Hi, We have SCOM 2007 R2 implemented with the clustered RMS and Database.I could see event ID 26004 in the operationsmanager eventlog in both nodes of the RMS cluster.I tried to check but Iam not be find one.I wpuld appreciate if some help me in fixing this issue The Windows Event Log Provider is still unable to open the Event ID 1020 event log on computer 'XXXX'. The Provider has been unable to open the Event ID 1020 event log for 6480 seconds. Most recent error details: The specified channel could not be found. Check channel configuration. One or more workflows were affected by this. Workflow name: many Instance name: many Instance ID: many Management group: OpsMgrraj

Something wrong with your server? If the event log service isn't running this could be the issue.Microsoft Corporation

Hi, Please ensure the action account has enough privileges on the servers. Ensure you have applied the required hotfixes: Which hotfixes should I apply? http://blogs.technet.com/b/kevinholman/archive/2009/01/27/which-hotfixes-should-i-apply.aspx Regarding the error, I also noticed the following thread, please also refer to it: Agent Deployment - Ops MGR Event Log - Access denied http://social.technet.microsoft.com/Forums/en-US/operationsmanagerdeployment/thread/a0e08a14-4369-472f-942a-3f96f1b527b9/ If the issue persists, please check the Event Log on the problematic servers; if there are any related errors, please let us know the details. Hope this helps. Thanks. Nicholas Li - MSFT Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

It was once happened to me. I was able to resolve the issue by disabling the troubling monitor. Actually what happened was: Suddenly I started receiving event id 26004 on my active RMS node every 12 minutes. I digged deep into the issue only to find that it was actually caused by the Exchange application team. They created a new monitor to monitor "event id 1020 which could arise in the Hub transport servers and when many user have problem with connecting to their Mailbox server and may with other servers as well". They also created a notification subscription for this alert. Now i have disabled this monitor and the subscription and it stopped throwing the 26004 events at once. So the problem seems to be with their monitor settings but not sure this is a permanent solution for this issue. Hope this helps. Thanks,

Hi, this error is related to custom rules created to access in the event log security and this rules failed to access Can you check if your action account have the permission on your RMS to open the security log, and verify if you have a GPO security template for security logs Please visit this link it can help you to resolve your problem: http://support.microsoft.com/kb/959865 Oussama Oueslati | System Engineer | vNext Consulting