none
System Center Data Access service will continue without generating auditing events

    Question

  • After install WEB PORTAL, always ythat I access the End User or Analyst WEB PAGE, I receive this erros on event viewer:

     

    Log Name:      Operations Manager
    Source:        OpsMgr SDK Service
    Date:          7/30/2010 7:23:56 PM
    Event ID:      26338
    Task Category: None
    Level:         Error
    Keywords:      Classic
    User:          N/A
    Computer:      server.abc.com
    Description:
    The System Center Data Access service is not able to generate auditing events for data access operations. Verify that the System Center Data Access service account has the correct rights to generate security audits.

    The System Center Data Access service will continue without generating auditing events.

    Details:
    System.ComponentModel.Win32Exception: The parameter is incorrect
       at Microsoft.EnterpriseManagement.Internal.Auditing.MomAuditLog.HandleError(Int32 error)
       at Microsoft.EnterpriseManagement.Internal.Auditing.MomAuditLog.ReportSecurityEvent(Int32 auditId, AuditType auditType, Object[] parameters)
       at Microsoft.EnterpriseManagement.Internal.Auditing.MomAuditLog.LogAuditEvent(Int32 eventId, AuditType auditType, String[] formatPlaceholders)
       at Microsoft.EnterpriseManagement.Mom.Sdk.Authorization.Auditing.AuditSuccess(String windowsIdentityName, String operationName, MethodBase callingMethod)
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="OpsMgr SDK Service" />
        <EventID Qualifiers="49152">26338</EventID>
        <Level>2</Level>
        <Task>0</Task>
        <Keywords>0x80000000000000</Keywords>
        <TimeCreated SystemTime="2010-07-30T22:23:56.000000000Z" />
        <EventRecordID>782</EventRecordID>
        <Channel>Operations Manager</Channel>
        <Computer>server.abc.com</Computer>
        <Security />
      </System>
      <EventData>
        <Data>System.ComponentModel.Win32Exception: The parameter is incorrect
       at Microsoft.EnterpriseManagement.Internal.Auditing.MomAuditLog.HandleError(Int32 error)
       at Microsoft.EnterpriseManagement.Internal.Auditing.MomAuditLog.ReportSecurityEvent(Int32 auditId, AuditType auditType, Object[] parameters)
       at Microsoft.EnterpriseManagement.Internal.Auditing.MomAuditLog.LogAuditEvent(Int32 eventId, AuditType auditType, String[] formatPlaceholders)
       at Microsoft.EnterpriseManagement.Mom.Sdk.Authorization.Auditing.AuditSuccess(String windowsIdentityName, String operationName, MethodBase callingMethod)</Data>
      </EventData>
    </Event>

     

    What can be happening?

    • Edited by JRSCE Friday, July 30, 2010 10:57 PM error
    Friday, July 30, 2010 10:32 PM

Answers

  • The account that the System Center Data Access Service is running as needs to be a local administrator on the SCSM Management Server in order to write events to the Security event log for auditing purposes.
    Travis Wright Senior Program Manager Lead Microsoft
    Wednesday, September 22, 2010 3:36 AM
  • If your portal server is separate from your management server, please make sure that the app pool account is a local admin too.  You really only need to do this if you want to have auditing events.  If you don't care about that then you can safely ignore these messages.
    Travis Wright Senior Program Manager Lead Microsoft
    Thursday, September 30, 2010 2:31 AM

All replies

  • have you found a solution yet? I am having the same problem and would be very interested in a solution.
    Friday, August 06, 2010 6:44 AM
  • The account that the System Center Data Access Service is running as needs to be a local administrator on the SCSM Management Server in order to write events to the Security event log for auditing purposes.
    Travis Wright Senior Program Manager Lead Microsoft
    Wednesday, September 22, 2010 3:36 AM
  • Hi

    I have the exakt same problem.
    I have installed the web portal on a separate server.
    The account that runs "System Center Data Access Service" on my SCSM server is administrator on my portal server.
    The account also has the right to "generate security audits" in the "Local security policy".

    Wednesday, September 22, 2010 7:28 AM
  • If your portal server is separate from your management server, please make sure that the app pool account is a local admin too.  You really only need to do this if you want to have auditing events.  If you don't care about that then you can safely ignore these messages.
    Travis Wright Senior Program Manager Lead Microsoft
    Thursday, September 30, 2010 2:31 AM
  • Hi, my portal is not separate form management server, System Center Data Access Service is running as local administrator on the SCSM Management Server and app pool account is a local admin too but i still have this error.

    Any suggestion?

    Tuesday, August 02, 2011 9:34 AM
  • All you have to do it to create a delta GPO which allows the SDK account on the RMS to generate security audit events. Apply the GPO by running gpupdate /force from an elevated cmd-prompt and run the command rsop.msc right after it. That way you’ll see whether the delta GPO has landed properly:
    Monday, May 27, 2013 1:42 PM
  • Hello! Have you tried this one: http://thoughtsonopsmgr.blogspot.com.br/2011/08/eventid-26338-on-rms-system-center-data.html ? Regards, RFM
    Wednesday, September 04, 2013 11:42 AM