Share via

Windows 2003 agent - SCOM 2012R2 - Failed to access Event Log (Warning Message)

Chua Liang Wei 186 Reputation points
2021-01-14T03:52:39.867+00:00

How can we fix this issue, the agent is configured using local system. Tried to flush the agent but did not recalculate,

The log path does not exist.

The Windows Event Log Provider was unable to open the Microsoft-Windows-TaskScheduler/Operational event log on computer <hostname>' for reading. The provider will retry opening the log every 30 seconds. Most recent error details: The system cannot find the file specified. One or more workflows were affected by this.

Operations Manager
Operations Manager
A family of System Center products that provide infrastructure monitoring, help ensure the predictable performance and availability of vital applications, and offer comprehensive monitoring for datacenters and cloud, both private and public.
1,421 questions
0 comments
Accepted answer
  1. CyrAz 5,181 Reputation points
    2021-01-21T11:45:58.967+00:00

    From the name of the workflow, it looks like it was created directly in the SCOM console by someone from your company.
    You can run the following command to find its display name and which management pack it's stored in : 

    Get-SCOMRule -Name MomUIGeneratedRuleafc86050fc76455eab425ce588c73c7e

5 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Chua Liang Wei 186 Reputation points
    2021-01-21T09:36:12.147+00:00

    Based on the detailed error message, it is possible to verify the error come from which MP?

    The Windows Event Log Provider was unable to open the Microsoft-Windows-TaskScheduler/Operational event log on computer '<hostname>' for reading. The provider will retry opening the log every 30 seconds. Most recent error details: The system cannot find the file specified. One or more workflows were affected by this. Workflow name: MomUIGeneratedRuleafc86050fc76455eab425ce588c73c7e Instance name: <hostname> Instance ID: {A13CAC3C-A6EC-3BF5-CA2B-5AB24F8799B0} Management group: <management group>

    The Windows Event Log Provider is still unable to open the Microsoft-Windows-TaskScheduler/Operational event log on computer '<hostname>'. The Provider has been unable to open the Microsoft-Windows-TaskScheduler/Operational event log for 720 seconds. Most recent error details: Access is denied. One or more workflows were affected by this. Workflow name: MomUIGeneratedRuleafc86050fc76455eab425ce588c73c7e Instance name: <hostname> Instance ID: {25B4AC38-00F1-6B4D-BDF0-0A08E167A048} Management group: <management group>

    0 comments