Event id 31551 in scom 2012 server

Dear Team,
We are getting continuously the following error event id 31551 on our SCOM 2012 SP1 server as below.
Please let me know how to resolve this.
Log Name:      Operations Manager
Source:        Health Service Modules
Date:          02/01/2015 13:52:42
Event ID:      31551
Task Category: Data Warehouse
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      LOXXXXXXX.XXXX
Description:
Failed to store data in the Data Warehouse. The operation will be retried.
Exception 'SqlException': Cannot open database "OperationsManagerDW" requested by the login. The login failed.
Login failed for user 'WREN\SVC-SC-OM12-DW'. 
One or more workflows were affected by this.  
Workflow name: Microsoft.SystemCenter.DataWarehouse.CollectEntityHealthStateChange 
Instance name: LONSCOM001.wren.co.uk 
Instance ID: {0F89A4D1-B7D5-8658-29A8-E0CAFAA602CF} 
Management group: Brit Insurance
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Health Service Modules" />
    <EventID Qualifiers="49152">31551</EventID>
    <Level>2</Level>
    <Task>3</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2015-01-02T13:52:42.000000000Z" />
    <EventRecordID>933223</EventRecordID>
    <Channel>Operations Manager</Channel>
    <Computer>LOXXXXXXX.XXXX</Computer>
    <Security />
  </System>
  <EventData>
    <Data>Brit Insurance</Data>
    <Data>Microsoft.SystemCenter.DataWarehouse.CollectEntityHealthStateChange</Data>
    <Data>LONSCOM001.wren.co.uk</Data>
    <Data>{0F89A4D1-B7D5-8658-29A8-E0CAFAA602CF}</Data>
    <Data>SqlException</Data>
    <Data>Cannot open database "OperationsManagerDW" requested by the login. The login failed.
Login failed for user 'WREN\SVC-SC-OM12-DW'.</Data>
  </EventData>
</Event>
Saravana Raja

Hi,
Based on the error message, the login failed for user 'WREN\SVC-SC-OM12-DW', have you changed its password? Please make sure the account can access the SQL server where your data warehouse installed.
Or we may reset the account. And the article below should be helpful for changing password for data warehouse account:
Changing Password on SCOM Data Warehouse run as accounts
http://blogs.technet.com/b/randymonteleone/archive/2010/03/12/changing-password-on-scom-data-warehouse-run-as-accounts.aspx
Regards,
Yan Li
Please remember to mark the replies as answers if they help and unmark them if they provide no help.

Similar Messages

  • Event ID 26319 on SCOM 2012 R2 Management server with RMS emulator role

    Hi all,
    Two weeks ago we've setup a new SCOM 2012 R2 environment.
    We now have the problem that event 26319 is logged every 5 minutes.
    An exception was thrown while processing GetUserRolesForOperationAndUser for session ID uuid:dca9765e-37a4-40fc-bb9e-575f278447f9;id=63.
     Exception message: Value does not fall within the expected range.
     Full Exception: System.ArgumentException: Value does not fall within the expected range.
       at Microsoft.Interop.Security.AzRoles.IAzApplication2.InitializeClientContextFromStringSid(String SidString, Int32 lOptions, Object varReserved)
       at Microsoft.EnterpriseManagement.Mom.Sdk.Authorization.AzManHelper.GetScopedRoleAssignmentsForUser(Int32 operationNumericId, String userName)
       at Microsoft.EnterpriseManagement.Mom.Sdk.Authorization.AuthorizationService.GetUserRolesForOperationAndUser(Guid operationId, String userName)
       at Microsoft.EnterpriseManagement.ServiceDataLayer.SecurityConfigurationService.GetUserRolesForOperationAndUser(Guid operationId, String userName)
       at Microsoft.EnterpriseManagement.Mom.ServiceDataLayer.SdkDataAccessBackCompatProxy.GetUserRolesForOperationAndUser(Guid operationId, String userName)
    In the previous weeks I've imported some management packs and did some changes in the user roles.
    I've now deleted all custom created user roles but the event is still being logged.
    Where does the 'Value does not fall within the expected range.'
    message points to ?
    Is this related to a imported MP ? I've deleted the built-in administrator user and replaced it by an admin group.
    Where do I start to troubleshoot this issue ?
    Kind Regards,
    J. Monnens

    Yes, it's related to import MP.
    For this issue,  KB980862 - Event ID 26319 is logged when you import a management pack in Operations Manager 2007 R2
    Also you can check below link
    http://thoughtsonopsmgr.blogspot.com/2011/08/eventid-26319-exception-was-thrown.html
    Please remember, if you see a post that helped you please click "Vote As Helpful" and if it answered your question, please click "Mark As Answer"
    Mai Ali | My blog: Technical | Twitter:
    Mai Ali

  • SCOM 2012 collect Windows Audit logs and forward them to a Linux Syslog server

    Hello:
    1. We have a SCOM 2012 server.
    2. We have SNARE agents for PCI systems, but now we want to save money by gathering all events for all Windows servers using its native features.
    3. We also have a centralized Linux server running SYSLOG which aggregates the logs to our Dell LogVault retention appliance (for PCI purposes)
    Thus, my question:
    In effort to remove the SNARE agents from the windows servers, can we implement Audit Collections Services (ACS) in the windows environment so that they collect/forward audit/event logs to the SCOM 2012 server and then SCOM forwards the events to the centralized
    syslog Linux server? In which case they are aggregated to the Dell appliance.
    We prefer to use the Linux syslog as the centralized log server but would like to know how to go about implementing the solution above.
    Many thanks,
    Robert Perez-Corona

    Hi,
    Here is a thread about how to make SCOM 2012 work as a syslog server, hope this can be helpful for you:
    https://social.technet.microsoft.com/Forums/en-US/524ea527-c069-40f9-96ef-026a4aa06fe9/make-scom-2012-a-syslog-server?forum=operationsmanagergeneral
    Regards,
    Yan Li
    Regards, Yan Li

  • Issues with SCOM 2012 Agent on Red Hat 5 Server

    We are running SCOM 2012 server and have deployed the agent successfully to a number of Red Hat Linux servers. I am having an issue on about a quarter of the hosts, in that they appear as HEALTHY but are Grayed out and not green. When I look at the /var/opt/microsoft/scx/log/omiserver.log
    file I see:
    WARNING: wsman: authentication failed for user scom2012
    I have verified that the system account is setup with the correct password and the runas account is setup with the correct password (i am able to deploy the agent from the SCOM server using it, so the passwords DO match).
    Any ideas? 

    We are running SCOM 2012 server and have deployed the agent successfully to a number of Red Hat Linux servers. I am having an issue on about a quarter of the hosts, in that they appear as HEALTHY but are Grayed out and not green. When I look at the /var/opt/microsoft/scx/log/omiserver.log
    file I see:
    WARNING: wsman: authentication failed for user scom2012
    I have verified that the system account is setup with the correct password and the runas account is setup with the correct password (i am able to deploy the agent from the SCOM server using it, so the passwords DO match).
    Any ideas? 
    I've seen this on a few systems here when the agent has been upgraded but the old agent process does not die off.  Just to rule it out, pick a node, make sure there are no instances of scxcimserver or scxcimprovagt and then start the agent and
    see if the issue goes away.  I've also seen wsman authentication failures related to the libssl issue that was fixed in yesterday's release.

  • Minimum value of UNIX/Linux Heartbeat Monitor in scom 2012

    Hi,
    In my environment, we have SCOM 2012 server, when I change values of UNIX/Linux
    Heartbeat Monitor: Interval , Missed
    Heartbeats and Missed Heartbeats from 300 , 630 ,2 to 120, 150, 1 in event viewer shows Error
    11112:
    The Microsoft Operations Manager Consolidate Module failed to initialize because the specified compare count is less than the minimum
    Compare count value : 1
    Minimum value allowed : 2
    One or more workflows were affected by this.
    What is the best minimum value?
    Thanks

    You've ended up in the wrong forum. mostly service manager here, Ops manager is
    over there https://social.technet.microsoft.com/Forums/en-US/home?category=systemcenteroperationsmanager. 
    That being said, the error you reference is somewhat abstracted from the values you adjusted. the error you posted is the system comparison operator complaining that it only has one thing to compare, typically you need two things to do a comparison.
    Here is a person running into a similar problem with the lync MP, where it was trying to compare the site assignment of two systems, but the environment only has one system.
    http://thoughtsonopsmgr.blogspot.com/2014/09/lync-server-2010-mp-bug-alert.html. is it possible this is an outgrowth of something similar in your unix environment? Do you have any more details about the specific health XML that's failing?

  • Manage DPM servers, running DPM jobs, etc from SCOM 2012 SP1

    Hi,
    Little background about our systems.
    We have a dedicated SCOM 2012.
    We have 22 DPM servers, DPM 2010 and DPM 2012 (we are upgrading to 2012 SP1, we have customers that still using Windows 2003 servers) to be managed by SCOM
    We have a few DPM servers that are not located on the same domain as the SCOM server (untrusted domain).
    Some problem we have
    1. When we try to manage the DPM servers from the SCOM server.
    From SCOM 2012 server I can “Manage DPM server” that are located in our domain but I cannot manage DPM servers located on untrusted domains (customer’s domains). I receive the below error message
    "Unable to connect to <untrusted domain DPM SERVER> ID: 948
    Verify that the DPM service is running on this computer"
    I guess it’s because the account that I’m using to run SCOM server located in our domain and does not have the permission to open the DPM console on the untrusted domain. So I wonder if it is possible to use “RUN AS profiles/accounts”
    to solve this issue, and how?
    2. I have installed SCOM 2012 Operations Manager Console on my computer and then installed DPM Central Console.
    When I select one dpm server (from my computer), that is on our domain, and then click “Manage DPM server” I got this error message
    "Unable to connect to <our domain DPM SERVER> ID: 33333
    1. Verify that the DPM service is running on this computer (YES)
    2. Verify that the current user has been added to at least one of the roles in Operations Manager. (YES)
    3. Open Operations Manage console and then try launching the DPM Console (THAT IS WHAT I AM TRYING TO DO)
    4. If you have re-imported the management pack recently, the role configuration may be corrupt. Open the DPM-specific roles and check if the roles have task assigned to them. If not, delete the roles and recreate the...."
    When I click on “Get more information” I get this error message.
    "You don´t have access permission to connect to the System Center Data Access service on <SCOM SERVER>. Please check if it is a permission issue".....
    Do you know why I cannot connect to any DPM server on our own domain?
    Why do I get access permission error on my computer but not on the SCOM server (using the same account)?
    What should we do to be able to connect to DPM servers that are on untrusted domain?
    3. Is it possible to see Last Recovery Point date/time in SCOM alerts?
    For me it is the first thing I look at. If it has failed 10 min ago it is not critical.
    But if it is a date and time more than 1 day old, then it is critical.
    I hope someone can help us with this
    Br
    SvBoho

    Hi,
    To manager DPM, I think we may need to add the account to local admin group of the DPM server.
    In addition, to connect to DPM the user needs permissions to DPM/SQL Server DPMDB.
    For your DCs, have your enabled agent proxy option? If not, please enable that option for all DCs.
    To monitor DPM with SCOM, please also go through the below links:
    http://kevingreeneitblog.blogspot.com/2011/10/managing-and-monitoring-system-center.html
    http://damatisystemcenter.com/2013/10/14/monitor-data-protection-manager-2012-using-scom-2012-sp1/
    Please Note: Since the web site is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information.
    Regards,
    Yan Li
    Regards, Yan Li

  • Which type of SQL DB do I need for SCOM 2012?

    Hello everyone,
    We would like to install a SCOM 2012 Server for reporting and alerting of our Exchange and Lync Server.
    Our guys from database management asks me, what type of SQL DB do I need. "An SQL DB with 100GB" shouldn't be enough :-( I'm not very familiar with SQL.
    So, which informations could be missing?
    Thanks in advance and best regards
    Daniel
    Beste Grüße

    Daniel,
    usually Standard Edition is enough and included in the SCOM (agent) license.
    Here you find more about requirements:
    https://technet.microsoft.com/en-us/library/dn249696.aspx
    SQL specific:
    Check for updates and hotfixes for Microsoft SQL Server. See
    SQL Server in System Center 2012 R2.
    Operations Manager does not support hosting its databases or SQL Server Reporting Services on a 32-bit edition of SQL Server.
    Using a different version of SQL Server for different Operations Manager features is not supported. The same version should be used for all features.
    For SQL Server collation settings, see
    SQL Server in System Center 2012 R2
    The SQL Server Agent service must be started, and the startup type must be set to automatic.
    The db_owner role for the operational database must be a domain account. If you set the SQL Server Authentication to Mixed mode, and then try to add a local SQL Server login on the operational database, the Data Access service will not be able to start.
    For information about how to resolve the issue, see
    System Center Data Access Service Start Up Failure Due to SQL Configuration Change
    If you plan to use the Network Monitoring features of System Center 2012 R2 Operations Manager, you should move the tempdb database to a separate disk that has multiple spindles. For more information, see
    tempdb Database.
    You should have a look at the sizing calculator:
    http://download.microsoft.com/download/C/A/6/CA60425C-950B-456E-986C-C5F2FCD5668D/System%20Center%202012%20Operations%20Manager%20Sizing%20Helper%20Tool%20v1.xls
    Good luck,
    Patrick
    Please remember to click “Mark as Answer” on the post that helped you.
    Patrick Seidl (System Center and Private Cloud)
    Website: http://www.syliance.com
    Blog: http://www.systemcenterrocks.com

  • SCOM 2012: Agent Proxy not enabled.

    I am seeing Critical Severity alerts on my SCOM 2012 Server stating:
    "The agent was not able to submit data on behalf of another computer because agent proxy is not enabled. Details:Health service ( 0C43A2D6-628F-D150-9553-8EABFECA600C ) should not generate data about this managed object ( 716D31EF-F34C-A4E3-1A16-3B8B75E85C0D
    I have about 8 servers with this error. All of which have had Proxy turned on in SCOM ( Administration -> Agent Managed -> <agents in question> -> Properties -> Security Tab -> Checked "Allow this agent to act as a proxy...".
     All of these servers are on the same domain as the SCOM server (we only have 1 domain).
    Thanks,

    For what it's worth I'm experiencing this issue. I've closed out the alerts and watched them pop back up later.
    The agent was not able to submit data on behalf of another
    computer because agent proxy is not enabled. Details:Health service (
    774FAEE6-003E-7CAC-FC02-676C0D9F675E ) should not generate data about this
    managed object ( 13354EE4-F0F9-DF55-88F0-271F30A70AAB ).
    PS C:\> Get-SCOMAgent |Where-Object -Property id -eq '13354EE4-F0F9-DF55-88F0-271F30A70AAB'
    PS C:\> Get-SCOMAgent |Where-Object -Property id -eq '774FAEE6-003E-7CAC-FC02-676C0D9F675E'
    PS C:\>
    This alert was generated about an hour ago, I have 160 agents installed.
    My guess is...well I don't have a good guess. any help about this would really be appreciated.
    Jeffrey S. Patton Jeffrey S. Patton Systems Specialist, Enterprise Systems University of Kansas 1001 Sunnyside Ave. Lawrence, KS. 66045 (785) 864-0242 | http://patton-tech.com

  • SCOM 2007 server decommission

    Hi All,
    We have built new scom 2012 server so we have to uninstall all SCOM 2007 components . Please help me how to remove the SCOM 2007 RMS, MS , Reporting service and DB and DW. Also please tel me what are things
    i need to do before uninstallation of SCOM 2007

    1) Uninstall all agents.
    2) Uninstall all core components (MS, RMS, Reporting). Potentially decommission the servers if they were dedicated to SCOM.
    3) If you are looking to reinstall at some time or want to use the SQL Servers for something else then delete the databases and logins for the SCOM service accounts
    4) Disable the SCOM service accounts. You can delete them but I'd prefer to disable them in the first instance in case they have been reused elsewhere. If something breaks then you can just re-enable the account
    5) If you have deployed the AD Management Pack then delete the OpsMgrLatencyMonitors container
    6) If you used AD Integration then remove the container that this creates from AD
    7) If you have configured exchange to relay messages from the Management Server then you can remove this configuration in Exchange
    8) Network devices that have been configured to use SCOM can be reconfigured (security removed) to clean up the ACLs
    9) Ideally, if you have created Run As Accounts for specific applications e.g. SQL then you might need to remove these from the applications themselves e.g. remove the SQL logins used for SQL monitoring
    Roger

  • Remove SCVMM2012 Integration in SCOM 2012

    Hi @all
    i had a SCOM 2012 - SCVMM 2012 integration ... and now i re-installed the SCVMM Server with Windows Server 2012 and SCVMM 2012 SP1 ... i thought everything´s fine .. but now i noticed, that system discovery in SCOM 2012 does not work .. and i guess that
    is caused by the old SCVMM Integration ...
    how can i remove an obsolete scvmm 2012 integration on SCOM 2012 Server  ? ...

    Hi
    Before removing the old VMM server, you really needed to go into Settings and System Center Integrations and remove the SCOM integration. That would have removed the conectors from SCOM as well.
    Do you still see all the old VMM Connectors in SCOM?
    In VMM, have you tried reconfiguring the SCOM integration? Do you see a green tick or red cross? If not, then try re-adding to see if the new integration will work. You'll also need to upgrade Management Packs in SCOM.
    Regards
    Graham
    Regards Graham New System Center 2012 Blog! -
    http://www.systemcentersolutions.co.uk
    View OpsMgr tips and tricks at
    http://systemcentersolutions.wordpress.com/

  • SCOM 2012 R2 Exchange Correlation Service , we receive almost at every day in the Event log Application the Event720

    HI
    Since the SCOM was Upgrade to R2 
    Almost at every Day, we receive in the Event log application the Event 720 from the correlation service Source MSExchangeMonitoring Correlation
    This arrives always around 7:20AM, someday is at 7:19, other at 7:21. It is always approximately at the same hour, but we never have any problem during weekend
    The description of the Event
    Exceeded maximum time (15 minutes) to wait for completion of all CorrelateBatchTask threads.
    After that the correlation stop to work. At the Same time if we tried to open the SCOM Console on that server we was unable to open it. Also we was not able to open the SCOM PowerShell
    And also we cannot from that server to get which server is the RMS if we run get-SCOMRMSEmulator .  (This the RMS Server)
    When this arrive, the only thing we found, it to reboot the server or restart de SCOM service, after the Reboot the Correlation begin to work
    We got also many Event 714 Critical and after this Event 711 Warning
    Thank

    Have a look at: https://social.technet.microsoft.com/Forums/systemcenter/en-US/e75e84d9-0c9e-4d83-b3da-45a143757f85/exchange-2010-monitoring-with-scom-2012-correlation-service-issue
    One user reported an issue with the exchange correlation engine after upgrade and said that:
    I had issues with the corellation engine after upgrading scom 2012 to R2.
    The MomBidLdr.dll version changed in the SCOM directories, and needs to be updated in the:
    C:\Program Files\Microsoft\Exchange Server\v14\Bin directory.
    That seemed to stop the errors for me.
    Some troubleshooting steps listed here also:
    https://technet.microsoft.com/en-us/library/ff360495(v=exchg.140).aspx
    Cheers,
    Martin
    Blog:
    http://sustaslog.wordpress.com 
    LinkedIn:
    Note: Posts are provided “AS IS” without warranty of any kind, either expressed or implied, including but not limited to the implied warranties of merchantability and/or fitness for a particular purpose.

  • XML document could not be created because server memory is low( SCOM 2012 R2).

    Hi 
    I am facing below issue in the scom 2012 r2.
    please find the error below 
    On SCOM MS:
    Alert name :Data Warehouse relationship synchronization process failed to write data 
    Alert description :Data Warehouse relationship synchronization process failed to write data to the Data Warehouse database. Failed to store data
    in the Data Warehouse. The operation will be retried.
    Exception 'SqlException': Sql execution failed. Error 6624, Level 16, State 1, Procedure sp_xml_preparedocument, Line 1, Message: XML document could not be created because server memory is low. Use sp_xml_removedocument to release XML documents.
    Event id in Operation log:  
    Event id :33333 
    Data Access Layer rejected retry on SqlError:
     Request: DataWarehouseSynchConfigChangeTypeGet -- (InstalledManagementPackXml=<ManagementPacks><ManagementPack>7b9f4239-7351-e72b-4ce4-d6c56ddb401d</ManagementPack><ManagementPack>848edb97-9da5-e2ae-24d4-56...),
    (RETURN_VALUE=-6)
     Class: 16
     Number: 6624
     Message: XML document could not be created because server memory is low. Use sp_xml_removedocument
    to release XML documents.
    ON SCOM DB server:
    SQL version : SQL 2012 SP1 X64 bit Host all SCOm db (SCOM DB,SCOM DW,Reporting)
    Ervent id : 28005 ,Application log,source: MSSQLSERVER
    Please suggest me in this regard.
    Thanks 
    sridhar v

    For fix error 33333, you can refer below links
    http://opsmgradmin.blogspot.com/2011/05/scom-event-id-33333-in-scom-from-source.html
    http://systemcenterblog.blogspot.com/2009/11/error-id-33333-data-access-layer.html
    Please remember, if you see a post that helped you please click "Vote As Helpful" and if it answered your question, please click "Mark As Answer"
    Mai Ali | My blog: Technical | Twitter:
    Mai Ali

  • Exchange Server 2013 Management Pack in SCOM 2012, can not update healthset status automatically

    Hi, all
    I have Exchange Server 2013 and SCOM 2012 installed. I have imported Exchange Server 2013 Management Pack to SCOM 2012. Now I have a question that when there is a service not healthy, I can find the red alert in my alert view with the Exchange 2013 server,
    but after the service is healthy automatically, the red alert is still there. I can only make it become green healthy status after reseting the healthset status in the healthset explorer.
    Does anyone know how to make the server become green healthy status automatically after the monitor is healthy?
    Thank you.
    Nile

    Hi,
    How many Exchange Servers do you have? Does this issue only occur on one Exchange Server?
    Please check the application log on the problematic Exchange server and see whether there are any related event error.
    Regards,
    Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact
    [email protected]
    Simon Wu
    TechNet Community Support

  • SCOM 2012 SP1 SQL Server 2008 R2 Clustering Monitoring?

    We have a new print management system that was setup using SQL server 2008 R2 clustering.  Right now we have SQL MP (monitoring)(discover) 6.3.173.1.  They had a failover occur a week ago and SCOM didnt throw any alerts.  As a temporary
    fix, I found some correlated events and setup a monitor for those events on the servers.  However, the system owner wants to know if there is a MP that will monitor for a SQL cluster failover event.  I have looked and looked and cant seem to find
    anything that gives a whole lot of detail on this.
    Thanks
    EFD
    Warm Fuzzies!

    Yes, you can monitor SQL Cluster 2008 using SCOM 2012 SP1. but you need to install SQL MP and Windows Cluster MP and Enable proxy Agent on physical nodes.
    You can refer below link {it's same for SCOM 2012}
    http://blogs.technet.com/b/birojitn/archive/2010/04/14/sql-server-2008-cluster-monitoring.aspx
    Please remember, if you see a post that helped you please click "Vote As Helpful" and if it answered your question, please click "Mark As Answer"
    Mai Ali | My blog: Technical | Twitter:
    Mai Ali

  • SCOM 2012 - Event ID 6024 (Launching Restart Health Service. Health Service exceeded Process\Handle Count or Private Bytes threshhold.)

    I am getting event ID 6024 (LaunchRestartHealthService.js : Launching Restart Health Service. Health Service exceeded Process\Handle Count or Private Bytes threshhold.) within an interval ranging from 12-17 minutes.
    I am using SCOM (2012 SP1 and 2012 R2) on Windows Server (2008 R2 / 2012 / 2012 R2).
    This issue is occurring only on agent managed computer (acting as proxy and discover managed objects on other computers setting is enabled) which i am using for monitoring my device. All discovery scripts (powershell) and monitors are targeted on this agent
    managed computer.
    There are total 80 discoveries and 900 monitors. 55 discoveries and 550 monitors are enabled by default and rest all are disabled.
    I am seeing event id 6024 frequently only on agent managed computer. Can anyone help me to resolve this issue.
    Thanks,
    Mukul

    To fix issue 6024, you can follow below steps:
    1. Open SCOM console. Go to Monitors -> Agent -> Entity Health -> Performance -> Health Service Performance -> Health Service State.
    2. Double click Health Service Handle Count Threshold monitor and go to Overrides page.
    3. Click Override -> For a specific object of Class: Agent. Select the affected SCOM agent QMXServer.
    4. Check on the parameter Agent Performance Monitor Type - Threshold. Change the default value 2000 to an appropriate value, like 4000. You can check the Health service handle count alert in SCOM console to get the value when the alert is generated. You
    can also launch the health explorer against QMXServer to check the value when the monitor state is changed from healthy to critical.
    Also you can refer below links
    http://blogs.technet.com/b/omx/archive/2013/10/17/health-service-restarts-on-service-manager-servers-with-scom-agents.aspx
    Please remember, if you see a post that helped you please click "Vote As Helpful" and if it answered your question, please click "Mark As Answer"
    Mai Ali | My blog: Technical | Twitter:
    Mai Ali

Maybe you are looking for