The MOM service may crash when you run the discovery process on many agent computers in MOM 2005

You may experience one of the following problems:

• Problem 1
  In Microsoft Operations Manager (MOM) 2005, the MOM service (Momservice.exe) may crash when you run the discovery process on many agent computers. Therefore, the functionality that this service provides is lost.
• Problem 2
  When MOM 2005 monitors a UNICODE log file by using the Application log provider with the Generic single-line log file type, you may experience high CPU usage on the agent when the log is monitored.

You may experience one of the following symptoms:

• Symptom 1
  You may see the following events in the Application log:

  Event Type: Error 
  Event Source: Microsoft Operations Manager 
  Event Category: None 
  Event ID: 9014 
  Date: Date 
  Time: Time 
  User: N/A 
  Computer: Computer Name 
  Description: The Microsoft Operations Manager service (MOMService.exe) terminated due to an unhandled exception. It will attempt to restart itself. 
  

  Event Type: Error 
  Event Source: Microsoft Operations Manager 
  Event Category: None 
  Event ID: 9015 
  Date: Date 
  Time: Time 
  User: N/A 
  Computer: Computer Name 
  Description: The Microsoft Operations Manager service (MOMService.exe) received an unexpected exception. 
  Thread Id: ID 
  Thread Name: Name 
  Exception code: 0x00000000c0000005 
  Exception description: Access Violation 
  Exception address: address 
  Exception flags: 0x0 
  

• Symptom 2
  
  If you have installed the hotfix in KB927796, the monitoring of UNICODE log files may fail if a UNICODE Byte-Order Mark (BOM) is written to the file. The MOM Application log provider will continually re-read the BOM. Then, you may experience high CPU usage.
  
  For more information, click the following article number to view the article in the Microsoft Knowledge Base:
  927796  (http://support.microsoft.com/kb/927796/ ) Microsoft Operations Manager 2005 does not monitor log files that contain lines that have more than 4,096 characters

This problem occurs because the service receives incomplete data that causes an access violation issue.

Hotfix information

A supported hotfix is available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing the problem described in this article. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next software update that contains this hotfix.

If the hotfix is available for download, there is a "Hotfix download available" section at the top of this Knowledge Base article. If this section does not appear, contact Microsoft Customer Service and Support to obtain the hotfix.

Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, visit the following Microsoft Web site: Note The "Hotfix download available" form displays the languages for which the hotfix is available. If you do not see your language, it is because a hotfix is not available for that language.

Prerequisites

To apply this hotfix, you must have Microsoft Operations Manager (MOM) 2005 Service Pack 1 (SP1) installed on the computer.

Restart requirement

You do not have to restart the computer after you apply this hotfix.

Hotfix replacement information

This hotfix does not replace a previously released hotfix.

File information

The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.

Microsoft Operations Manager 2005, x86-based editions

Microsoft Operations Manager 2005, IA-64-based editions

Hotfix installation information

To apply this hotfix, follow these steps:

1. Copy the following file to a local folder or to an available network shared folder:
   MOM2005-SP1-KB949874-X86-IA64-ENU.MSI
2. Run this file locally on each applicable computer.
   
   Note You can run this file from Windows Explorer or at a command prompt. The MOM service is restarted when the hotfix is applied.

To apply the hotfix for the MOM agent component, use one of the following procedures:

• Use the MOM Administrator console to apply the hotfix to each MOM agent by using the Control Level = Full parameter.
  
  A list of agents that can be automatically updated is shown in the Pending Actions folder under Computers in the MOM Administrator console under Administration.
• Manually apply the hotfix on each MOM agent by using the Control Level = None parameter.
  
  These agents, if any, are listed in the Agent-managed Computers folder under Computers in the MOM Administrator console under Administration.

For agents that are manually installed by using the Control Level = Full parameter after the hotfix is applied to the MOM server, you can manually update the agent. Or, you can configure the MOM server to perform the update. To do this, follow these steps:

1. Make sure that the manual installation is approved by viewing the Pending Actions folder in the MOM Administrator console.
2. In the Agent-managed Computers folder, right-click the agent, and then run the Update Agent Settings task.

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

For more information about software update terminology, click the following article number to view the article in the Microsoft Knowledge Base: