Microsoft KB Archive/885416

= MOM 2005 agent logs an &quot;existing connection was forcibly closed by the remote host&quot; event =

Article ID: 885416

Article Last Modified on 7/24/2007

-

APPLIES TO


 * Microsoft Operations Manager (MOM) 2005

-





SYMPTOMS
The Microsoft Operations Manager (MOM) 2005 agent logs the following events in the Microsoft Windows NT Application event log. The events typically occur after a new agent is deployed, and the link between the agent and Management Server is slow. Event Type: Error

Event Source: Microsoft Operations Manager

Event Category: None

Event ID: 21293

User: NT AUTHORITY\SYSTEM

Description: The agent was unable to send data to the MOM Server at. The error code is 10054. An existing connection was forcibly closed by the remote host.

Event Type: Information

Event Source: Microsoft Operations Manager

Event Category: None

Event ID: 26021

User: NT AUTHORITY\SYSTEM

Description: The agent has restored communication to



CAUSE
This problem may occur if the agent does not respond to a Management Server request within one second. If the agent takes more than one second to respond, the Management Server closes the connection to the agent. For example, this problem may occur when a new agent is downloading new rules. You may experience this problem more frequently on agents that connect to a Management Server over a wide area network (WAN).



Service pack information
To resolve this problem, obtain the latest service pack for Microsoft Operations Manager 2005. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

905416 How to obtain the latest Microsoft Operations Manager 2005 service pack

Hotfix information
A supported hotfix is now available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing this specific problem. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next service pack that contains this hotfix.

To resolve this problem, submit a request to Microsoft Online Customer Services to obtain the hotfix. To submit an online request to obtain the hotfix, visit the following Microsoft Web site:

http://go.microsoft.com/?linkid=6294451

Note If additional issues occur or any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. To create a separate service request, visit the following Microsoft Web site:

http://support.microsoft.com/contactus/?ws=support

Prerequisites
Install this hotfix only on Management Servers.

Restart requirement
This hotfix installation stops and then starts the MOM service (MOMService.exe).

Hotfix replacement information
This hotfix does not replace any other hotfixes.

File information
The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in coordinated universal time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.   Date         Time   Version            Size    File name --  28-Sep-2004  15:45  6.0.2800.1106     602,624  Mom2005-rtm-kb885416-x86-enu.exe After the hotfix is installed, the following files will have the listed attributes or later versions:   Date         Time   Version            Size    File name --  27-Sep-2004  21:26  5.0.2749.2      1,629,424  Momengine.dll

To install this hotfix

 * 1) Create a folder on each MOM 2005 Management Server.
 * 2) Copy the Mom2005-rtm-kb885416-x86-enu.exe file to the new folder on each server.
 * 3) Log on locally to the Management Server, and then run the Mom2005-rtm-kb885416-x86-enu.exe file.

The hotfix installer program performs these steps:
 * 1) Stops the MOM service.
 * 2) Replaces the MomEngine.dll file on the Management Server.
 * 3) Starts the MOM service.



STATUS
Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the &quot;Applies to&quot; section. This problem was first corrected in Microsoft Operations Manager 2005 Service Pack 1.



MORE INFORMATION
After you install this hotfix, the connection time-out value on the Management Server is increased from one second to fifteen seconds. The new default value resolves the symptoms in most situations. Therefore, no additional action is typically necessary after you install the hotfix. However, the symptoms may still occur on slow WAN connections. If you continue to experience this problem after you apply this hotfix, you can use a new registry value to increase the time-out value. The new registry value is named ServerIOTimeoutMS and is implemented with this hotfix.

You must manually create the ServerIOTimeoutMS value. If this registry value does not exist, the Management Server uses the default value of 15,000 milliseconds (ms), or 15 seconds. To create the ServerIOTimeoutMS registry value and to increase the default time-out value, follow these steps on each Management Server that is experiencing the problem:  Start Registry Editor. Locate and right-click the following registry subkey:

HKEY_LOCAL_MACHINE\Software\Mission Critical Software\OnePoint\Configurations\ \Operations\Consolidator

 Point to New, and then click DWORD Value. Type ServerIOTimeoutMS as the value name, and then press ENTER.</li> Double-click the ServerIOTimeoutMS value, type a value that is larger than 15,000 ms. This value is the time that elapses before the Management Server times out an active agent connection if no response is received. The recommended maximum value for this registry entry is 120,000 ms, or 2 minutes. However, the value can be larger if it is required.</li> Close Registry Editor.</li> Stop and then start the MOM service on the Management Server.</li></ol>

For more information about other problems that are resolved by Microsoft Operations Manager 2005 Service Pack 1, click the following article number to view the article in the Microsoft Knowledge Base:

905420 List of bugs that are fixed in Microsoft Operations Manager 2005 service packs

For additional information, click the following article number to view the article in the Microsoft Knowledge Base:

824684 Description of the standard terminology that is used to describe Microsoft software updates

Additional query words: Disconnect communication failure forced

Keywords: kbqfe kbhotfixserver atdownload kbgetsp kbbug kbnetwork kbperformance kbfix kbopmanrules kbopmaninstall kbopmandeploy kbopman2005spfix kbopman2005bug KB885416

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.