Select the product you need help with

System Center Operations Manager 2007 R2 CU3 & CU4 may cause non-SCOM 2007 services to restart

Article ID: 2526113 - View products that this article applies to.

SUMMARY

When a System Center Operations Manager 2007 R2 (SCOM) agent is updated to Cumulative Update 3 (CU3) or Cumulative Update 4 (CU4), non-SCOM services may be restarted or a reboot may be requested. The non-SCOM services can be related to other products like SQL Server, Exchange, Windows, SharePoint, etc.

The service restarts may happen on Windows Server 2008, Windows Vista and newer operating systems, while the reboot requests may happen on Windows Server 2003 and older operating systems.

Causes

A shared code library for logging events has leaked a reference to the dynamic library EventCommon.dll since SCOM 2007 R2 RTM. EventCommon.dll was first updated in CU3 which is why the service restarts started occurring with that CU. We fixed an install bug in CU4 which we believed would correct the problem, but found after CU4 released that there was another bug (the handle leak) which also caused non-SCOM services to restart. The performance counter extension MOMConnectorPerformance.dll uses the class library with the leak. When a process does a snapshot or enumeration of performance counters on a system, MOMConnectorPerformance.dll will be loaded into the process doing the snapshot. The library used by MOMConnectorPerformance.dll will load EventCommon.dll. After doing a performance counter snapshot Windows will automatically unload MOMConnectorPerformance.dll. Due to the leak, EventCommon.dll is not unloaded and left behind in the process.

While the leak can occur on any version of Windows, the service restart issue only affects Windows Server 2008 and Windows Server 2008 R2. Windows Server 2008 added a feature called Restart Manager which automatically restarts dependent processes when a file those processes depend on is replaced during an update. Windows Server 2003 and Windows Server 2003 may request a reboot after installing the patch.

Resolutions

Plan agent updates for a time when the possibility of services restarts will not impact service level agreements.
Update Management Servers and databases with the cumulative update, but wait until CU5 to update the agents. CU5 will fix the underlying leak. However, since the update is applying to a system which may have already leaked the reference to EventCommon.dll installing CU5 may exhibit a reboot request as we have disabled the interaction with Restart Manager. Once a system has been updated to CU5 future updates will not cause a reboot request.
You can determine whether a particular computer might be affected by running the following command at the command prompt or in PowerShell and looking for processes besides HealthService.exe & MonitoringHost.exe (specifically WmiPrvSE.exe):
tasklist /m EventCommon.dll
For instance, if you have explored the SCOM performance counters via PerfMon, you may find WmiPrvSE.exe (Windows Management Instrumentation service) in the list of tasks that are currently using EventCommon.dll.
To determine which services will be restarted if the Windows Management Instrumentation (WMI) service is restarted, run the following command in PowerShell:
(get-service winmgmt).dependentServices

Back to the top | Give Feedback

MORE INFORMATION

We are aware of only a small number of customers being affected by this problem.

Back to the top | Give Feedback

Note This is a "FAST PUBLISH" article created directly from within the Microsoft support organization. The information contained herein is provided as-is in response to emerging issues. As a result of the speed in making it available, the materials may include typographical errors and may be revised at any time without notice. See Terms of Use

(http://go.microsoft.com/fwlink/?LinkId=151500)

for other considerations.

Back to the top | Give Feedback