Article ID: 904748
Article Last Modified on 10/27/2006
APPLIES TO
- Microsoft Operations Manager (MOM) 2005
SYMPTOMS
The MOM service process (Momservice.exe) unexpectedly shuts down. Additionally, you receive an event in the Application log on the Microsoft Operations Manager (MOM) 2005 Management Server that is similar to the following event:
Event Type:
Error Event Source: Microsoft Operations Manager
Event ID: 1000
Description:
Faulting application momservice.exe, version 5.0.2749.0, stamp 411d1d01, faulting module momdbconnector.dll, version 5.0.2749.0, stamp 411d1d1a, debug? 0, fault address 0x000ab79c.
This symptom occurs if the following conditions are true:
- The provider name of the event rule of the collection type is Security.
- The "with event id" setting of the event rule of the collection type is 540. However, this issue may also occur if the "with event id" setting is set to a different event ID.
CAUSE
This problem occurs if the following conditions are true:
- MOM 2005 is configured to collect event parameters through a collection type event rule.
- MOM 2005 cannot correctly parse the event parameters before MOM 2005 writes the event data to the database.
Therefore, an access violation occurs and the MOM service stops.
WORKAROUND
To work around this problem, change the collection type event rule to not collect event parameters. To change the collection type event rule to not collect event parameters, follow these steps:
- Start the MOM 2005 Administrator Console.
- Expand Microsoft Operations Manager (
MOM Server Name), expand Management Packs, expand Rule Groups, and then click the collection type event rule. - In the right pane, double-click the collection type event rule, and then click the Parameter Storage tab.
- Under Parameters, click Store no event parameters or Store all event parameters, and then click OK.
STATUS
Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.
Additional query words: security event ID 540 Successful Network Logon
Keywords: kberrmsg kbtshoot kbprb KB904748
