Hi,

We have SCOM 2007 R2 implemented with the clustered RMS and Database.I could see event ID 26004 in the operationsmanager eventlog in both nodes of the RMS cluster.I tried to check but Iam not be find one.I wpuld appreciate if some help me in fixing this issue

The Windows Event Log Provider is still unable to open the Event ID 1020 event log on computer 'XXXX'. The Provider has been unable to open the Event ID 1020 event log for 6480 seconds.

Most recent error details: The specified channel could not be found. Check channel configuration.
 

One or more workflows were affected by this. 

Workflow name: many
Instance name: many
Instance ID: many
Management group: OpsMgr

Something wrong with your server?  If the event log service isn't running this could be the issue.

 

Hi,

 

Please ensure the action account has enough privileges on the servers.

 

Ensure you have applied the required hotfixes:

 

Which hotfixes should I apply?

http://blogs.technet.com/b/kevinholman/archive/2009/01/27/which-hotfixes-should-i-apply.aspx

 

Regarding the error, I also noticed the following thread, please also refer to it:

 

Agent Deployment - Ops MGR Event Log - Access denied

http://social.technet.microsoft.com/Forums/en-US/operationsmanagerdeployment/thread/a0e08a14-4369-472f-942a-3f96f1b527b9/

 

If the issue persists, please check the Event Log on the problematic servers; if there are any related errors, please let us know the details.

 

Hope this helps.

 

Thanks.

It was once happened to me. I was able to resolve the issue by disabling the troubling monitor. Actually what happened was:

Suddenly I started receiving event id 26004 on my active RMS node every 12 minutes. I digged deep into the issue only to find that it was actually caused by the Exchange application team. They created a new monitor to monitor "event id 1020 which could arise in the Hub transport servers and when many user have problem with connecting to their Mailbox server and may with other servers as well".

They also created a notification subscription for this alert. Now i have disabled this monitor and the subscription and it stopped throwing the 26004 events at once.

So the problem seems to be with their monitor settings but not sure this is a permanent solution for this issue.

Hope this helps.

Thanks,

 

Hi,

this error is related to custom rules created to access in the event log security and this rules failed to access

Can you check if your action account have the permission on your RMS to open the security log, and verify if you have a GPO security template for security logs

Please visit this link it can help you to resolve your problem:

http://support.microsoft.com/kb/959865

 

hi:

for me just replace this monitor,it's work

KHI: Destructive Cmdlet execution throttled for first org user because of Powershell Budget Monitor
ID:  _2205F5BA_6785_11DF_BC88_4F1CDFD72085_
Description:   
Target:  Remote PowerShell
Enabled:  On Essential Monitoring

http://mpwiki.viacode.com/default.aspx?g=posts&t=65122

Hi,

You can check Problem 1 in the following article. This should help.

https://support.microsoft.com/en-us/kb/959865?wa=wsignin1.0

----------------------------------------------------------------------------

G.R.V