Discover related Alerts Issue
I see a lot of events / alerts related to discovery on one of the manually Installed agent: Data was found in the output, but has been dropped because the Event Policy for the process started at 8:37:37 AM has detected errors. The 'ExitCode' policy expression: [^0]+ matched the following output: -1073741819 Command executed: "C:\Windows\system32\cscript.exe" /nologo "DiscoverSQL2008DBEngineDiscovery.vbs" {32FBB1E4-C6D1-0517-2F47-3DDA67D46A3B} {9AAAC888-2A20-A660-8CC0-AAC445947127} SALSABAPP09.mog.maerskoil.com SALSABAPP09.mog.maerskoil.com SALSABAPP09 "Exclude:" Working Directory: C:\Program Files\System Center Operations Manager 2007\Health Service State\Monitoring Host Temporary Files 1\75\ One or more workflows were affected by this. Workflow name: Microsoft.SQLServer.2008.DBEngineDiscoveryRule.Server It happens for ither apps as well not just SQL related. Because of this i aint able to discover the instances of SQL ,dhcp etc a s the Scripts fail i guess . It is a Win 2008 Box , McAfee is Installed on it but McAfee is installed on other servers as well..The permissions look fine on SQL and the ..Local Admin has rights. SCOm service account is added to Local Admin group Have Stopped the service and deleted Health folder and then started the service.. Still Event 21414 Any Help
May 19th, 2011 2:08am

Please check scriptscan in mcafee and set the rights exclusions. Here is a thread that discusses several of the things you can do (like disable scriptscan and possible unregistering the scriptscan dll and settings exclusions). https://community.mcafee.com/thread/32575 After that take a look at runas profiles in scom for several roles. You can check it in the management pack guide. The one for sql 2008 that was released about 2 weeks ago has some good info on runas profile usage http://www.microsoft.com/downloads/en/details.aspx?FamilyID=8c0f970e-c653-4c15-9e51-6a6cadfca363&displaylang=en Hope it helps.Bob Cornelissen - BICTT (My BICTT Blog)
Free Windows Admin Tool Kit Click here and download it now
May 19th, 2011 3:06am

Data was found in the output, but has been dropped because the Event Policy for the process started at 8:37:37 AM has detected errors. The 'ExitCode' policy expression: [^0]+ matched the following output: -1073741819 This error can be translated to 0xC0000005, which is an access violation. So double check the McAfee and/or security settings of your account.Regards, Marc Klaver http://jama00.wordpress.com/
May 19th, 2011 5:16am

Also, access violation may mean that the script doesn't have the permissions like you think it does. Lots of variables here to prevent the scripts from succeeding. After disabling macafee or some equivalent set of exceptions, try standard discovery debugging procedure that start with run the script from the command line. The command line is shown in your sample error message. You will then see what the output of the script looks like that is triggering the policy - which roughly translated means "script exited with non-zero return code" Microsoft Corporation
Free Windows Admin Tool Kit Click here and download it now
May 19th, 2011 4:20pm

Yes it is McAfee ... As predicted :) Troubleshooting McAfee. Need to Look More into the exceptions that hav to be made for SCOM Agents
May 23rd, 2011 3:14am

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics