Hi, In addition, please also check the issue referring to the method in the following document: Troubleshooting http://technet.microsoft.com/en-us/library/dd279686.aspx Please note the problem about the script SCOMpercentageCPUTimeCounter.vbs. Please also try the following hotfix: The Svchost.exe process that has the WMI service crashes in Windows Server 2008 R2 or in Windows 7 http://support.microsoft.com/kb/982293 Hope this helps. Thanks. Nicholas Li TechNet Community Support

Hi Nicholas, Thanks for your response. We have SP1 on these 2008R2 servers and they already have those hotfixes. And the issue mentioned in technet is related to Invalid class error but error descriptions in our case is little different Thanks~Cheers, Rohit Kochher

Hi All We are getting events 21402 and 21403 from few servers. OS 2008R2Sp1 SCOM: 2007R2 Cu5. Agents mix of Cu2 and Cu5. We had 3 servers in past where we had slow access issues,memory consumption resulting in server black out. All 3pointed out to below two events about SCOMpercentageCPUtimecounter.vbs 21402 Forced to terminate the following process started at 1:27:51 PM because it ran past the configured timeout 300 seconds. Command executed: "C:\Windows\system32\cscript.exe" /nologo "SCOMpercentageCPUTimeCounter.vbs" false 3 Working Directory: C:\Program Files\System Center Operations Manager 2007\Health Service State\Monitoring Host Temporary Files 57\1595\ One or more workflows were affected by this. Workflow name: Microsoft.SystemCenter.HealthService.SCOMpercentageCPUTimeCollection Instance name: Instance ID: {09599BDA-85F6-DFB3-0C72-24C2C9A49425} Management group: 21403 The process started at 1:27:51 PM was terminated because the HealthService requested the workflow to stop, some data may have been lost. Command executed: "C:\Windows\system32\cscript.exe" /nologo "SCOMpercentageCPUTimeCounter.vbs" false 3 Working Directory: C:\Program Files\System Center Operations Manager 2007\Health Service State\Monitoring Host Temporary Files 57\1595\ One or more workflows were affected by this. Workflow name: Microsoft.SystemCenter.HealthService.SCOMpercentageCPUTimeCollection Instance name: Instance ID: {09599BDA-85F6-DFB3-0C72-24C2C9A49425} Management group: Now, I found that this script is used by a monitor for finding CPU consumption by SCOM agent and by a rule to populate agent proc utilization view. And based on research the fix seems to be missing/courrupt perf counters and/or Anti virus related issues. Since we dont know in furture this issue would come from which server, We dont want end users to face issues from servers like slow access etc. If we disable this rule and monitor..what is functionality loss?Or can we override this to avoid the problem? For some reasons we cannot troubleshooting the root cause for now and might be comfortable with disabling/overiding this script. Thanks All in advance!~Cheers, Rohit Kochher

Hi Rohit Hope all is well. Kevin discusses this error on his blog: http://blogs.technet.com/b/kevinholman/archive/2010/02/23/a-new-script-error-scompercentagecputimecounter-vbs-invalid-class.aspx?PageIndex=2#comments From the comments, it is clear that it affects more than just windows 2000 servers. E,g, - SCOMpercentageCPUTimeCounter.vbs(212, 2) SWbemObjectSet: Out of memory Assuming Issue with WMI - SCOMpercentageCPUTimeCounter.vbs(125, 5) SWbemRefresher: No more threads can be created in the system. Assuming Issue with WMI - I have seen both of these - and both times it appeared to be an issue with WMI. It didnt need a WMI rebuild - it needed the WMI service restarted or a reboot of the OS. Can you please find out on the majorty of systems with these errors - what OS are they running? Also - how much memory (private bytes) are the WMI processes using in Task manager? - If 2008 R2 - make sure WMI isnt leaking memory per my other article. - If not 2008 R2 - make sure cscript is updated to 5.7, and WMI is functional, then walk through the script and try and determin which steps are failing to return data. Cheers Graham Regards Graham New System Center 2012 Blog! - http://www.systemcentersolutions.co.uk View OpsMgr tips and tricks at http://systemcentersolutions.wordpress.com/

Hi Graham Thanks for your response. We have 2008R2 SP1 on these servers , So i guess hotfix wont work. Dll mentioned is updated on our servers and no event id 1000 pointing to wmi. I am wondering if it AV or corrupt counters. Now my concern is for the time being , can we disable this rule and monitor and live with it? And if we do that will scom agent still cause wmi/memory issues? Thanks~Cheers, Rohit Kochher

A lot of the comments at the end of article, including those from Kevin, point to generic WMI issues causing this. E.g. "- I have seen both of these - and both times it appeared to be an issue with WMI. It didnt need a WMI rebuild - it needed the WMI service restarted or a reboot of the OS. Can you please find out on the majorty of systems with these errors - what OS are they running? Also - how much memory (private bytes) are the WMI processes using in Task manager?" Disabling is an option but as you say, it will then potentially mask any WMI issues. Have you tried restarting WMI or can you plan a reboot for them to see if that fixes the issue?Regards Graham New System Center 2012 Blog! - http://www.systemcentersolutions.co.uk View OpsMgr tips and tricks at http://systemcentersolutions.wordpress.com/

Hi Graham Issue started from helpdesk tickets for slow access and in analysis they found SCOM agent causing high util. They stopped SCOM service and then after stopping they rebooted the server. Then they never started SCOM service on those servers. And claimed stopping SCOM fixes issues. I second you on restarting OS and WMI will fix this. But we cant afford this as it is reactive approach starting from end users related issues. There are some political aspects involved due to which i thought of stopping rule and monitor. ~Cheers, Rohit Kochher

So from last two comments on this blog http://blogs.technet.com/b/kevinholman/archive/2010/06/09/wmi-leaks-memory-on-server-2008-r2-monitored-agents.aspx?PageIndex=2#comments WMI leaks are there for 2008R2SP1 but seems no fix/hotfix for now. we are also having on all 2008r2sp1 would appreciate any help on this~Cheers, Rohit Kochher