question

steveburdiez-5867 avatar image
0 Votes"
steveburdiez-5867 asked CyrAz commented

Operations Manager alerts related to wmi

Hi,

I have a windows server 2012 just created and I'm monitoring it with operations manager.
I got these two alerts, and I don't know what to do.



Alert Rule: Workflow Runtime: Failed to run a WMI query
Created: 04/05/2021 08:23:23
Module was unable to connect to namespace '\.\ROOT\CIMV2'
This has happened 6 times since this instance was loaded.



Alert Rule: AD CPU Overload Script Based Test Failed to Complete
Created: 04/05/2021 09:12:12
AD CPU Overload : The script AD LSASS CPU failed to retrieve the raw performance data for the lsass process via WMI
The error returned was: 'The wait operation timed out. '


Does anyone know what they are? What should I check to know that I have the server right?
Regards
Thanks


msc-operations-manager
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

CyrAz avatar image
1 Vote"
CyrAz answered

Looks like WMI on these servers is broken, that happens quite frequentely but it's not directly related to SCOM.
SCOM is simply telling you it's unable to connect to WMI... so now you need to find what's happening with WMI on these servers

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

StoyanChalakov avatar image
0 Votes"
StoyanChalakov answered

Hi @steveburdiez-5867,

Cyril has a point here. I noticed also this:

"This has happened 6 times since this instance was loaded.". This means that it was able to connect to WMI previously. So besides WMI corruption, you can also check for other WMI related issues.
You can also try to connect to wmi yourself and test this:

Wmi Troubleshooting on MS Docs

Hope I was able to help


(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)
Stoyan




5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

steveburdiez-5867 avatar image
0 Votes"
steveburdiez-5867 answered

93621-screenshot-1.png




If I do a test to connect to namespace it works correctly.

I do the test with wbemtest. Has it nothing to do with it?


screenshot-1.png (89.5 KiB)
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

CyrAz avatar image
0 Votes"
CyrAz answered steveburdiez-5867 commented

It is absolutely related, now the thing is it could be intermitently not working for various reasons (server heavily loaded for example, I've also had issues with this specific wmi class on non-english servers but it doesn't seem to be the case here).
You could try running a simple powershell loop to try to identify if it fails from time to time :

 $i = 1
 [int]$KOCount = "0"
 while ($i -lt 9999) 
 {
     $result = $null
     $result = Get-WmiObject -namespace "root\cimv2" -Query "select * from Win32_PerfFormattedData_PerfProc_Process"
     if ($result -ne $null) { Write-Host -ForegroundColor Green "OK. KO count : $kocount / $i" }
     else {
     $KOCount = $KOCount + 1
     Write-Host -ForegroundColor Red "KO. KO count : $kocount / $i"
     }
        
     $i++
     Start-Sleep -Seconds 15
 }
· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

The script was done well, it did not fail.

0 Votes 0 ·
CyrAz avatar image
0 Votes"
CyrAz answered CyrAz commented

Are the two alerts in the first post very recurring or just on that one occasion?

· 2
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

CyrAz avatar image CyrAz steveburdiez-5867 ·

OK so it could very well simply be a temporary perf issue that prevented access to WMI at that moment, I wouldn't bother with it too much if it doesn't happen again/on a frequent basis

0 Votes 0 ·