MOM 2005 agent logs an "existing connection was forcibly closed by the remote host" event

The Microsoft Operations Manager (MOM) 2005 agent logs the following events in the Microsoft Windows NT Application event log. The events typically occur after a new agent is deployed, and the link between the agent and Management Server is slow.

Event Type: Error
Event Source: Microsoft Operations Manager
Event Category: None
Event ID: 21293
User: NT AUTHORITY\SYSTEM
Description: The agent was unable to send data to the MOM Server at ManagementServerName. The error code is 10054. An existing connection was forcibly closed by the remote host.

Event Type: Information
Event Source: Microsoft Operations Manager
Event Category: None
Event ID: 26021
User: NT AUTHORITY\SYSTEM
Description: The agent has restored communication to ManagementServerName

This problem may occur if the agent does not respond to a Management Server request within one second. If the agent takes more than one second to respond, the Management Server closes the connection to the agent. For example, this problem may occur when a new agent is downloading new rules. You may experience this problem more frequently on agents that connect to a Management Server over a wide area network (WAN).

Service pack information

To resolve this problem, obtain the latest service pack for Microsoft Operations Manager 2005. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

Hotfix information

A supported hotfix is available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing this specific problem. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next software update that contains this hotfix.

If the hotfix is available for download, there is a "Hotfix download available" section at the top of this Knowledge Base article. If this section does not appear, contact Microsoft Customer Service and Support to obtain the hotfix.

Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, visit the following Microsoft Web site: Note The "Hotfix download available" form displays the languages for which the hotfix is available. If you do not see your language, it is because a hotfix is not available for that language.

Prerequisites

Install this hotfix only on Management Servers.

Restart requirement

This hotfix installation stops and then starts the MOM service (MOMService.exe).

Hotfix replacement information

This hotfix does not replace any other hotfixes.

File information

The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in coordinated universal time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel. After the hotfix is installed, the following files will have the listed attributes or later versions:

To install this hotfix

1. Create a folder on each MOM 2005 Management Server.
2. Copy the Mom2005-rtm-kb885416-x86-enu.exe file to the new folder on each server.
3. Log on locally to the Management Server, and then run the Mom2005-rtm-kb885416-x86-enu.exe file.

The hotfix installer program performs these steps:

1. Stops the MOM service.
2. Replaces the MomEngine.dll file on the Management Server.
3. Starts the MOM service.

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section. This problem was first corrected in Microsoft Operations Manager 2005 Service Pack 1.

After you install this hotfix, the connection time-out value on the Management Server is increased from one second to fifteen seconds. The new default value resolves the symptoms in most situations. Therefore, no additional action is typically necessary after you install the hotfix. However, the symptoms may still occur on slow WAN connections. If you continue to experience this problem after you apply this hotfix, you can use a new registry value to increase the time-out value. The new registry value is named ServerIOTimeoutMS and is implemented with this hotfix.

You must manually create the ServerIOTimeoutMS value. If this registry value does not exist, the Management Server uses the default value of 15,000 milliseconds (ms), or 15 seconds. To create the ServerIOTimeoutMS registry value and to increase the default time-out value, follow these steps on each Management Server that is experiencing the problem:

1. Start Registry Editor.
2. Locate and right-click the following registry subkey:
   HKEY_LOCAL_MACHINE\Software\Mission Critical Software\OnePoint\Configurations\configuration group name\Operations\Consolidator
3. Point to New, and then click DWORD Value.
4. Type ServerIOTimeoutMS as the value name, and then press ENTER.
5. Double-click the ServerIOTimeoutMS value, type a value that is larger than 15,000 ms. This value is the time that elapses before the Management Server times out an active agent connection if no response is received. The recommended maximum value for this registry entry is 120,000 ms, or 2 minutes. However, the value can be larger if it is required.
6. Close Registry Editor.
7. Stop and then start the MOM service on the Management Server.

For more information about other problems that are resolved by Microsoft Operations Manager 2005 Service Pack 1, click the following article number to view the article in the Microsoft Knowledge Base: For additional information, click the following article number to view the article in the Microsoft Knowledge Base: