System Center Operations Manager 2007 Agents write events to both System log and Operations Manager log.

 

Occasionally you may have an OpsMgr 2007 agent that log events to both the System log and the Operations Manager log repeatedly.  This usually happens after agent install, and when the server has been online for many days and not rebooted.  You may also notice that the MOMlog.evt does not get created correctly in the %systemroot%\system32\config folder, and that there are improper entries in the HKLM\System\CurrentControlSet\Services\EventLog registry sub-keys.

 

Fortunately, the resolution to this is relatively simple.  Reboot the agent server.  Upon reboot the MOMlog.evt will get created correctly in the config folder, and all future Operations Manager events will post solely to the Operations Manager log.  Not documented, and since agent installation doesn’t require a reboot, it’s not expected. For servers that aren’t rebooted regularly, that can be confusing.