Conhost.exe & Powershell.exe utilizing more in SCOM agent server

Hi All,
Currently we installed SCOM agent in lot of servers. But from few agent server there are lot of "Conhost.exe & Powershell.exe" process utilizing more memory. When i restart the SCOM service in that agent those process got killed it came back to normal
state. But after some time the process count got increased frequently. Due to this issue the server went to hung state.
Kindly help me.
Regards,
Sandy.

Hi, Compare OS components, Service Pack, patches between good and problem servers first. Also check SCOM agent patches for your version.

Similar Messages

Running SCOM Powershell cmdlets on SCOM Agent Server

Hello,
I have to run some SCOM cmdlets on SCOM Agent Server. But I am getting the below error.
"Get-SCOMClass : The Data Access service is either not running or not yet initilized. Check the event log for more information."
In the Agent Server, there is no "Data Access service".
Please help me in running the SCOM cmdlets on SCOM Agent Server.
Thanks in advance.
Regards,
Mahadevan.G

Hi Mahadevan:
On a SCOM management server, the SDK service name is "System Center Data Access Service". If you don't see that service listed then you are not on a SCOM management server.
Not sure what you mean "SCOM Agent Server"? The SCOM cmdlets won't run on a computer with just the SCOM agent installed unless you also install the SCOM console/powershell features from the SCOM install media.
The Get-SCOMClass cmdlet (or Get-SCClass) should run on a management server with no problems. Recommend check again that you are really logged into a SCOM management server.
John Joyner MVP-SC-CDM

Management packs to scom agent server ?

How SCOM agent will get Management Packs from Management server ? Will all Management Packs will get downloaded to all SCOM agent server?
Or how does Management server will come to know only required Management Packs
for agent server? (I heard Management Server will scan the registry to of agent server to understand the application and requirement , then it sent Management Packs
for agent server , is that correct ? )

On import, a complex and expensive series of operations occur.
The MP is written to a table.
The MP is loaded by the config service and all discovery targets are examined
A list of agents is created based on whether the agent manages a type instance that is a target of a discovery in each new MP. When this is found to be a match, the config service marks the agent config as stale in memory.
The agent periodically contacts the RMS (config service). In the response, a "you are stale" flag is included. THis causes the agent to ask for a resynchronization.
The agent gets a response with all of the state for every type instance being managed, as well as a list of mps and versions and indicators of whether the agents copy of these is stale.
The agent then requests any files it needs and receives them (this is expensive)
The agent then loads each MP, replacing any workflows that are necessary, and starts normal agent processing (discoveries run immediately - this is expensive).
Agent submits new discovery data. The config service responds with data indicating what the official state of each managed instance sent in the discovery is. (this is expensive)
Each time you create an override and save it, the above is repeated. (this is why it is slow to make online overrides)
Roger

Error report on win 8.1 about conhost.exe and werfault.exe

I am not sure exactly what is happening, but I have noticed recently a new problem with CONHOST.EXE and werfault.exe each time I was opened application. and I didn't know exactly about was there have relationship with my brightness control
(increase or decrease) than I can't make any change after first time I have noticed about conhost.exe and werfault.exe. and other problem than my laptop more 'slowly' than before, but the console window will remain open fastly enough. (The host process
exists, but I can see an orphaned CONHOST.EXE for the application in Task Manager.)
I hope someone who sees this knows why this is happening, and can help me fix the problem.
Thanks!

Hi,
Here is the details about conhost.exe process:
Windows 7 / Windows Server 2008 R2: Console Host
http://blogs.technet.com/b/askperf/archive/2009/10/05/windows-7-windows-server-2008-r2-console-host.aspx
Same within Windows 8.
The werfault.exe is used for Windows Error Reporting.
You can go to event viewer to check if there are any error messages.
For this kind of issue, you may also try Clean Boot to see if this problem persists.
Alex Zhao
TechNet Community Support

WmiPrvSE.exe Consuming A Lot of RAM on 2012R2 DCs with SCOM Agent

Good afternoon,
I have three Windows Server 2012 R2 Domain controllers (AD DS, DNS, and DFS roles) and I'm running SCOM 2012 R2 Update Rollup 1 with all the latest management packs for Server 2012 R2, Active Directory, DNS, and DFS.
When I install SCOM agents on these DCs, a WmiPrvSE process starts consuming a lot of memory until it reaches around 512MB. At that point no one can RDP to the DCs, but we can enter-possession to get-process | sort ws and kill the offending WmiPrvSE.exe
process. When I uninstall the SCOM agent the server returns to normal.
Other Windows Server 2012 R2 servers in our environment don't have this problem.  And when we had Windows Server 2012 (no R2) domain controllers this wasn't an issue. My assumption is one of the management packs are an issue.
I've seen other posts, but they are either related to older versions of Windows Server or not domain controllers.
These are all the features I have installed on the DCs:
Active Directory Domain Services
DNS Server
File and Storage Services
File and iSCSI Services
File Server
DFS Namespaces
DFS Replication
File Server Resource Manager
Storage Services
.NET Framework 3.5 Features
.NET Framework 3.5 (includes .NET 2.0 and 3.0)
.NET Framework 4.5 Features
.NET Framework 4.5
WCF Services
TCP Port Sharing
Group Policy Management
Remote Differential Compression
Remote Server Administration Tools
Role Administration Tools
AD DS and AD LDS Tools
Active Directory module for Windows PowerShell
AD DS Tools
Active Directory Administrative Center
AD DS Snap-Ins and Command-Line Tools
DNS Server Tools
File Services Tools
DFS Management Tools
File Server Resource Manager Tools
SMB 1.0/CIFS File Sharing Support
User Interfaces and Infrastructure
Graphical Management Tools and Infrastructure
Server Graphical Shell
Windows PowerShell
Windows PowerShell 4.0
Windows PowerShell 2.0 Engine
Windows PowerShell ISE
Windows Server Backup
WoW64 Support

I have ever seen somebody has similar problem when import DNS MP to DC. Check whether it is this situation.
Otherwise, Open Event Viewer to see if there are any useful info there.
Last, apply the Hotfix below.
http://support.microsoft.com/kb/2919355
Juke Chou
TechNet Community Support

Ocopy.exe utility in Oracle 9i

I would like to take a hot backup of an Oracle 9i database on Win 2000 using the OCOPY.EXE utility. I'll be backing up all *.CTL, *.LOG, and *.DBF files.
Does this utility do the same thing as a level 0 hot backup in RMAN?
Pls advise
Thanks

Don't forget to put your tablespace in backup mode before
you copy datafiles using any OS utility! More details
in the docs:
http://download-west.oracle.com/docs/cd/B10501_01/server.920/a96572/osbackups.htm
Hope this helps.
Kailash.

ITunes 10 starting conhost.exe and it won't die

I updated to the latest version of iTunes about 3 weeks ago (haven't run it in over a week, due to this problem). Immediately after installing, I began seeing conhost.exe start multiple times. It took me a week to figure out which installed software was causing the issue, and narrowed it down to iTunes.
When iTunes runs (with or without its various services started), it starts conhost.exe. Whatever it is running in that console causes every other process that starts after conhost.exe starts to never end. I had taken to killing the conhost.exe processes, but they would simply restart when the iTunes services were running.
Basically, what this means is that when iTunes and related services were running in the background, HUNDREDS of processes that Windows starts and stops automatically would NEVER DIE. I once came home to find over 500 processes running, and before I figured out it was iTunes causing the problem, had to restart my computer every night when I got home, because the computer wouldn't respond. Each of those processes may have been small, but there were hundreds of them, taking up all available RAM.
In case anyone is curious (which I'm sure may happen), I'm running on a self-built Core 2 Quad 2.0GHz, 8GB of RAM, Windows 7 Ultimate x64, with somewhere near 3TB of storage space (approximately 60% of which is available). There are no current hardware issues, all drivers are up to date, and air flow through the case is taken care of by 8 case fans. Keeps my processor temps right around 100F (which is a lot cooler than they were over the summer).
The iTunes.exe version information says it is version 10.0.0.68. I know there's a 10.0.1 out now, but can't find out whether or not it resolves this issue.
Anyone have any ideas? This may be specific to Windows 7 x64; I haven't been able to find any solutions in my searching, both here and on Google.
Thanks.

Empty/corrupt library after upgrade/crash
Hopefully it's not been too long since you last upgraded iTunes, in fact if you get an empty/incomplete library immediately after upgrading then with the following steps you shouldn't lose a thing or need to do any further housekeeping. In the Previous iTunes Libraries folder should be a number of dated iTunes Library files. Take the most recent of these and copy it into the iTunes folder. Rename iTunes Library.itl as iTunes Library (Corrupt).itl and then rename the restored file as iTunes Library.itl. Start iTunes. Should all be good, bar any recent additions to or deletions from your library.
See iTunes Folder Watch for a tool to catch up with any changes since the backup file was created.
When you get it all working make a backup!
tt2

Where can I download the Linksys TFTP.exe utility?

Hello everyone, I am trying to upgrade this router I've got and was wondering if anyone knew where to get the Linksys TFTP.exe utility. Apparently Linksys have decided to re-organize their public FTP and the file is no longer anywhere to be found. I have been linked to ftp://ftp.linksys.com/pub/network/tftp.exe but I get a "550 Failed to Change Directory" error message. I've browsed through all of the directories on the public FTP and am at a loss. Can anyone help? Thanks a million.

I used the Netgear TFTP solution and it worked well: Netgear TFTP firmware recovery procedure: http://kb.netgear.com/app/answers/detail/a_id/22688/~/how-to-upload-firmware-to-a-wndr3700v2-router-using-tftp Download TFTP2.exe software from http://www.shadowsoftware.net/shadowgameworld/downloads/tftp2.exe You could also try the DD-WRT option: Subject "Recover From A Bad Flash" Article: https://www.dd-wrt.com/wiki/index.php/Recover_from_a_Bad_Flash#Recovering_with_TFTP "DrayTek Router Tools - OSX/Windows: This program will run all those pesky TFTP commands with a push of a button. Simply download and install DrayTek router tools from here and follow the instructions:" ftp://ftp.draytek.com/tools/Router_Tools/ ..... Para Dox

MonitoringHost.exe high CPU utilization SCOM 2012 R2

Hi
im currently having issues with one of my servers that the monitoringhost.exe is using alot of CPU resources and I havn't really found anything on SCOM 2012 R2 "Server 2012 R2, alot of the issues were related to SCOM 2007 "Server 2008
R2", are they the same?
any advice would be greatly appreciated.
Thanks

Hi,
Please install the latest update for your SCOM enviroment.
In addition, if only one of your server encounter this issue, please try to flush health service state and caches for that agent.
Regards,
Yan Li
Regards, Yan Li

SQL or Powershell query to get the SCOM management group id for SCOM 2007 R2 & 2012 / 2012 R2

Hi All,
Can any one provide me the SQL or Powershell query to get the SCOM management group id for SCOM 2007 R2 & 2012 / 2012 R2
I had a SQL query which will query the data from data warehouse and give the management group id but i have lost it for all 3 above.
Gautam.75801

Hi Gautam,
Hope it helps:
http://blog.tyang.org/2013/03/13/data-aggregation-field-became-empty-in-opsmgr-2007-linked-performance-report/
http://blog.tyang.org/2012/09/05/mp-authoring-targeting-rms-or-ms/
Natalya
### If my post helped you, please take a moment to Vote as Helpful and\or Mark as an Answer

Problem upgrading from SCOM 2012 SP1 to R2 (near impossible to uninstall SCOM agent from Management Server)

I'm trying to upgrade our SCOM 2012 SP1 environment to R2, but I have a heck of a problem getting there.
We currently have an test installation with SCOM 2012 SP1 with Management Server and Console on a single 2012 Standard server. The database are located on a remote server. The R2 setup stopped mid way through the setup, because the SCOM 2012 SP1 agent is
installed. And I could NOT remove it my any normal means. I've tried "misexec.exe /x productcode", the setup, powershell uninstall and so on. Nothing works, because the management server installation is blocking the uninstall. The uninstall says
I have to remove the management installation first. And that's not gonna happen.
I had to follow this guide to finally getting through the setup: http://www.opsman.co.za/forcibly-removing-a-scom-agent-that-cannot-be-uninstalled-by-normal-means/
In addition to searching for the agent msi install key in registry, and deleting everything. After I did this, the setup is working, and the SCOM management server, console and DB are up to date. However, the Microsoft Monitoring Agent are STILL there in
Control Panel. And this can NOT be the most healthy way of getting through the setup.
I'm about to upgrade to R2 in our production environment with 3 management servers, and I would hate to go through this sketchy process there as well. Just for the record, I have no idea why the agents are installed on our management servers.
Any of you have tips as to how I can get rid of the agents more gracefully?

Hi
Thanks for the replay guys!
None of those links touch my problem I'm afraid. I have followed the Upgrade guides you pointed to, step by step. But the setup does not Complete. There's problems during the actual software Upgrade of the management servers (3'rd step in the Upgrade page).
I've dived into the Application logs and installation logs, and as far as I can tell, it stops because it has trouble upgrading while the server has the 2012 SP1 Agent installed. I do not remember the actual error text right now, but I can get it in a few
days.
Anyhow, the setup DID move on once I removed most of the registry information of the agent installation. So. that leaves me to the conclusion that the agent IS in fact stopping the setup. Either the agent are malfunctioning, or the setup do not expect the
agent to be present on the management servers. I suspect the latter to be the the most plausible. At least until Yan Li told me this was normal.
So, I'm not sure what to think. I'm pretty much forced to remove this agents, as this is the only thing allowing me to continue the setup. At least untill I'm told otherwise. But I hate to do it this way. It's so dirty. The registry is pretty much cleaned,
but there's still Application files present, and the agent is still in the Control panel and can be started. It's not something I would like to do in our prodution environment.

SCOM agent install fails Error 80070035 - the network path was not found

I have deployed SCOM 2012 agents to most servers (2008, 2008 R2, 2012, 2012R2) in our estate but some either fail to install or are not monitored. I assume the two problems are related, but for now I am concentrating on the servers that fail completely.
Installation is from the Discovery Wizard and I have about 20 servers that fail of various server versions.
So looking at one specific server that is failing to install the agent - a 2008 standard service pack 2
The firewall in on and file and printer sharing is enabled for domain, remote administration is enabled for domain
I added a specific rule to allow TCP 5723 and 5724
DCOM is enabled
I can Ping the target server from the SCOM server by both name and FQDN - both return the same IP and our DNS server has only one entry for this server
I can browse to the admin share \\server\C$ from the SCOM Server, using the same account that I specify for the agent install that is a domain admin with rights on this server (and on the other servers the agent
did install to) and the server has plenty of disk space available
I am not sure what else to look at so would welcome any ideas
Thanks

Hi Petro,
I have a Agent installation failure cheat sheet, For your error 80070035 it is said to perform a manual installation.
So i would like to understand which version of SCOM is this ? 2007 R2 or 2012 or 2012 r2 ?
Also check if your agents have the WMI service started and enabled ?
Also if yours is a SCOM 2007 R2 do you have a RMS & MS in your management group ? If yes then Pushing the agent installation from MS may cause such issue. So would suggest you push the installation from RMS.
Also check if your Network connectivity meets the minimum requirement as recommended by SCOM. Below is applicable for Both SCOM 2007 R2 & SCOM 2012 & 2012 R2.
Component A
Component B
Minimum Requirement
Root management server or management server
Agent
64 Kbps
Root management server or management server
Agentless
1024 Kbps
Root management server or management server
Database
256 Kbps
Also check if you have any Anti virus / Firewall which is blocking the install / communication. If yes disabe or add the "Monitoringhost.exe to the safe list or what your feature is.
Check if you have another IP assigned to the NIC card and remove it tempraurly andchecl.
Also post the event logs of the Agents which are in not monitored state for analysis.
SCOM Agent installation failure error codes
Error
Error Code(s)
Remediation Steps
The MOM Server could not execute WMI Query "Select * from Win32_Environment where
NAME='PROCESSOR_ARCHITECTURE'" on computer server.domain.com
Operation: Agent Install
Install account: domain\account
Error Code: 80004005
Error Description: Unspecified error
80004005
1. Check the PATH environment variable. If the PATH statement is very long, due to lots of installed third party software - this can
fail. Reduce the path by converting any long filename destinations to 8.3, and remove any path statements that are not necessary.
2. The cause
could be corrupted Performance Counters on the target Agent.
To rebuild all Performance counters including extensible and third party counters in Windows Server 2003, type the following commands at a command
prompt. Press ENTER after each command.
cd
\windows\system32
lodctr /R
Note /R is uppercase.
Windows Server 2003 rebuilds all the counters because it reads all the .ini files in the C:\Windows\inf\009 folder for the English operating system.
How to manually rebuild Performance Counter Library values
http://support.microsoft.com/kb/300956
3. Manual agent install.
The MOM Server could not execute WMI Query "Select * from Win32_OperatingSystem" on
computer “servername.domain.com”
Operation: Agent Install
Install account: DOMAIN\account
Error Code: 800706BA
Error Description: The RPC server is unavailable.
8004100A
800706BA
1. Ensure agent push account has local admin rights
2. Firewall is blocking NetBIOS access
3. Inspect WMI health and rebuild repository if necessary
4. Firewall is blocking ICMP (Live OneCare)
5. DNS incorrect
The MOM Server failed to open service control manager on computer "servername.domain.com". Access is Denied
Operation: Agent Install
Install account: DomainName\User Account
Error Code: 80070005
Error Description: Access is denied.
80070005
80041002
1. Verify SCOM agent push account is in Local Administrators group on target computer.
2. On Domain controllers will have to work with AD team to install agent manually if agent push account is not a domain admin.
Disable McAfee antivirus during push
The MOM Server failed to open service control manager on computer "servername.domain.com".
Therefore, the MOM Server cannot complete configuration of agent on the computer.
Operation: Agent Install
Install account: DOMAIN\account
Error Code: 800706BA
Error Description: The RPC server is unavailable.
800706BA
1. Firewall blocking NetBIOS ports
2. DNS resolution issue. Make sure the agent can ping the MS by NetBIOS and FQDN. Make sure the MS can ping the agent by NetBIOS
and FQDN
3. Firewall blocking ICMP
4. RPC services stopped.
The MOM Server failed to acquire lock to remote computer servername.domain.com. This means there is already an agent management operation proceeding
on this computer, please retry the Push Agent operation after some time.
Operation: Agent Install
Install account: DOMAIN\account
Error Code: 80072971
Error description: Unknown error 0x80072971
80072971
This problem occurs if the LockFileTime.txt file is located in the following folder on the remote computer:
%windir%\422C3AB1-32E0-4411-BF66-A84FEEFCC8E2
When you install or remove a management agent, the Operations Manager 2007 management server copies temporary files to the remote computer. One
of these files is named LockFileTime.txt. This lock file is intended to prevent another management server from performing a management agent installation at the same time as the current installation. If the management agent installation is unsuccessful and
if the management server loses connectivity with the remote computer, the temporary files may not be removed. Therefore, the LockFileTime.txt may remain in the folder on the remote computer. When the management server next tries to perform an agent installation,
the management server detects the lock file. Therefore, the management agent installation is unsuccessful.
http://support.microsoft.com/kb/934760/en-us
The MOM Server detected that the following services on computer "(null);NetLogon" are not running. These services are required for push
agent installation. To complete this operation, either start the required services on the computer or install the MOM agent manually by using MOMAgent.msi located on the product CD.
Operation: Agent Install
Remote Computer Name: servername.domain.com Install account: DOMAIN\account
Error Code: C000296E
Error Description: Unknown error 0xC000296E
C000296E
1. Netlogon service is not running. It must be set to auto/started
The MOM Server detected that the following services on computer
"winmgmt;(null)" are not running
C000296E
1. WMI services not running or WMI corrupt
The MOM Server detected that the Windows Installer service (MSIServer) is disabled on computer "servername.domain.com". This service is
required for push agent installation. To complete this operation on the computer, either set the MSIServer startup type to "Manual" or "Automatic", or install the MOM agent manually by using MOMAgent.msi located on the product CD.
Operation: Agent Install
Install account: DOMAIN\account
Error Code: C0002976
Error Description: Unknown error 0xC0002976
C0002976
1. Windows Installer service is not running or set to disabled – set this to manual or auto and start it.
The Agent Management Operation Agent Install failed for remote computer servername.domain.com.
Install account: DOMAIN\account
Error Code: 80070643
Error Description: Fatal error during installation.
Microsoft Installer Error Description:
For more information, see Windows Installer log file "C:\Program Files\System Center Operations Manager 2007\AgentManagement\AgentLogs\servernameAgentInstall.LOG
C:\Program Files\System Center Operations Manager 2007\AgentManagement\AgentLogs\servernameMOMAgentMgmt.log" on the Management Server.
80070643
1. Enable the automatic Updates service…. Install the agent – then disable the auto-updates service if desired.
Call was canceled by the message filter
80010002
Install latest SP and retry. One server that failed did not have Service pack installed
The MOM Server could not find directory \\I.P.\C$\WINDOWS\. Agent will not be installed on computer "name". Please verify the required
share exists.
80070006
1. Manual agent install
Possible locking on registry?
http://www.sysadmintales.com/category/operations-manager/
Try manual install.
Verified share does not exist.
The network path was not found.
80070035
1. Manual agent install
The Agent Management Operation Agent Install failed for remote computer "name". There is not enough space on the disk.
80070070
1. Free space on install disk
The MOM Server failed to perform specified operation on computer "name". The semaphore timeout period has expired.
80070079
NSlookup failed on server. Possible DNS resolution issue.
Try adding dnsname to dnssuffix search list.
The MOM Server could not start the MOMAgentInstaller service on computer "name" in the time.
8007041D
80070102
NSlookup failed on server. Possible DNS resolution issue.
Verify domain is in suffix search list on management servers.
The Agent Management Operation Agent Install failed for remote computer "name"
80070643
1. Ensure automatic updates service is started
2. Rebuild WMI repository
3. DNS resolution issue
The Agent Management Operation Agent Install failed for remote computer "name". Another installation is already in progress.
80070652
Verify not in pending management. If yes, remove and then attempt installation again.
The MOM Server detected that computer "name" has an unsupported operating system or service pack version
80072977
Install latest SP and verify you are installing to Windows system.
Not discovered
Agent machine is not a member of domain
Ping fails
1. Server is down
2. Server is blocked by firewall
3. DNS resolving to wrong IP.
Fail to resolve machine
1. DNS issue
The MOM Server failed to perform specified operation on computer "name". Not enough server storage…
8007046A
1. This is typically a memory error caused by the remote OS that the agent is being installed on.
There are currently no logon servers available to service the logon request.
8007051F
1. Possible DNS issue
This installation package cannot be installed by the Windows Installer service. You must install a Windows service pack that contains a newer version
of the Windows Installer service.
8007064D
1. Install Windows Installer 3.1
The network address is invalid
800706AB
Possible DNS name resolution issue.
Tried nslookup on server name and did not get response.
Verify domain is in suffix search list on management servers.
The MOM Server failed to perform specified operation on computer servername.domain.com
80070040
1. Ensure agent push account has local admin rights
The MOM Server detected that the actual NetBIOS name SERVERNAME is not same as the given NetBIOS name provide for remote computer SERVERNAME.domain.com.
80072979
1. Correct DNS/WINS issue.
2. Try pushing to NetBIOS name
Gautam.75801

SCOM Gateway Server Issue

Hi All
I am having an issue related with my LAB Gateway server with SCOM 2012 SP1
I am having 2 Management server and 3 gateway server in my LAB. Now I am trying to install a new Gateway server. But its not showing in Management server list. Its showing as a SCOM Client. have any one faced this issue or any idea.
Your earlier response is appreciated.

Hi,
Whether the gateway server is listed under pending management, if it is, try to remove it from here before running the approval.
Please also go through the below similar thread for more details:
SCOM 2012 R2 Gateway installation error and no System Center Management server after install
http://social.technet.microsoft.com/Forums/en-US/ce6d0a73-c31d-4c26-85d4-d3cce35d48c3/scom-2012-r2-gateway-installation-error-and-no-system-center-management-server-after-install?forum=operationsmanagerdeployment
Please follow the below steps:
1) Validate that the gateway server can ping the Management Server that it will need to communicate with and can telnet to port 5723. Also validate that the OpsMgr Management Server can ping the Gateway server. If traffic doesn’t route between these systems,
or they cannot resolve each others names, or they cannot communicate on port 5723 the Gateway will not function.
2) Install the gateway server from the OpsMgr media (Gateway management server).
When installing, choose the Management Server that we have determined will be the primary Management Server for gateway servers in the environment and configure the gateway to run as local system.
3) Next if required in the OpsMgr console we delete the agent from pending management if it appears in that view.
4) Perform the approval of the gateway by transferring the Microsoft.EnterpriseManagement.GatewayApprovalTool.exe from the installation media to the appropriate path to run it from (c:\program files\System Center Operations Manager 2012\Server is the default
location)
Regards,
Yan Li
Regards, Yan Li

SCOM Agent install \ deployment query?

Hi All
I have a query regards best practices. Within our environment we will have a number of Build Environments (all within the same domain), which will involve servers being built, decommissioned and rebuilt for application testing teams.
Query is how best to handle the install\life-cycle of the SCOM Agent with regards to this scenario?
Just looking to see if others have had experience of this type of scenario and best practices \ experiences etc
Any thoughts much appreciated.
Kind Regards
Andrew

Just have a couple of questions/suggestions:
Do the different servers have some sort of naming convention ie:
Prod servers have: PRD in the name
dev servers have: DEV in the name
ect.... If so then my suggestion is to create a number of groups ie Prod Servers, Dev Servers, Test Servers ect. and have these groups auto populate. You can then configure overrides for these groups for alerts
to manage alert volume/escalations.
As for install are these servers windows server/ unix servers or a mix?
Number of ways you could try managing installs is to script the install (Google SCCM SCOM agent deployment script for some hints)
Consider if you want to auto approve agents or manually approve them so you know when servers are being added or removed.
If servers are being removed you could look at scripting a removal of the server from SCOM (have a look at http://social.technet.microsoft.com/Forums/en-US/c4dcfce6-b241-4435-8f8b-1276814c455e/scom-2012-powershell-command-to-remove-agent)
If you could detail what your setup is or what you would like to be able to do we could make more suggestions.
Cheers,
Martin
Blog:
http://sustaslog.wordpress.com
LinkedIn:
Note: Posts are provided “AS IS” without warranty of any kind, either expressed or implied, including but not limited to the implied warranties of merchantability and/or fitness for a particular purpose.

SCOM Agent Causing Login errors with LSAsrv

Bit of background:
We have numerous servers within a separated secure environment which are getting flagged as having failed login attempts every 4 hours. The exact same issue is presented in our normal estate.
Initially it presents itself as an error in the event log with EventID 6037 and the following information (this is what is flagging in our security system).
The program svchost.exe, with the assigned process ID 1876, could not authenticate locally by using the target name HOST/.. The target name used is not valid. A target name should refer to one of the local computer names, for example, the DNS host name.
This actually turns out to be controlling RemoteRegistry.
The following link is a work around for this, but preferably, I don't want to disable loop back checking or strict name checking.
https://social.technet.microsoft.com/Forums/systemcenter/en-US/05cedf19-cd02-4c26-9651-4b5d5f46d58b/event-6037-lsasrv?forum=operationsmanagergeneral
(For some reason I now can't find the actual MS KB describing the work-around)
The other alternative is to then amend a registry key for BackConnectionHostNames [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0] (Sorry can't find the KB where I saw the work around for this now). However, given the number of servers affected,
I'm reluctant to go down this route.
I've disabled the SCOM agent and this is definitely the culprit; so the final option is to work out which ManagementPack has been incorrectly setup and then either override it or amend it for the servers.
I've run ETL tracing on one of the servers and get the following output (I believe the two relevant lines are the [13080] [8644] lines, and the timings coincide exactly with the LSASrv.exe eventIDs.
[1] [13080] [8644] [03/09/2015-15:10:06.978] [HealthServiceCommon] [] [Warning] [] [CFileUtility::_CheckAndCreateDirectory] [FileUtility_cpp202]GetFileAttributesEx on path "C:\Program Files\System Center Operations Manager 2007\Health Service State\Monitoring Host Temporary Files 59\2438\" failed with code 2(ERROR_FILE_NOT_FOUND).
[0] [13080] [8644] [03/09/2015-15:10:07.000] [HealthServiceCommon] [] [Warning] [] [CFileUtility::_CheckAndCreateDirectory] [FileUtility_cpp202]GetFileAttributesEx on path "C:\Program Files\System Center Operations Manager 2007\Health Service State\Monitoring Host Temporary Files 59\2434\" failed with code 2(ERROR_FILE_NOT_FOUND).
[1] [13080] [8644] [03/09/2015-15:10:07.012] [HealthServiceCommon] [] [Warning] [] [CFileUtility::_CheckAndCreateDirectory] [FileUtility_cpp202]GetFileAttributesEx on path "C:\Program Files\System Center Operations Manager 2007\Health Service State\Monitoring Host Temporary Files 59\2430\" failed with code 2(ERROR_FILE_NOT_FOUND).
[1] [13080] [8644] [03/09/2015-15:10:07.017] [ModulesLibrary] [] [Error] [] [MOMXmlSupport::LoadElement] [MOMXmlSupport_cpp823]`VariantChangeTypeEx(&bstrVar, &bstrVar, LOCALE_INVARIANT, 0, VT_R8)` failed, returning ERROR: {hr= 0x80020005(DISP_E_TYPEMISMATCH)}
[0] [13080] [12132] [03/09/2015-15:10:07.038] [ModulesPerformance] [] [Error] [] [McPerformance::Snapshot::getNextObject] [McPerfSnapshot_cpp2115]makePerfPtr returned NULL
[2] [13080] [10612] [03/09/2015-15:10:07.134] [ModulesLibrary] [] [Error] [] [MOMXmlSupport::LoadElement] [MOMXmlSupport_cpp823]`VariantChangeTypeEx(&bstrVar, &bstrVar, LOCALE_INVARIANT, 0, VT_R8)` failed, returning ERROR: {hr= 0x80020005(DISP_E_TYPEMISMATCH)}
[2] [13080] [9540] [03/09/2015-15:10:07.138] [ModulesLibrary] [] [Error] [] [MOMXmlSupport::LoadElement] [MOMXmlSupport_cpp823]`VariantChangeTypeEx(&bstrVar, &bstrVar, LOCALE_INVARIANT, 0, VT_R8)` failed, returning ERROR: {hr= 0x80020005(DISP_E_TYPEMISMATCH)}
[0] [13080] [8644] [03/09/2015-15:10:07.451] [ModulesCommon] [] [Warning] [] [CModuleUtility::IsLocalMachine] [ModuleUtility_cpp135]Unable to find the address for the specified machine (.), assuming remote monitoring, error = 11002(WSATRY_AGAIN)
[0] [13080] [12628] [03/09/2015-15:10:07.460] [ModulesLibrary] [] [Error] [] [MOMXmlSupport::LoadElement] [MOMXmlSupport_cpp823]`VariantChangeTypeEx(&bstrVar, &bstrVar, LOCALE_INVARIANT, 0, VT_R8)` failed, returning ERROR: {hr= 0x80020005(DISP_E_TYPEMISMATCH)}
[0] [13080] [8644] [03/09/2015-15:10:07.769] [ModulesCommon] [] [Warning] [] [CModuleUtility::IsLocalMachine] [ModuleUtility_cpp135]Unable to find the address for the specified machine (.), assuming remote monitoring, error = 11002(WSATRY_AGAIN)
[0] [13080] [7060] [03/09/2015-15:10:10.097] [ModulesExpressionEvaluator] [] [Error] [] [RegExExpression::Evaluate] [MOMExprEvaluator_cpp2787]`EXPR: m_pValue->Evaluate(pitfEvaluateValue, pitfReportError, pitfProcessTrace, &spValue) FAILED` {setting hr= HRESULT=80FF0059}
So essentially my question is now that I've narrowed it down to it being a management pack of SCOM, whats the best process to work out which particular management pack is causing this?
Is there a way to get a list of all management packs that apply to a computer object? If I can get this, I can then work out which ones are on a 4 hour timer to narrow the list down and then systematically create overrides to work out which one it is.
Kind Regards,
Kevin

Hi,
If there is something wrong with the agent, we should get alerts in SCOM console for this agent. Please also check is there any errors or warnings in operation manager event log on this agent.
And here are two links about geting monitors, rules runnin on an agent, hope it can be helpful for you
What Monitors, Rules and Discoveries are running on an OpsMgr Agent?
http://blogs.technet.com/b/stefan_stranger/archive/2010/11/30/what-monitors-rules-and-discoveries-are-running-on-an-opsmgr-agent.aspx
How to View All Rules and Monitors Running on an Agent-Managed Computer
https://technet.microsoft.com/en-us/library/hh212748.aspx?f=255&MSPPError=-2147217396
Regards,
Yan Li
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected]

Conhost.exe & Powershell.exe utilizing more in SCOM agent server

Similar Messages

Maybe you are looking for