The Microsoft Operations Manager (MOM) 2005 agent logs the following events in the Microsoft Windows NT Application event log.The events typically occur after a new agent is deployed, and the link between the agent and Management Server is slow.
Event Type: Error Event Source: Microsoft Operations Manager Event Category: None Event ID: 21293 User: NT AUTHORITY\SYSTEM Description:The agent was unable to send data to the MOM Server at ManagementServerName. The error code is 10054. An existing connection was forcibly closed by the remote host.
Event Type: Information Event Source: Microsoft Operations Manager Event Category: None Event ID: 26021 User: NT AUTHORITY\SYSTEM Description:The agent has restored communication to ManagementServerName
This problem may occur if the agent does not respond to a Management Server request within one second. If the agent takes more than one second to respond, the Management Server closes the connection to the agent.For example, this problem may occur when a new agent is downloading new rules. You may experience this problem more frequently on agents that connect to a Management Server over a wide area network (WAN).
Service pack information
To resolve this problem, obtain the latest service pack for Microsoft Operations Manager 2005. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
905416 How to obtain the latest Microsoft Operations Manager 2005 service pack
A supported hotfix is available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing this specific problem. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next software update that contains this hotfix.
If the hotfix is available for download, there is a "Hotfix download available" section at the top of this Knowledge Base article. If this section does not appear, contact Microsoft Customer Service and Support to obtain the hotfix.
Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, visit the following Microsoft Web site:
Note The "Hotfix download available" form displays the languages for which the hotfix is available. If you do not see your language, it is because a hotfix is not available for that language.
Install this hotfix only on Management Servers.
This hotfix installation stops and then starts the MOM service (MOMService.exe).
Hotfix replacement information
This hotfix does not replace any other hotfixes.
The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in coordinated universal time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.
Date Time Version Size File name -------------------------------------------------------------- 28-Sep-2004 15:45 6.0.2800.1106 602,624 Mom2005-rtm-kb885416-x86-enu.exe
After the hotfix is installed, the following files will have the listed attributes or later versions:
Date Time Version Size File name -------------------------------------------------------------- 27-Sep-2004 21:26 5.0.2749.2 1,629,424 Momengine.dll
To install this hotfix
Create a folder on each MOM 2005 Management Server.
Copy the Mom2005-rtm-kb885416-x86-enu.exe file to the new folder on each server.
Log on locally to the Management Server, and then run the Mom2005-rtm-kb885416-x86-enu.exe file.
The hotfix installer program performs these steps:
Stops the MOM service.
Replaces the MomEngine.dll file on the Management Server.
Starts the MOM service.
Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section. This problem was first corrected in Microsoft Operations Manager 2005 Service Pack 1.
After you install this hotfix, the connection time-out value on the Management Server is increased from one second to fifteen seconds. The new default value resolves the symptoms in most situations. Therefore, no additional action is typically necessary after you install the hotfix. However, the symptoms may still occur on slow WAN connections. If you continue to experience this problem after you apply this hotfix, you can use a new registry value to increase the time-out value. The new registry value is named ServerIOTimeoutMS and is implemented with this hotfix.
You must manually create the ServerIOTimeoutMS value. If this registry value does not exist, the Management Server uses the default value of 15,000 milliseconds (ms), or 15 seconds. To create the ServerIOTimeoutMS registry value and to increase the default time-out value, follow these steps on each Management Server that is experiencing the problem:
Start Registry Editor.
Locate and right-click the following registry subkey:
HKEY_LOCAL_MACHINE\Software\Mission Critical Software\OnePoint\Configurations\configuration group name\Operations\Consolidator
Point to New, and then click DWORD Value.
Type ServerIOTimeoutMS as the value name, and then press ENTER.
Double-click the ServerIOTimeoutMS value, type a value that is larger than 15,000 ms. This value is the time that elapses before the Management Server times out an active agent connection if no response is received. The recommended maximum value for this registry entry is 120,000 ms, or 2 minutes. However, the value can be larger if it is required.
Close Registry Editor.
Stop and then start the MOM service on the Management Server.
For more information about other problems that are resolved by Microsoft Operations Manager 2005 Service Pack 1, click the following article number to view the article in the Microsoft Knowledge Base:
905420 List of bugs that are fixed in Microsoft Operations Manager 2005 service packs
For additional information, click the following article number to view the article in the Microsoft Knowledge Base:
824684 Description of the standard terminology that is used to describe Microsoft software updates