.NET Questions and Solutions

Symptoms
After you configure a Collect Specific Events (Collection) rule in Microsoft Operations Manager (MOM) 2005, the following symptoms occur:The MOM service (MOMservice.exe) stops unexpectedly. If you try to start the MOM service, you receive the following error message:

Could not start the MOM service on Local Computer.Error 1067:The process terminated unexpectedly. The following events are logged in the Application log:
Event Type:Error
Event Source:Microsoft Operations Manager
Event Category: None
Event ID:9014
Date:date
Time:time
User:N/A
Computer: ComputerName
Description: The Microsoft Operations Manager service (MOMService.exe) terminated due to an unhandled exception.Itwill attempt to restart itself.
For more information, see Help and Support Center at<http://go.microsoft.com/fwlink/events.asp>.
Event Type:Error
Event Source:Microsoft Operations Manager
Event Category: None
Event ID:9015
Date:date
Time:time
User:N/A
Computer: ComputerName
Description: The Microsoft Operations Manager service (MOMService.exe) received an unexpected exception.
Thread Id: 0xf40
Thread Name: MSB3904
Exception code: 0×00000000c0000005
Exception description: Access Violation
Exception address: 025EB79C
Exception flags: 0×0
For more information, see Help and Support Center at<http://go.microsoft.com/fwlink/events.asp>.
Resolution
This problem may occur if the Collect Specific Events (Collection) rule is configured to collect security event parameters. In this scenario, the Collect Specific Events (Collection) rule may occasionally collect more parameters than requested. This behavior may cause the MOM service to stop.

Symptoms
Although the MSSQLServer service does not stop, the Microsoft Operations Manager (MOM) 2005 Operator Console contains a Critical Error severity alert that is similar to the following alert:

Name: The MSSQLServer service terminated unexpectedlySeverity: Critical ErrorResolution State: NewDomain: WORKGROUPComputer: ComputerNameTime of First Event: TimeTime of Last Event: TimeAlert latency: 1 secProblem State: InvestigateRepeat Count: 3Age:Source: MSSQLSERVERAlert Id: 390da845-d0c7-4570-b895-cb265d13addaRule (enabled): Microsoft SQL Server\SQL Server 2000\SQL Server 2000 Event Collection\SQL Server General\The MSSQLServer service terminated unexpectedlyDescription: SqlDumpExceptionHandler: Process 56 generated fatal exception c0000005 EXCEPTION_ACCESS_VIOLATION. SQL Server is terminating this process.
Resolution
This issue occurs when the following conditions are true: You enable the The MSSQLServer service terminated unexpectedly event rule. This event rule has the following criteria in the MOM 2005 Administrator Console: The Event Number event property matches the following code:

regex ^(17052|17055)$The Source Name event property matches the following code:

wildcard MSSQL*The Description event property matches the following code:

substring Error: 0, Severity: 19, State: 0You receive an error message that has a severity level 19 in Microsoft SQL Server 2000 that is similar to the following error message:

ODBC: Msg 0. Level 19, State 1SqlDumpExceptionHandler: Process 56 generated fatal exception c0000005 EXCEPTION_ACCESS_VIOLATION. SQL Server is terminating this process.Connection Broken

Symptoms
The Microsoft Operations Manager (MOM) OnePointService stop working because there is an access violation in the Performance Manager (PerfMgr) thread on MOM agents. The service attempts to restart but it may or may not succeed. The following two events are typically logged in the Application event log if you experience this problem:

Event ID: 9015Event Type: ErrorEvent Source: OnePoint OperationsDescription:The Microsoft Operations Manager 2000 service (OnePointService.exe) received an unexpected exception. Thread Name: PerfMgr Exception code: 0xc0000005 Exception description: Access Violation Exception address: 77DF7D88

Event ID: 9014Event Type: ErrorEvent Source: OnePoint OperationsUser:NT AUTHORITY\SYSTEMDescription:The Microsoft Operations Manager 2000 service (OnePointService.exe) terminated due to an unhandled exception.It will attempt to restart itself.If the “Thread Name”, “Exception code”, and the “Exception address” match these errors, you are most likely affected by this issue. Also, the OnePointService log file may log entries that are similar to the following entries:

“12015“`0`3044`39`1`PerfMgr`PerformanceManager::execute`236775672`29425836“Event logging is disabled (this is normal for GUIs).Suppressed logging of event 9015(Error) args = “0xbe4″ “0×00000000c0000005″ “Access Violation” “77DF7D88″ “0×0″ “PerfMgr” “12016“`0`3044`39`1`PerfMgr`PerformanceManager::execute`236775672`29425836“Event logging is disabled (this is normal for GUIs).Suppressed logging of event 9014(Error) args = “12017“`0`3044`39`0`PerfMgr`PerformanceManager::execute`236931925`29425836“}PerformanceManager::execute: exiting.“12018“`0`3044`39`0`PerfMgr“239275720`29425836“VERIFY FAILURE:T:\Dev\EEM\V3\Ship\Providers\PerfProvider\PerformanceManager.cpp(51): Destroying mutex locked at this location!After you receive these errors, the OnePointService service may appear to be running when it stops responding (hangs). To recover from this, you must restart the computer.
Resolution
This problem occurs because there is a timeout issue when the PerfMgr thread requests performance data from the computer.