Hi, We have SCOM R2 installed and recently I have been getting following Event on the RMS: Log Name: Operations Manager Source: Health Service Modules Date: 8/26/2010 3:01:14 AM Event ID: 26004 Task Category: None Level: Error Keywords: Classic User: N/A Computer: RMS Description: The Windows Event Log Provider is still unable to open the Security event log on computer 'RMS'. The Provider has been unable to open the Security event log for 223920 seconds. The issue discussed at http://support.microsoft.com/kb/959865 is similar, but applies to SCOM SP1. Any known solution for the above mentioned? Thanks, Regards, Meer

Hey Meer This error has been associated with custom rules written that access the security log and fail... can you track if you have a custom rule that does that?Paul Keely

Hey Paul, I do have a monitor that searches for a couple of event Ids from Security Log. So does it mean the event Ids I am trying to track can't be monitored? Thanks, Meer

No I wouldn't say so Where are the rules stored and what are they using to do the searching? If they are just plain old eventid rules gathering data for the security logs then maybe your action account does not have the permission on your rms to open the security log do you have a GPO security template for security logs?.. Its along those lines id be lookingPaul Keely

Just a couple of event IDs, and it's saved to a newly created MP. The security log needs extra than what can be pulled form an Application/System logs? Moreover this rule is run againt a group where SCOM RMS is not included. thanks Meer

Hi, No activity for a long time. I will mark as answer. Feel free to re-open. thanksAnders Bengtsson | Microsoft PFE | blog at http://www.contoso.se