Microsoft KB Archive/830557

= Large Events May Cause Microsoft Operations Manager 2000 to Reprocess Old Event Data =

Article ID: 830557

Article Last Modified on 7/24/2007

-

APPLIES TO


 * Microsoft Operations Manager 2000 Service Pack 1

-





SYMPTOMS
Microsoft Operations Manager (MOM) 2000 may reprocess old Microsoft Windows NT event data from the beginning of the event log. This problem may trigger a critical alert for an issue that no longer exists.

When this problem occurs, you may receive an event in the Windows event log that is similar to the following event message: Source: OnePoint Operations Event ID: 25013 Description: The NT %1 Event Log appears to have &quot;wrapped&quot; while the NT %1 Event Provider was not active. This error occurs when the provider is inactive for a period of time during which more events are logged than the event log can contain.

In some cases, the Windows NT event log provider may &quot;replay&quot; old data. As a result, you may receive alerts on issues that occurred weeks or months earlier.



CAUSE
This problem may occur if the MOM 2000 Windows NT Event Provider processes a large event, for example a large Dr. Watson event.



Hotfix Information
A supported hotfix is now available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing this specific problem. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next service pack that contains this hotfix.

To resolve this problem, submit a request to Microsoft Online Customer Services to obtain the hotfix. To submit an online request to obtain the hotfix, visit the following Microsoft Web site:

http://go.microsoft.com/?linkid=6294451

Note If additional issues occur or any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. To create a separate service request, visit the following Microsoft Web site:

http://support.microsoft.com/contactus/?ws=support

Prerequisites
You must have MOM 2000 Service Pack 1 (SP1) installed to apply this hotfix.

Restart Requirement
You do not have to restart your computer after you apply this hotfix.

Hotfix Replacement Information
This hotfix does not replace any other hotfixes.

File Information
The English version of this hotfix has the file attributes (or later) that are listed in the following table. The dates and times for these files are listed in coordinated universal time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.   Date         Time   Version  Size       File name ---   07-Nov-2003  14:53  1.0.0.0  1,070,592  Q830557.exe After the fix is installed, the following files will have the listed attributes or later:   Date         Time   Version      Size     File name 31-Oct-2003 21:13  4.0.1300.11  391,322  Eemntevent.dll



STATUS
Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the &quot;Applies to&quot; section of this article.



MORE INFORMATION
For additional information about standard terminology used to describe software updates, click the following article number to view the article in the Microsoft Knowledge Base:

824684 Description of the Standard Terminology That Is Used to Describe Microsoft

Additional query words: replay

Keywords: kbqfe kbhotfixserver kbeventservice kbeventlog kbevent kbfix kbbug KB830557

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.