Share via

OpsMgr 2007: Agent Push Installation Fails with Error 25211. Failed to install performance counters

  • Article

Here's a great tip on troubleshooting agent installation problems where you're getting Event ID 10005's.  This is a cool one because the basic process can be used any time you're troubleshooting an issue that references a file already being in use by another process:

========

Issue: When trying to install the Operations Manager 2007 agent you may receive the following error:

Event Type: Error
Event Source: MsiInstaller
Event Category: None
Event ID: 10005
Description: Product: System Center Operations Manager 2007 Agent -- Error 25211.Failed to install performance counters.. Error Code: -2147024864 (The process cannot access the file because it is being used by another process.).

For more information, see Help and Support Center at https://go.microsoft.com/fwlink/events.asp.

Data:
0000: 7b 45 37 36 30 30 41 39 {E7600A9
0008: 43 2d 36 37 38 32 2d 34 C-6782-4
0010: 32 32 31 2d 39 38 34 45 221-984E
0018: 2d 41 42 38 39 43 37 38 -AB89C78
0020: 30 44 43 32 44 7d 0DC2D}

Resolution:   The question here is What other process is using our file?  The first step is to run Process Monitor during the installation attempt and take a look at the resulting .PML file:

Open .PML file in Process Monitor and filter on Results contain SHARING VIOLATION.  You may notice something like this:

AM MsiExec.exe 7192 CreateFile
C:\WINNT\system32\perfc009.dat SHARING VIOLATION Desired Access:
Generic Write, Disposition: Supersede, Options: Synchronous IO Non-Alert,
Attributes: N, ShareMode: Read, AllocationSize: 0

So now we know there's a sharing violation for perfc009.dat.  The next step is to run Handle.exe from Sysinternals and pipe the output to a text file:

handle.exe > handle.txt

Search Handle.txt for SHARING VIOLATION and you'll probably find something similar to this:

118: File (RW-) C:\Program Files\CiscoSecure ACS v4.0\CSMon
124: File (R--) C:\Program Files\CiscoSecure ACS v4.0\CSMon\Logs\CSMon.log
140: File (RW-) C:\Program Files\CiscoSecure ACS v4.0\CSMon
244: File (RW-) C:\Program Files\CiscoSecure ACS v4.0\Logs
250: File (R--) C:\Program Files\CiscoSecure ACS v4.0\Logs\ServiceMonitoring\CSMonLog.csv
2B0: File (RW-) C:\WINNT\system32\perfc009.dat
2B8: File (RW-) C:\WINNT\system32\perfh009.dat
2CC: File (RW-) C:\WINNT\system32\Perflib_Perfdata_a18.dat
2D0: Section \BaseNamedObjects\Perflib_Perfdata_a18

Note that in my case the process is part of CiscoSecure but honestly it can be anything.  This is just what it happened to be in my case. 

Once you discover the process holding the file open, simply stop that service, retry your install, then once it completes successfully restart the service that you stopped.

========

Special thanks to Frank Novak, a Senior Support Engineer in our Washington state office for writing this up for us.  Thanks Frank!

J.C. Hornbeck | Manageability Knowledge Engineer

Comments

  • Anonymous
    January 01, 2003
    body { font-family: Arial; font-size: 10pt} 183 Microsoft Team blogs searched, 82 blogs have new articles

  • Anonymous
    January 01, 2003
    thank you

  • Anonymous
    January 01, 2003
    this didn't work for me. unfortunately on a 64-bit server, the 32-bit agent was installed, and then later the 64-bit r2 agent was installed. so they both show up in add/remove programs and neither will uninstall. the SHARED VIOLATION entries in procmon do not show up in handle.txt.