Select the product you need help with
- Internet Explorer
- Windows Phone
- More products
System Center Operations Manager 2007 R2 CU3 & CU4 may cause non-SCOM 2007 services to restart
Article ID: 2526113 - View products that this article applies to.
When a System Center Operations Manager 2007 R2 (SCOM) agent is updated to Cumulative Update 3 (CU3) or Cumulative Update 4 (CU4), non-SCOM services may be restarted or a reboot may be requested. The non-SCOM services can be related to other products like SQL Server, Exchange, Windows, SharePoint, etc.
The service restarts may happen on Windows Server 2008, Windows Vista and newer operating systems, while the reboot requests may happen on Windows Server 2003 and older operating systems.
A shared code library for logging events has leaked a reference to the dynamic library EventCommon.dll since SCOM 2007 R2 RTM. EventCommon.dll was first updated in CU3 which is why the service restarts started occurring with that CU. We fixed an install bug in CU4 which we believed would correct the problem, but found after CU4 released that there was another bug (the handle leak) which also caused non-SCOM services to restart. The performance counter extension MOMConnectorPerformance.dll uses the class library with the leak. When a process does a snapshot or enumeration of performance counters on a system, MOMConnectorPerformance.dll will be loaded into the process doing the snapshot. The library used by MOMConnectorPerformance.dll will load EventCommon.dll. After doing a performance counter snapshot Windows will automatically unload MOMConnectorPerformance.dll. Due to the leak, EventCommon.dll is not unloaded and left behind in the process.
While the leak can occur on any version of Windows, the service restart issue only affects Windows Server 2008 and Windows Server 2008 R2. Windows Server 2008 added a feature called Restart Manager which automatically restarts dependent processes when a file those processes depend on is replaced during an update. Windows Server 2003 and Windows Server 2003 may request a reboot after installing the patch.
We are aware of only a small number of customers being affected by this problem.
(http://go.microsoft.com/fwlink/?LinkId=151500)for other considerations.