Article ID: 959865 - View products that this article applies to.
This Operations Manager Module update for System Center Operations Manager 2007 Service Pack 1 provides a resolution to the following issues and supersedes those updates that are listed in the More Information section:
On a Windows Server 2008-based failover cluster, the Operations Manager NTEventWorkflows are unloaded onto a virtual server. This occurs because of a problem in the detection of the physical computer name for the computer on which Operations Manager is running.
Additionally, the following event is logged in the Operations Manager event log on the active node:
This issue was first documented as Issue 7 as described in KB 954049:
Log Name: Operations Manager Source: Health Service Modules Date: <date> Event ID: 26004 Task Category: None Level: Error Keywords: Classic User: N/A Computer: <computer name> Description: The Windows Event Log Provider is still unable to open the System event log on computer <computer name>. The Provider has been unable to open the System event log for 7000 seconds.
(http://support.microsoft.com/kb/954049/ )Description of the hotfix rollup package for System Center Operations Manager 2007 Service Pack 1 and for System Center Essentials 2007 Service Pack 1: July 25, 2008
After a Windows Server 2003 or Windows Server 2008-based failover cluster node fails over to another node, old Operations Manager alerts are displayed in the Operations Manager console.
This problem occurs because of an issue in the Operations Manager NTEventLog module. When this issue occurs, the NTEventLog module cannot determine the last event log record for each Windows event log that is being monitored. Therefore, the module resets its pointer to the beginning of the monitored event log. This behavior can regenerate the alerts that are described in the monitored event log.
In a Microsoft failover cluster, resources that you want to make redundant are grouped into collections called resource groups. In these resource groups, you can have zero, one, or many network name resources. These network name resources are the names by which the network resources are addressed on the network.
By default, the Operations Manager agent selects only one network name for a resource group. That network name becomes the agentless managed entry for that resource group.
After you install this update, this default behavior can be overridden so that every network name resource in a resource group acn have a distinct agentless managed entry. To enable this behavior, follow the steps in the Enabling multiple entries for network name resources section.
Note When you enable this behavior, some duplicate alerts may occur. This is because the network names all correspond to the single physical node in the cluster. These alerts to come from the distinct agentless managed entries for the corresponding network names.
When Operations Manager monitors a plain text log file, the expected response from a monitor or rule does not occur if a null character was written to the plain text log file.
If an application writes a null character to a text file that Operations Manager is monitoring by using the ApplicationLog module, the module repeatedly reads the line that was logged before the null character. Therefore, no additional lines are read.
Note This issue was discovered while Operations Manager was monitoring some Oracle log files. This issue is not specific to monitoring log files on a failover cluster.
Depending on the operating system version and the configuration of a Microsoft Failover Cluster, events that are generated in the Windows Event Logs for clustered resources can be raised under the name of the physical node or under the network name that corresponds to the resource group.
By default, for all rules and monitors that use events as criteria, the Operations Manager agent implicitly filtered the event log to only show events that were raised from the network name for the resource group. Therefore, some events are not detected for clustered resources if the events were raised under the computer name of the physical nodes.
After you install this update, the default behavior is changed so that the implicit filter on the event log includes both the network name for the resource group and the computer name of the physical nodes.
Update InformationThis fix is contained within the Microsoft System Center Operations Manager 2007 Service Pack 1 update. To see a list of issues are fixed and how to obtain the cumulative rollup, refer to this article in the Microsoft Knowledge Base:
(http://support.microsoft.com/kb/971541/ )Description of System Center Operations Manager 2007 Service Pack 1
Hotfix InformationA supported hotfix is available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing this specific problem.
If the hotfix is available for download, there is a "Hotfix download available" section at the top of this Knowledge Base article. If this section does not appear, submit a request to Microsoft Customer Service and Support to obtain the hotfix.
Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, visit the following Microsoft Web site:
http://support.microsoft.com/contactus/?ws=supportNote The "Hotfix download available" form displays the languages for which the hotfix is available. If you do not see your language, it is because a hotfix is not available for that language.
PrerequisitesTo apply this hotfix, you must have System Center Operations Manager 2007 Service Pack 1 installed on the computer. This hotfix must be applied to each computer that hosts any of the following:
Restart RequirementYou do not have to restart the computer after you apply this hotfix.
Hotfix Replacement InformationThis hotfix replaces the hotfix of the following KB articles:
File InformationThe English version of this hotfix has the file attributes (or later) that are listed in the following table. The dates and times for these files are listed in coordinated universal time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.
System Center Operations Manager 2007 SP1 x86
Collapse this tableExpand this table
System Center Operations Manager 2007 SP1 IA-64
Collapse this tableExpand this table
System Center Operations Manager 2007 SP1 X64
Collapse this tableExpand this table
To extract the hotfix files that are contained in this hotfix, follow these steps:
Note To run this Windows installer file on Windows Server 2008, you must run this file as an administrator at a command prompt. If you do not run this Windows installer file as an administrator, the System Center Operations Manager 2007 Software Update splash screen will not be displayed. Therefore, you cannot install the hotfix.
Enabling multiple entries for network name resourcesTo enable the functionality that is described in Issue 3 of the Symptoms section, follow these steps:
After you apply the update and import the supplied cluster Management Pack library, the cluster resource names will not be discovered automatically. The default functionality may be changed by setting the new Multiple Servers Discovery override setting to True. To do this, follow these steps:
Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section of this article.
This update also supersedes certain module files in the following KB article:
(http://support.microsoft.com/kb/957123/ )Hotfix for System Center Operations Manager 2007 S957123 enables monitoring support for IIS 7.0
However, KB 957123 must be installed so that Internet Information Service (IIS) 7.0 can use the new MOMIISModules.dll module.
For additional information, click the following article number to view the article in the Microsoft Knowledge Base:
(http://support.microsoft.com/kb/824684/ )Description of the standard terminology that is used to describe Microsoft software updates
Contact us for more help
Connect with Answer Desk for expert help.