locked
WMI Error Message: WMI Probe Module Failed Execution RRS feed

  • Question

  • Hi,

    I'm getting tons of these error message with this text enclosed (I'm working with R2):


    Object enumeration failed


    Query: 'SELECT SourceName, EventCode, InsertionStrings, Message FROM Win32_NTLogEvent
    WHERE (LogFile = 'Operations Manager')
        AND (SourceName = 'Health Service Modules')
        AND (
            (EventCode = '10601') OR
            (EventCode = '10602') OR
            (EventCode = '10603') OR
            (EventCode = '10606') OR
            (EventCode = '10607') OR
            (EventCode = '10608') OR
            (EventCode = '10609') OR
            (EventCode = '10610') OR
            (EventCode = '10611') OR
            (EventCode = '10612') OR
            (EventCode = '10614') OR
            (EventCode = '10615') OR
            (EventCode = '10617') OR
            (EventCode = '10618') OR
            (EventCode = '10619') OR
            (EventCode = '10620') OR
            (EventCode = '10621') OR
            (EventCode = '10622') OR
            (EventCode = '10623') OR
            (EventCode = '10624') OR
            (EventCode = '10625') OR
            (EventCode = '10626') OR
            (EventCode = '10627') OR
            (EventCode = '10629')
        )
        AND (TimeGenerated >= '7/31/2009 9:39:13 AM' AND TimeGenerated <= '7/31/2009 9:39:13 AM')'


    HRESULT: 0x80041017

    Details: Invalid query

     

    One or more workflows were affected by this.


    Workflow name: Microsoft.SystemCenter.AgentManager.WindowsClusterVirtualServer.Monitor

    Instance name: mgntgroupservice01

    Instance ID: {47B316C2-CF93-5293-BDDC-25AB56AC5CA0}

    Management group: mgntgroup


    --------------------

    Can anybody help me how to troubleshoot this?

    Thanks

    Alex

    Friday, July 31, 2009 12:38 PM

Answers

  • Are these on a clustered Root Management Server, or just on physical nodes of application clusters?

     If they are on a clustered RMS, and this is Windows 2008 operating system then you need to change the Priviledged Run As Profile for the RMS.  By default it is local system, but local system doesn't have the rights to query the passive node of the RMS cluster.  Set the priviledge Run As Profile for the RMS to be the same as the default action account.
     
     If this is an application cluster, then you might check to be sure WMI queries can run against the physical nodes of the cluster as the default action account.  The fire wall may block the WMI queries, or system policy.  Also check to be sure the default action account is either local system, or an administrator account on the physical server.  By default only an Administrator account can execute remote queries against a server, and when querying the virtual server for WMI this is a remote WMI query.
    • Marked as answer by StuartR Thursday, August 27, 2009 7:25 PM
    Monday, August 3, 2009 4:39 AM

All replies

  • A good start is to get the WMI hotfixes and Windows Script 5.7 on the servers if your running 2003, have a read of Kevin's blog for more info.
    Friday, July 31, 2009 3:39 PM
  • Sorry, Steve,


    I forgot to mention that I've already done that. But nothing's changed (Hotfixes plus Registry Keys).

    What should / could be the next step coming to a solution for this problem?

    Thanks in advance.

    Alex
    Friday, July 31, 2009 5:58 PM
  • Are these on a clustered Root Management Server, or just on physical nodes of application clusters?

     If they are on a clustered RMS, and this is Windows 2008 operating system then you need to change the Priviledged Run As Profile for the RMS.  By default it is local system, but local system doesn't have the rights to query the passive node of the RMS cluster.  Set the priviledge Run As Profile for the RMS to be the same as the default action account.
     
     If this is an application cluster, then you might check to be sure WMI queries can run against the physical nodes of the cluster as the default action account.  The fire wall may block the WMI queries, or system policy.  Also check to be sure the default action account is either local system, or an administrator account on the physical server.  By default only an Administrator account can execute remote queries against a server, and when querying the virtual server for WMI this is a remote WMI query.
    • Marked as answer by StuartR Thursday, August 27, 2009 7:25 PM
    Monday, August 3, 2009 4:39 AM
  • Hi!

    Same problem in my environment but unfortunately your solution doesn't fit because of not clustered RMS!
    As far as I remember I didn't have this issue before upgrading to R2.

    Any other idea?

    Thx,
    Patrick

    Friday, September 11, 2009 10:54 AM
  • OK, this thread is quite old but because of a discussion with a colleague of mine here are my thoughts to this issue.

    If you run the query without the TimeGenerated- statement, it ends without problems and give you the output (or not if no such event ids found). So this seems to be a regional settings issue.

    Unfortunately I don't remember if I did it because of that problem, but I changed regional settings from DEA (our default here in Austria) to DEU. Hint: try in your lab before - of course at your own risk!

    Cheers,

    Patrick

    Thursday, August 19, 2010 8:40 AM