Microsoft KB Archive/904748

= The MOM service process (Momservice.exe) unexpectedly shuts down and you receive an event in the Application log on the Microsoft Operations Manager 2005 Management Server =

Article ID: 904748

Article Last Modified on 10/27/2006

-

APPLIES TO


 * Microsoft Operations Manager (MOM) 2005

-





SYMPTOMS
The MOM service process (Momservice.exe) unexpectedly shuts down. Additionally, you receive an event in the Application log on the Microsoft Operations Manager (MOM) 2005 Management Server that is similar to the following event: Event Type:

Error Event Source: Microsoft Operations Manager

Event ID: 1000

Description:

Faulting application momservice.exe, version 5.0.2749.0, stamp 411d1d01, faulting module momdbconnector.dll, version 5.0.2749.0, stamp 411d1d1a, debug? 0, fault address 0x000ab79c.

This symptom occurs if the following conditions are true:
 * The provider name of the event rule of the collection type is Security.
 * The &quot;with event id&quot; setting of the event rule of the collection type is 540. However, this issue may also occur if the &quot;with event id&quot; setting is set to a different event ID.



CAUSE
This problem occurs if the following conditions are true:
 * MOM 2005 is configured to collect event parameters through a collection type event rule.
 * MOM 2005 cannot correctly parse the event parameters before MOM 2005 writes the event data to the database.

Therefore, an access violation occurs and the MOM service stops.



WORKAROUND
To work around this problem, change the collection type event rule to not collect event parameters. To change the collection type event rule to not collect event parameters, follow these steps:
 * 1) Start the MOM 2005 Administrator Console.
 * 2) Expand Microsoft Operations Manager , expand Management Packs, expand Rule Groups, and then click the collection type event rule.
 * 3) In the right pane, double-click the collection type event rule, and then click the Parameter Storage tab.
 * 4) Under Parameters, click Store no event parameters or Store all event parameters, and then click OK.



STATUS
Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the &quot;Applies to&quot; section.

Additional query words: security event ID 540 Successful Network Logon

Keywords: kberrmsg kbtshoot kbprb KB904748

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.