KB930770 - Event ID 9014 and Event ID 9015 are logged and MOMservice.exe stops unexpectedly after you configure a Collect Specific Events (Collection) rule in Microsoft Operations Manager 2005
KB930770 is now available via https://support.microsoft.com/kb/930770
SYMPTOMS
After you configure a Collect Specific Events (Collection) rule in Microsoft Operations Manager (MOM) 2005, the following symptoms occur:
| • | The MOM service (MOMservice.exe) stops unexpectedly. If you try to start the MOM service, you receive the following error message: Could not start the MOM service on Local Computer. Error 1067: The process terminated unexpectedly. |
| • | The following events are logged in the Application log:Event ID 9014 Event Type: Error Event Source: Microsoft Operations Manager Event Category: None Event ID: 9014 Date: Time: User: N/A Computer: Description: The Microsoft Operations Manager service (MOMService.exe) terminated due to an unhandled exception. It will attempt to restart itself. For more information, see Help and Support Center at <https://go.microsoft.com/fwlink/events.asp>. Event ID 9015Event Type: Error Event Source: Microsoft Operations Manager Event Category: None Event ID: 9015 Date: Time: User: N/A Computer: Description: The Microsoft Operations Manager service (MOMService.exe) received an unexpected exception. Thread Id: 0xf40 Thread Name: MSB3904 Exception code: 0x00000000c0000005 Exception description: Access Violation Exception address: 025EB79C Exception flags: 0x0 For more information, see Help and Support Center at <https://go.microsoft.com/fwlink/events.asp>. |
CAUSE
This problem may occur if the Collect Specific Events (Collection) rule is configured to collect security event parameters. In this scenario, the Collect Specific Events (Collection) rule may occasionally collect more parameters than requested. This behavior may cause the MOM service to stop.
RESOLUTION
Hotfix information
A supported hotfix is now available from Microsoft. However, it is intended to correct only the problem that is described in this article. Apply it only to systems that are experiencing this specific problem. This hotfix may receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next MOM 2005 service pack that contains this hotfix.
To resolve this problem immediately, contact Microsoft Customer Support Services to obtain the hotfix. For a complete list of Microsoft Customer Support Services telephone numbers and information about support costs, visit the following Microsoft Web site:
https://support.microsoft.com/contactus/?ws=support (https://support.microsoft.com/contactus/?ws=support)
Note In special cases, charges that are ordinarily incurred for support calls may be canceled if a Microsoft Support Professional determines that a specific update will resolve your problem. The usual support costs will apply to additional support questions and issues that do not qualify for the specific update in question.
Prerequisites
To apply this hotfix, you must have MOM 2005 Service Pack 1 (SP1) installed on the computer.
For more information, click the following article number to view the article in the Microsoft Knowledge Base:
905416 (https://support.microsoft.com/kb/905416/) How to obtain the latest Microsoft Operations Manager 2005 service pack
Restart requirement
You do not have to restart the computer after you apply this hotfix. However, you must apply this hotfix to the MOM 2005 management server. When you apply this hotfix, the MOM service automatically restarts.
Hotfix replacement information
This hotfix does not replace any other hotfixes.
The hotfix, if required is available from Microsoft CSS.