data Warehouse failed to deploy reports for a management pack to SQL Reporting Services Server

Issue: The DNS management pack can cause issues in the environment resulting in event ID 26319 from the OpsMgr SDK Service.

Resolution: Add the account designated as the Data Reader account to the group designated as Operations Manager Administrators during setup (this group is added to the Operations Manager Administrators role). This issue only exists with the current DNS Management Pack (version 6.0.5000.0) and no other management packs.

Submitted By: Jason Sandys

Alert: Outlook Web Access logon failure: Unexpected error during synthetic Outlook Web Access logon
Issue: There is a good discussion on this: http://technet.microsoft.com/en-us/library/aa996009.aspx (issue #3)

OWA logon verification : Cannot measure OWA availability for the following URL:0×80131502(-2146233086) Index was out of range. Must be non-negative and less than the size of the collection. Parameter name: index

Resolution: This rule needs to have SSL configured. Steps here to configure SSL on the Exchange 2003 front-end servers are available at http://www.petri.co.il/configure_ssl_on_owa.htm.

To enable SSL:

-Open Internet Information Services (IIS Manager).
-Connect to the server name of your front-end Exchange server.
-Drill down to Web Sites, then to the web site.
-Locate the two virtual directories named OMA and Microsoft-Server-ActiveSync.
-Open the properties of the virtual directories, choose the Directory Security tab.
-Under Secure communications, click Edit.
-Check the box labeled \”Require security channel (SSL)”.

Submitted By: Cameron Fuller [MOM MVP]

Alert: Outlook Mobile Access logon failure: Unexpected errorsIssue: OMA logon verification : Cannot measure OMA availability for the following URL: 0×80131502(-2146233086) Index was out of range. Must be non-negative and less than the size of the collection. Parameter name: index

Resolution: This rule needs to have SSL configured. Steps here to configure SSL on the Exchange 2003 front-end servers are available at http://www.petri.co.il/configure_ssl_on_owa.htm.

To enable SSL:

-Open Internet Information Services (IIS Manager).
-Connect to the server name of your front-end Exchange server.
-Drill down to Web Sites, then to the web site.
-Locate the two virtual directories named OMA and Microsoft-Server-ActiveSync.
-Open the properties of the virtual directories, choose the Directory Security tab.
-Under Secure communications, click Edit.
-Check the box labeled \”Require security channel (SSL)”.

Submitted By: Cameron Fuller [MOM MVP]

Alert: Exchange ActiveSync logon failure: Unexpected ErrorIssue: EAS logon verification : Cannot measure EAS availability for the following URL:
0×80131502(-2146233086) Index was out of range. Must be non-negative and less than the size of the collection. Parameter name: index

Resolution: This rule needs to have SSL configured. Steps here to configure SSL on the Exchange 2003 front-end servers are available at http://www.petri.co.il/configure_ssl_on_owa.htm.

To enable SSL:

-Open Internet Information Services (IIS Manager).
-Connect to the server name of your front-end Exchange server.
-Drill down to Web Sites, then to the web site.
-Locate the two virtual directories named OMA and Microsoft-Server-ActiveSync.
-Open the properties of the virtual directories, choose the Directory Security tab.
-Under Secure communications, click Edit.
-Check the box labeled \”Require security channel (SSL)”.

Submitted By: Cameron Fuller [MOM MVP]

Alert: SSL is not configured on this Exchange server

Issue: Front-end servers without SSL configured on them in Exchange 2003.

Resolution: Steps here to configure SSL on the Exchange 2003 front-end servers are available at http://www.petri.co.il/configure_ssl_on_owa.htm.

To enable SSL:

-Open Internet Information Services (IIS Manager).
-Connect to the server name of your front-end Exchange server.
-Drill down to Web Sites, then to the web site.
-Locate the two virtual directories named OMA and Microsoft-Server-ActiveSync.
-Open the properties of the virtual directories, choose the Directory Security tab.
-Under Secure communications, click Edit.
-Check the box labeled \”Require security channel (SSL)”.

If SSL is being translated at a higher level (so that https comes into the network and is translated to http then it is handed off to the http server) this rule can be disabled.

Submitted By: Cameron Fuller [MOM MVP]

Alert: Failed to probe the state of monitored servicesIssue: Check service(s) state : The following services are not running: MSExchangeMTA

Resolution: This service is intentionally not running on the server reporting the error. This could be readjusted by running the Exchange Configuration Wizard and choosing to not monitor that service. Another approach is to open the registry editor on the server being monitored and changing the HKLM\\Software\\Microsoft\\Exchange MOM in the Monitored Services key to remove that service from the list.

Submitted By: Cameron Fuller [MOM MVP]

Here are the results of a form posted 12/18/2007 8:00AM:

Alert: OWA: Outlook Web Access logon failure: Authentication error

Issue: The OpsMgr script in the Exchange 2003 management pack will not work if you are using a custom URL and HTTPS with certificates. If you\’re not already familiar with this issue, Andy Dominey previously blogged this at http://myitforum.com/cs2/blogs/adominey/archive/2007/04/10/mom-2005-and-om-2007-exchange-2003-management-pack-issue.aspx). For example, if you have a server named SERVER1 at ABCCO and your webmail address is https://webmail.abcco.com on SERVER1 the current MP cannot perform the check on this web location correctly, as the server name (server1.abcco.com) does not match the certificate name of webmail.abcco.com.

Resolution: Create a custom simple monitor with two views to monitor the OWA front-end functionality. Details available at: http://ops-mgr.spaces.live.com/blog/cns!3D3B8489FCAA9B51!271.entry

Submitted By: Cameron Fuller [MOM MVP]

Alert: GPO Data Retrieval Error

Issue: Every 5 minutes errors were occurring in the application log for Userenv for 1058 and then 1030.

Resolution: Determined that the domain controller had not been patched or rebooted in over six months (checked the system log for the event source of eventlog). Patched and rebooted the DC and the group policy errors stopped occurring.

Submitted By: Cameron Fuller [MOM MVP]

Alert: Agent proxying needs to be enabled for a health service to submit discovery data about other computers.

Issue: Agent proxying needs to be enabled when health service discovers instance of some managed e