Re: Monitoring and Alerts

Hi John,

Thanks for your update.

I am sorry for the delayed response due to weekend. Please understand that
the newsgroups are staffed weekdays by Microsoft Support professionals to
answer your systems and applications questions. Your understanding is
greatly appreciated!

From the reply, the process of sending the e-mail fails, and Health Monitor
indicates that "Action failed. 0x8004100a"

As I know, the issue may be caused by the following:

I. This behavior can occur because the Simple Mail Transfer Protocol (SMTP)
virtual server relay settings that run on an Exchange 2003-based server are
not configured correctly. This behavior may also occur if the server is
multi-homed and the external interface is listed first in the binding order.

Please first refer to the KB article below to verify the Binding Order and
Relay settings for Exchange SMTP Virtual Server:

280043 Health Monitor May Be Unable to Send E-Mail via Local Exchange SMTP
Server
http://support.microsoft.com/default.aspx?scid=kb;EN-US;280043

Try again to see if the problem still occurs.

II. It also is related WMI. You may follow these steps in order to resolve
WMI issues in general, check WMI at each step:

1. Start -> Run -> DCOMCNFG, Expand Component Services node, Expand
Computers node, Right click My Computer node, Properties, Select Default
COM Security tab:

Under "Default Launch Permissions" you should ensure that at least
INTERACTIVE, SYSTEM, and Administrators have "Allow Launch".

The "Default Access Permissions" should only list the following accounts:

2000: empty
XP: SYSTEM
2003: SELF, SYSTEM

As an alternative you can export (for backup) and then delete the following
registry key to restore the original default values.
HKLM\SOFTWARE\Microsoft\Ole\DefaultAccessPermission.

2. Go to DCOM Config node now, Right click Windows Management [and]
Instrumentation, Properties:

Here are some of the settings you should verify.
Authentication Level: Default
Launch Permissions: Use Default (2000) or Everyone (XP/2003)
Access Permissions: Use Default

3. Go to Services, Double click on "Windows Management Instrumentation":
Under "General" tab verify that Startup Type is set to "Automatic". Under
"Log On" tab verify that "Local System account" is selected.
4. Start "gpedit.msc" and navigate down to "Local Computer Policy ->
Computer Configuration -> Windows Settings -> Security Settings -> Local
Policies -> User Rights Assignment". Verify that the SERVICE account is
specifically granted "Impersonate a client after Authentication" rights.
5. A very important step that fixes this issue most number of times is by
running this command:

From Start->Run-> Type:> "secedit /configure /cfg
%windir%\repair\secsetup.inf /db secsetup.sdb /verbose" and reboot the
server.

6. Re-Register all WMI DLLs. Stop and Disabled the WMI service. From the
command prompt run the following command to re-register all WMI modules:

"for /f %s in ('dir /b /s *.dll') do regsvr32 /s %s"

After this command is complete, start the WMI service and run this command:

"wmiprvse /regserver"

Also run the following commands: wmimgmt /clearadap and wmimgmt /resyncperf.

I appreciate your time and look forward to hearing from you.

Best regards,

Crina Li (MSFT)

Microsoft CSS Online Newsgroup Support

Get Secure! - www.microsoft.com/security

=====================================================
This newsgroup only focuses on SBS technical issues. If you have issues
regarding other Microsoft products, you'd better post in the corresponding
newsgroups so that they can be resolved in an efficient and timely manner.
You can locate the newsgroup here:
http://www.microsoft.com/communities/newsgroups/en-us/default.aspx

When opening a new thread via the web interface, we recommend you check the
"Notify me of replies" box to receive e-mail notifications when there are
any updates in your thread. When responding to posts via your newsreader,
please "Reply to Group" so that others may learn and benefit from your
issue.

Microsoft engineers can only focus on one issue per thread. Although we
provide other information for your reference, we recommend you post
different incidents in different threads to keep the thread clean. In doing
so, it will ensure your issues are resolved in a timely manner.

For urgent issues, you may want to contact Microsoft CSS directly. Please
check http://support.microsoft.com for regional support phone numbers.

Any input or comments in this thread are highly appreciated.

=====================================================

This posting is provided "AS IS" with no warranties, and confers no rights.
--------------------
| From: "John" <spam001(at)plasticcircus(dot)com>
| References: <eIu7z#cfGHA.4464@xxxxxxxxxxxxxxxxxxxx>
<LT4cvxkfGHA.4336@xxxxxxxxxxxxxxxxxxxxx>
<OeYSPsBgGHA.1520@xxxxxxxxxxxxxxxxxxxx>
<zghAEpJgGHA.1740@xxxxxxxxxxxxxxxxxxxxx>
| Subject: Re: Monitoring and Alerts
| Date: Fri, 26 May 2006 14:36:31 -0700
| Lines: 795
| MIME-Version: 1.0
| Content-Type: multipart/alternative;
| boundary="----=_NextPart_000_0007_01C680D1.C8DEE990"
| X-Priority: 3
| X-MSMail-Priority: Normal
| X-Newsreader: Microsoft Outlook Express 6.00.2900.2869
| X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2869
| Message-ID: <Oxn62xQgGHA.1856@xxxxxxxxxxxxxxxxxxxx>
| Newsgroups: microsoft.public.windows.server.sbs
| NNTP-Posting-Host: user-v8lmf6j.cable.mindspring.com 209.91.60.211
| Path: TK2MSFTNGXA01.phx.gbl!TK2MSFTNGP01.phx.gbl!TK2MSFTNGP03.phx.gbl
| Xref: TK2MSFTNGXA01.phx.gbl microsoft.public.windows.server.sbs:271205
| X-Tomcat-NG: microsoft.public.windows.server.sbs
|
| > 1. Do you type the external email address when you run Set Up
Monitoring
| > Reports and Alerts wizard?
| The server was configured to send performance alerts to both my Mobile
phone's email address and my internal email address.
| > 2. Please rerun Set Up Monitoring Reports and Alerts wizard and only
| > configure an internal email address for those alert emails to be sent,
and
| > restart a service, will the email be sent fine?
| I re-ran the monitoring and alerts wizard
| I received the email confirming my settings
| I then stopped the world wide web publishing service
| I did not receive an email, nothing was left in the queue
| I opened my the health monitor and found alerts in both...
| health monitor> all monitored computers> my server> actions> send email
with monitoring alert> "Critical 5/26/2006 1:19:56 PM Send e-mail with
monitoring alert (my server) Action failed. View the
system32\wbem\logs\wbemess.log for more information. 0x8004100a :", "Ok
5/26/2006 1:19:56 PM Send e-mail with monitoring alert (my server) Action
was fired."
| &
| health monitor> all monitored computers> my server> small business server
alerts> exchange server alerts> Microsoft exchange management>"Critical
5/26/2006 1:19:56 PM Microsoft Exchange Management (my server)
MSExchangeMGMT service is Stopped.This service manages Exchange management
information that uses Windows Management Instrumentation (WMI). If this
service is stopped, Exchange management information using WMI is
unavailable.For more information about this event, see the event logs on
the server computer. You can restart this service by using the View
Services task in the Server Management Monitoring and Reporting taskpad.You
can disable this alert by using the Change Alert Notifications task.
| "
| > 3. Have you seen these emails in the queue?
| No, I do not find any emails in the queue.
| > 4. Can you receive Performance or other reports for the email?
| Yes I receive daily performance alerts, and weekly usage report just fine.
| > 5. Please perform a clean boot to see how thing goes:
| After performing a clean boot I didn't receive a system up time alert.
the exchange management alert is gone from the health monitor but the "send
email with monitoring alert" item is still in a critical state, even though
there are no alerts in the item.
| I have since restarted in normal mode.
| ""Crina Li"" <v-crinal@xxxxxxxxxxxxxxxxxxxx> wrote in message
news:zghAEpJgGHA.1740@xxxxxxxxxxxxxxxxxxxxxxxx
| > Hi John,
| >
| > Thanks for your update.
| >
| > I have reviewed the log and found no useful information. To narrow down
the
| > problem, would you please help me collect the following information?
| >
| > 1. Do you type the external email address when you run Set Up
Monitoring
| > Reports and Alerts wizard?
| > 2. Please rerun Set Up Monitoring Reports and Alerts wizard and only
| > configure an internal email address for those alert emails to be sent,
and
| > restart a service, will the email be sent fine?
| > 3. Have you seen these emails in the queue?
| > 4. Can you receive Performance or other reports for the email?
| > 5. Please perform a clean boot to see how thing goes:
| >
| > 1) Click Start, click Run, and then in the Open box, type "MSCONFIG"
| > (without the quotation marks). Click OK.
| > 2) In the System Configuration Utility (MSConfig) window, click to
select
| > the Selective Startup button.
| > 3) Click to clear the check mark from the "Load startup items" below
| > Selective Startup.
| > 4) Click the Services tab, click to check the "Hide All Microsoft
Services"
| > box, and remove all the check marks from the remained Non-Microsoft
| > Services. Please note that the Exchange services could be marked as
| > non-Microsoft. Please do not disable those services.
| > 5) Click OK to close the MSConfig window. Click Yes when you are asked
to
| > restart your computer in order to enable the changes.
| > 6) After restarting, please check whether this issue will reoccur.
| >
| > More information:
| >
| > 280043 Health Monitor May Be Unable to Send E-Mail via Local Exchange
SMTP
| > http://support.microsoft.com/?id=280043
| >
| > Please feel free to let me know if there is anything I can do for you.
| >
| > I appreciate your time and look forward to hearing from you.
| >
| > Best regards,
| >
| > Crina Li (MSFT)
| >
| > Microsoft CSS Online Newsgroup Support
| >
| > Get Secure! - www.microsoft.com/security
| >
| > =====================================================
| > This newsgroup only focuses on SBS technical issues. If you have issues
| > regarding other Microsoft products, you'd better post in the
corresponding
| > newsgroups so that they can be resolved in an efficient and timely
manner.
| > You can locate the newsgroup here:
| > http://www.microsoft.com/communities/newsgroups/en-us/default.aspx
| >
| > When opening a new thread via the web interface, we recommend you check
the
| > "Notify me of replies" box to receive e-mail notifications when there
are
| > any updates in your thread. When responding to posts via your
newsreader,
| > please "Reply to Group" so that others may learn and benefit from your
issue.
| >
| > Microsoft engineers can only focus on one issue per thread. Although we
| > provide other information for your reference, we recommend you post
| > different incidents in different threads to keep the thread clean. In
doing
| > so, it will ensure your issues are resolved in a timely manner.
| >
| > For urgent issues, you may want to contact Microsoft CSS directly.
Please
| > check http://support.microsoft.com for regional support phone numbers.
| >
| > Any input or comments in this thread are highly appreciated.
| >
| > =====================================================
| >
| > This posting is provided "AS IS" with no warranties, and confers no
rights.
| > --------------------
| > | From: "John" <spam001(at)plasticcircus(dot)com>
| > | References: <eIu7z#cfGHA.4464@xxxxxxxxxxxxxxxxxxxx>
| > <LT4cvxkfGHA.4336@xxxxxxxxxxxxxxxxxxxxx>
| > | Subject: Re: Monitoring and Alerts
| > | Date: Thu, 25 May 2006 09:48:30 -0700
| > | Lines: 125
| > | X-Priority: 3
| > | X-MSMail-Priority: Normal
| > | X-Newsreader: Microsoft Outlook Express 6.00.2900.2869
| > | X-RFC2646: Format=Flowed; Original
| > | X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2869
| > | Message-ID: <OeYSPsBgGHA.1520@xxxxxxxxxxxxxxxxxxxx>
| > | Newsgroups: microsoft.public.windows.server.sbs
| > | NNTP-Posting-Host: user-v8lmf6j.cable.mindspring.com 209.91.60.211
| > | Path: TK2MSFTNGXA01.phx.gbl!TK2MSFTNGP01.phx.gbl!TK2MSFTNGP03.phx.gbl
| > | Xref: TK2MSFTNGXA01.phx.gbl microsoft.public.windows.server.sbs:270881
| > | X-Tomcat-NG: microsoft.public.windows.server.sbs
| > |
| > | You can check the settings in
| > | > Health Monitor: Click Start\Administrative Tools\Health Monitor,
expand
| > | > Small Business Alerts\Core Server Alerts, can you see System Up
Time and
| > | > World Wide Web Publishing?
| > |
| > | Yes, System Up Time, World Wide Web Publishing, and a long list of
others
| > | including DHCP Server, Print Spooler, SMTP, etc.
| > |
| > | >1. Are there any related error messages in Event Log?
| > | There are messages in the event log stating that the IIS service has
| restarted, and that the system has restarted, but nothing about an
error
| > | sending a message.
| > |
| > | > 2. SBSMSI-Monitoring.log from the C:\Program Files\Microsoft
| > | > Integration\Windows Small Business Server 2003\Logs folder.
| > | I will email that to you..
| > |
| > | > 3. Do you mean you can not receive any Alerts?
| > | Correct, I do not receive any alerts other than the initial
confirmation
| > | message after configuring the alerts.
| > |
| > |
| > | ""Crina Li"" <v-crinal@xxxxxxxxxxxxxxxxxxxx> wrote in message
| > | news:LT4cvxkfGHA.4336@xxxxxxxxxxxxxxxxxxxxxxxx
| > | > Hi John,
| > | >
| > | > Thank you for posting in SBS newsgroup.
| > | >
| > | > From your description, I understand the issue to be: you have
configured
| > | > Monitoring and Alerts through Set Up Monitoring Reports and Alerts
wizard.
| > | > However you can not receive alerts when the server restart and IIS
stop.
| > | > If
| > | > I have misunderstood your concern, please do not hesitate to let me
| > know.
| > | >
| > | > As I know, you should be able to receive the alert when system
restarts
| > | > after you configure Monitoring and Reporting. You can check the
| > settings
| > | > in
| > | > Health Monitor: Click Start\Administrative Tools\Health Monitor,
expand
| > | > Small Business Alerts\Core Server Alerts, can you see System Up
Time and
| > | > World Wide Web Publishing?
| > | >
| > | > If it does exist, would you please help me collect the following
| > | > information?
| > | >
| > | > 1. Are there any related error messages in Event Log?
| > | > 2. SBSMSI-Monitoring.log from the C:\Program Files\Microsoft
| > | > Integration\Windows Small Business Server 2003\Logs folder.
| > | > 3. Do you mean you can not receive any Alerts?
| > | >
| > | > I appreciate your time and look forward to hearing from you.
| > | >
| > | > Best regards,
| > | >
| > | > Crina Li (MSFT)
| > | >
| > | > Microsoft CSS Online Newsgroup Support
| > | >
| > | > Get Secure! - www.microsoft.com/security
| > | >
| > | > =====================================================
| > | > This newsgroup only focuses on SBS technical issues. If you have
issues
| > | > regarding other Microsoft products, you'd better post in the
| > corresponding
| > | > newsgroups so that they can be resolved in an efficient and timely
manner.
| > | > You can locate the newsgroup here:
| > | > http://www.microsoft.com/communities/newsgroups/en-us/default.aspx
| > | >
| > | > When opening a new thread via the web interface, we recommend you
check
| > | > the
| > | > "Notify me of replies" box to receive e-mail notifications when
there
| > are
| > | > any updates in your thread. When responding to posts via your
| > newsreader,
| > | > please "Reply to Group" so that others may learn and benefit from
your
| > | > issue.
| > | >
| > | > Microsoft engineers can only focus on one issue per thread.
Although we
| > | > provide other information for your reference, we recommend you post
| > | > different incidents in different threads to keep the thread clean.
In
| > | > doing
| > | > so, it will ensure your issues are resolved in a timely manner.
| > | >
| > | > For urgent issues, you may want to contact Microsoft CSS directly.
Please
| > | > check http://support.microsoft.com for regional support phone
numbers.
| > | >
| > | > Any input or comments in this thread are highly appreciated.
| > | >
| > | > =====================================================
| > | >
| > | > This posting is provided "AS IS" with no warranties, and confers no
| > | > rights.
| > | > --------------------
| > | > | From: "John" <spam001(at)plasticcircus(dot)com>
| > | > | Subject: Monitoring and Alerts
| > | > | Date: Mon, 22 May 2006 11:44:04 -0700
| > | > | Lines: 13
| > | > | X-Priority: 3
| > | > | X-MSMail-Priority: Normal
| > | > | X-Newsreader: Microsoft Outlook Express 6.00.2900.2869
| > | > | X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2869
| > | > | X-RFC2646: Format=Flowed; Original
| > | > | Message-ID: <eIu7z#cfGHA.4464@xxxxxxxxxxxxxxxxxxxx>
| > | > | Newsgroups: microsoft.public.windows.server.sbs
| > | > | NNTP-Posting-Host: user-v8lmf6j.cable.mindspring.com 209.91.60.211
| > | > | Path:
TK2MSFTNGXA01.phx.gbl!TK2MSFTNGP01.phx.gbl!TK2MSFTNGP04.phx.gbl
| > | > | Xref: TK2MSFTNGXA01.phx.gbl
microsoft.public.windows.server.sbs:269908
| > | > | X-Tomcat-NG: microsoft.public.windows.server.sbs
| > | > |
| > | > | After configuring the monitoring and alerts wizard to send
critical
| > | > alerts
| > | > | to my email address and mobile phone, I received a test on both
my
| > phone
| > | > and
| > | > | in my email inbox.
| > | > |
| > | > | But whenever there is a critical event such as the server
restarting,
| > | > the
| > | > | IIS service stopping, or anything else, no alert is sent out.
| > | > |
| > | > | I'm running SBS 2003 sp2 premium, with ISA 2004 installed on the
SBS
| > | > | Where should I look for solutions?
| > | > |
| > | > | Thank you all in advance.
| > | > |
| > | > |
| > | > |
| > | >
| > |
| > |
| > |
| >
|

.