Event Log Provider unable to open the System event log on Exchange CCR Cluster

[Morten Holst]

Hello


We are running two Exchange 2007 mailbox servers in a CRR cluster on two
windows 2008 servers.



I am getting errors from our Exchange 2007 servers in the event viewer:

The Windows Event Log Provider was unable to open the System event log on
computer 'SCH-CCR-CLU.xxx.no for reading.
The provider will retry opening the log every 30 seconds.

Most recent
error details: The request is not supported.



One or more workflows were affected by this.


Workflow name: many

Instance name: many

Instance ID: many

Management group: xxx

The Windows Event Log Provider was unable to open the System event log on
computer 'SCH-EXCHMBX-01.xxxno' for reading.
The provider will retry opening the log every 30 seconds.

Most recent
error details: The request is not supported.



One or more workflows were affected by this.


Workflow name: ServicesExchangeStoreTerminateE_5_Rule

Instance name: FSMPack2007_FSE.Forefront_Security_for_Exchange_Server___Mailbox__Public_Folder_Installation

Instance ID: {93BA2522-93BB-1B39-DD20-E8FD1290ECC9}

Management group: xxx



The errors are regarding the Forefront Security MP.
The system event log the Forefront Security MP have problems to access is
the cluster virtual network name account for the passive and active node.

I have installed all the hotfixes for Exchange 2007 that Microsoft recommend
for SCOM 2007 on our Exchange 2007 servers.

Is there a way to fix this?









Morten

[Åke Pettersson [MSFT}]

Hi Morten, are the virtual nodes discovered correctly in OpsMgr? Ie, you
need to enable Agent Proxy on all nodes of the cluster.

Åke

Post by Morten Holst
Hello
We are running two Exchange 2007 mailbox servers in a CRR cluster on two
windows 2008 servers.
The Windows Event Log Provider was unable to open the System event log on
computer 'SCH-CCR-CLU.xxx.no for reading.
The provider will retry opening the log every 30 seconds.
Most recent
error details: The request is not supported.
One or more workflows were affected by this.
Workflow name: many
Instance name: many
Instance ID: many
Management group: xxx
The Windows Event Log Provider was unable to open the System event log on
computer 'SCH-EXCHMBX-01.xxxno' for reading.
The provider will retry opening the log every 30 seconds.
Most recent
error details: The request is not supported.
One or more workflows were affected by this.
Workflow name: ServicesExchangeStoreTerminateE_5_Rule
FSMPack2007_FSE.Forefront_Security_for_Exchange_Server___Mailbox__Public_Folder_Installation
Instance ID: {93BA2522-93BB-1B39-DD20-E8FD1290ECC9}
Management group: xxx
The errors are regarding the Forefront Security MP.
The system event log the Forefront Security MP have problems to access is
the cluster virtual network name account for the passive and active node.
I have installed all the hotfixes for Exchange 2007 that Microsoft
recommend for SCOM 2007 on our Exchange 2007 servers.
Is there a way to fix this?
Morten

[Morten Holst]

The virtual nodes are discovered correctly and Agent Proxy is enabled on
both ccr cluster nodes.


Morten



Hello Åke Pettersson [MSFT},

Post by Åke Pettersson [MSFT}
Hi Morten, are the virtual nodes discovered correctly in OpsMgr? Ie,
you need to enable Agent Proxy on all nodes of the cluster.
Åke

Post by Morten Holst
Hello
We are running two Exchange 2007 mailbox servers in a CRR cluster on
two windows 2008 servers.
The Windows Event Log Provider was unable to open the System event log on
computer 'SCH-CCR-CLU.xxx.no for reading.
The provider will retry opening the log every 30 seconds.
Most recent
error details: The request is not supported.
One or more workflows were affected by this.
Workflow name: many
Instance name: many
Instance ID: many
Management group: xxx
The Windows Event Log Provider was unable to open the System event log on
computer 'SCH-EXCHMBX-01.xxxno' for reading.
The provider will retry opening the log every 30 seconds.
Most recent
error details: The request is not supported.
One or more workflows were affected by this.
Workflow name: ServicesExchangeStoreTerminateE_5_Rule
FSMPack2007_FSE.Forefront_Security_for_Exchange_Server___Mailbox__Pub
lic_Folder_Installation
Instance ID: {93BA2522-93BB-1B39-DD20-E8FD1290ECC9}
Management group: xxx
The errors are regarding the Forefront Security MP.
The system event log the Forefront Security MP have problems to access is
the cluster virtual network name account for the passive and active node.
I have installed all the hotfixes for Exchange 2007 that Microsoft
recommend for SCOM 2007 on our Exchange 2007 servers.
Is there a way to fix this?
Morten

[Morten Holst]

Could it be related to that i am running the Scom agent as local system at
our Exchange 2007 nodes?

Morten



Hello Morten,

Post by Morten Holst
The virtual nodes are discovered correctly and Agent Proxy is enabled
on both ccr cluster nodes.
Morten
Hello Åke Pettersson [MSFT},

Post by Åke Pettersson [MSFT}
Hi Morten, are the virtual nodes discovered correctly in OpsMgr? Ie,
you need to enable Agent Proxy on all nodes of the cluster.
Åke

Post by Morten Holst
Hello
We are running two Exchange 2007 mailbox servers in a CRR cluster on
two windows 2008 servers.
The Windows Event Log Provider was unable to open the System event log on
computer 'SCH-CCR-CLU.xxx.no for reading.
The provider will retry opening the log every 30 seconds.
Most recent
error details: The request is not supported.
One or more workflows were affected by this.
Workflow name: many
Instance name: many
Instance ID: many
Management group: xxx
The Windows Event Log Provider was unable to open the System event log on
computer 'SCH-EXCHMBX-01.xxxno' for reading.
The provider will retry opening the log every 30 seconds.
Most recent
error details: The request is not supported.
One or more workflows were affected by this.
Workflow name: ServicesExchangeStoreTerminateE_5_Rule
FSMPack2007_FSE.Forefront_Security_for_Exchange_Server___Mailbox__Pu
b lic_Folder_Installation
Instance ID: {93BA2522-93BB-1B39-DD20-E8FD1290ECC9}
Management group: xxx
The errors are regarding the Forefront Security MP.
The system event log the Forefront Security MP have problems to access is
the cluster virtual network name account for the passive and active node.
I have installed all the hotfixes for Exchange 2007 that Microsoft
recommend for SCOM 2007 on our Exchange 2007 servers.
Is there a way to fix this?
Morten

[Steven Halsey [MSFT]]

For the current Exchange 2007 and 2003 MPs the agents must be run under
Local System as the default account or workflows will fail.
--
Steven Halsey [MSFT]

This posting is provided "AS IS" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm

Post by Morten Holst
Could it be related to that i am running the Scom agent as local system at
our Exchange 2007 nodes?
Morten
Hello Morten,

Post by Morten Holst
The virtual nodes are discovered correctly and Agent Proxy is enabled
on both ccr cluster nodes.
Morten
Hello Åke Pettersson [MSFT},

Post by Åke Pettersson [MSFT}
Hi Morten, are the virtual nodes discovered correctly in OpsMgr? Ie,
you need to enable Agent Proxy on all nodes of the cluster.
Åke

Post by Morten Holst
Hello
We are running two Exchange 2007 mailbox servers in a CRR cluster on
two windows 2008 servers.
The Windows Event Log Provider was unable to open the System event log on
computer 'SCH-CCR-CLU.xxx.no for reading.
The provider will retry opening the log every 30 seconds.
Most recent
error details: The request is not supported.
One or more workflows were affected by this.
Workflow name: many
Instance name: many
Instance ID: many
Management group: xxx
The Windows Event Log Provider was unable to open the System event log on
computer 'SCH-EXCHMBX-01.xxxno' for reading.
The provider will retry opening the log every 30 seconds.
Most recent
error details: The request is not supported.
One or more workflows were affected by this.
Workflow name: ServicesExchangeStoreTerminateE_5_Rule
FSMPack2007_FSE.Forefront_Security_for_Exchange_Server___Mailbox__Pu
b lic_Folder_Installation
Instance ID: {93BA2522-93BB-1B39-DD20-E8FD1290ECC9}
Management group: xxx
The errors are regarding the Forefront Security MP.
The system event log the Forefront Security MP have problems to access is
the cluster virtual network name account for the passive and active node.
I have installed all the hotfixes for Exchange 2007 that Microsoft
recommend for SCOM 2007 on our Exchange 2007 servers.
Is there a way to fix this?
Morten

[Manjun]

In my case I am getting the same error on all SQL virtual serverss of Windows
2008 Server cluster as below:
The Windows Event Log Provider is still unable to open the
Application/System event log on computer "virutal SQL server name". The
Provider has been unable to open the Application event log for 720 seconds.

Most recent error details: The request is not supported.


One or more workflows were affected by this.

Workflow name: AgentMaintMode.OpsMgr.OFF
Instance name: Maintenance Mode Class
Instance ID: {A0A766C0-16D1-7D53-09D6-646FF75E0EBF}
Management group: yyyyy
<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
Any input will be highly appreciated, thanks,

Post by Steven Halsey [MSFT]
For the current Exchange 2007 and 2003 MPs the agents must be run under
Local System as the default account or workflows will fail.
--
Steven Halsey [MSFT]
This posting is provided "AS IS" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm

Post by Morten Holst
Could it be related to that i am running the Scom agent as local system at
our Exchange 2007 nodes?
Morten
Hello Morten,

Post by Morten Holst
The virtual nodes are discovered correctly and Agent Proxy is enabled
on both ccr cluster nodes.
Morten
Hello Åke Pettersson [MSFT},

Post by Åke Pettersson [MSFT}
Hi Morten, are the virtual nodes discovered correctly in OpsMgr? Ie,
you need to enable Agent Proxy on all nodes of the cluster.
Åke

Post by Morten Holst
Hello
We are running two Exchange 2007 mailbox servers in a CRR cluster on
two windows 2008 servers.
The Windows Event Log Provider was unable to open the System event log on
computer 'SCH-CCR-CLU.xxx.no for reading.
The provider will retry opening the log every 30 seconds.
Most recent
error details: The request is not supported.
One or more workflows were affected by this.
Workflow name: many
Instance name: many
Instance ID: many
Management group: xxx
The Windows Event Log Provider was unable to open the System event log on
computer 'SCH-EXCHMBX-01.xxxno' for reading.
The provider will retry opening the log every 30 seconds.
Most recent
error details: The request is not supported.
One or more workflows were affected by this.
Workflow name: ServicesExchangeStoreTerminateE_5_Rule
FSMPack2007_FSE.Forefront_Security_for_Exchange_Server___Mailbox__Pu
b lic_Folder_Installation
Instance ID: {93BA2522-93BB-1B39-DD20-E8FD1290ECC9}
Management group: xxx
The errors are regarding the Forefront Security MP.
The system event log the Forefront Security MP have problems to access is
the cluster virtual network name account for the passive and active node.
I have installed all the hotfixes for Exchange 2007 that Microsoft
recommend for SCOM 2007 on our Exchange 2007 servers.
Is there a way to fix this?
Morten

[Manjun]

In my case it happens on all sql virtual servers on Windows 2008 cluster
nodes as following:
The Windows Event Log Provider is still unable to open the
Application/System event log on computer 'virtual sql server FQDN'. The
Provider has been unable to open the Application event log for 720 seconds.

Most recent error details: The request is not supported.


One or more workflows were affected by this.

Workflow name: AgentMaintMode.OpsMgr.OFF
Instance name: Maintenance Mode Class
Instance ID: {A0A766C0-16D1-7D53-09D6-646FF75E0EBF}
Management group: yyyyyyxxxx
<<<<<<<<<<<<<<<<<<<<<<<<<
Thanks in advance for any input,

Post by Steven Halsey [MSFT]
For the current Exchange 2007 and 2003 MPs the agents must be run under
Local System as the default account or workflows will fail.
--
Steven Halsey [MSFT]
This posting is provided "AS IS" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm

Post by Morten Holst
Could it be related to that i am running the Scom agent as local system at
our Exchange 2007 nodes?
Morten
Hello Morten,

Post by Morten Holst
The virtual nodes are discovered correctly and Agent Proxy is enabled
on both ccr cluster nodes.
Morten
Hello Åke Pettersson [MSFT},

Post by Åke Pettersson [MSFT}
Hi Morten, are the virtual nodes discovered correctly in OpsMgr? Ie,
you need to enable Agent Proxy on all nodes of the cluster.
Åke

Post by Morten Holst
Hello
We are running two Exchange 2007 mailbox servers in a CRR cluster on
two windows 2008 servers.
The Windows Event Log Provider was unable to open the System event log on
computer 'SCH-CCR-CLU.xxx.no for reading.
The provider will retry opening the log every 30 seconds.
Most recent
error details: The request is not supported.
One or more workflows were affected by this.
Workflow name: many
Instance name: many
Instance ID: many
Management group: xxx
The Windows Event Log Provider was unable to open the System event log on
computer 'SCH-EXCHMBX-01.xxxno' for reading.
The provider will retry opening the log every 30 seconds.
Most recent
error details: The request is not supported.
One or more workflows were affected by this.
Workflow name: ServicesExchangeStoreTerminateE_5_Rule
FSMPack2007_FSE.Forefront_Security_for_Exchange_Server___Mailbox__Pu
b lic_Folder_Installation
Instance ID: {93BA2522-93BB-1B39-DD20-E8FD1290ECC9}
Management group: xxx
The errors are regarding the Forefront Security MP.
The system event log the Forefront Security MP have problems to access is
the cluster virtual network name account for the passive and active node.
I have installed all the hotfixes for Exchange 2007 that Microsoft
recommend for SCOM 2007 on our Exchange 2007 servers.
Is there a way to fix this?
Morten

[MWardlaw]

I'm having the same issue with SCOM 2007 and SQL MP. In Health Explorer we
have the following description for this alert:

Description:
The Windows Event Log Provider was unable to open the System event log on
computer '<SQL server cluster virtual node>' for reading. The provider will
retry opening the log every 30 seconds. Most recent error details: The
request is not supported. One or more workflows were affected by this.
Workflow name: Microsoft.SystemCenter.NTService.CollectSCMEvent Instance
name: SQL Server service monitoring Instance ID:
{A973E62E-C59C-FC71-210B-C544268DDC07} Management group: XXXXXXXXXX

There have been 720 state change events for this particular alert, it goes
from state "Successfully Accessed Event Log" to a state of "Failed to Access
Event Log" after a period of 30 seconds. It then stays in the Failed status
for around 1 hour.

Troubleshooting steps that I have actioned so far:

1. Installed the following patches to each node of the cluster:

The Event Log service may stop responding because of a deadlock on a Windows
Server 2008-based or Windows Vista-based computer
http://support.microsoft.com/kb/952664

An application may crash when it uses legacy methods to query performance
counter values in Windows Vista or in Windows Server 2008
http://support.microsoft.com/kb/953290

Restart each physical node of sql cluster after patches applied

2. Upgrade SQL MP to the latest version from the catalog - vers 6.0.6460.0

3. Restart SCOM RMS

Since SCOM is only reporting that it is unable to read the event log from
the sql cluster virtual node, it appears that the scope of the alert is
incorrect?

Cheers,

Michael

Post by Steven Halsey [MSFT]
For the current Exchange 2007 and 2003 MPs the agents must be run under
Local System as the default account or workflows will fail.
--
Steven Halsey [MSFT]
This posting is provided "AS IS" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm

Post by Morten Holst
Could it be related to that i am running the Scom agent as local system at
our Exchange 2007 nodes?
Morten
Hello Morten,

Post by Morten Holst
The virtual nodes are discovered correctly and Agent Proxy is enabled
on both ccr cluster nodes.
Morten
Hello Åke Pettersson [MSFT},

Post by Åke Pettersson [MSFT}
Hi Morten, are the virtual nodes discovered correctly in OpsMgr? Ie,
you need to enable Agent Proxy on all nodes of the cluster.
Åke

Post by Morten Holst
Hello
We are running two Exchange 2007 mailbox servers in a CRR cluster on
two windows 2008 servers.
The Windows Event Log Provider was unable to open the System event log on
computer 'SCH-CCR-CLU.xxx.no for reading.
The provider will retry opening the log every 30 seconds.
Most recent
error details: The request is not supported.
One or more workflows were affected by this.
Workflow name: many
Instance name: many
Instance ID: many
Management group: xxx
The Windows Event Log Provider was unable to open the System event log on
computer 'SCH-EXCHMBX-01.xxxno' for reading.
The provider will retry opening the log every 30 seconds.
Most recent
error details: The request is not supported.
One or more workflows were affected by this.
Workflow name: ServicesExchangeStoreTerminateE_5_Rule
FSMPack2007_FSE.Forefront_Security_for_Exchange_Server___Mailbox__Pu
b lic_Folder_Installation
Instance ID: {93BA2522-93BB-1B39-DD20-E8FD1290ECC9}
Management group: xxx
The errors are regarding the Forefront Security MP.
The system event log the Forefront Security MP have problems to access is
the cluster virtual network name account for the passive and active node.
I have installed all the hotfixes for Exchange 2007 that Microsoft
recommend for SCOM 2007 on our Exchange 2007 servers.
Is there a way to fix this?
Morten