Solved

Advice on WMI / WINMGMT event logs after IIS reinstall

Posted on 2006-06-16
21
3,781 Views
Last Modified: 2010-08-05
Can any body give me some advice on how to resolve the following event logs please?

They began after I had to reinstall IIS, I also reinstalled Exchange and symantec mail security.

Event ID:      47
Date:            16/06/2006
Time:            14:37:23
User:            N/A
Computer:      SERVERNAME
Description:
WMI ADAP was unable to retrieve data from the PerfLib subkey: SYSTEM\CurrentControlSet\Services\MSSGTHRSVC\Performance\Library, error code: 0x80041009

Event Type:      Warning
Event Source:      WinMgmt
Event Category:      None
Event ID:      47
Date:            16/06/2006
Time:            14:37:23
User:            N/A
Computer:      SERVERNAME
Description:
WMI ADAP was unable to retrieve data from the PerfLib subkey: SYSTEM\CurrentControlSet\Services\mssindex\Performance\Library, error code: 0x80041009

Event Type:      Warning
Event Source:      WinMgmt
Event Category:      None
Event ID:      5603
Date:            16/06/2006
Time:            14:42:28
User:            NT AUTHORITY\SYSTEM
Computer:      SERVERNAME
Description:
A provider, PerfProv, has been registered in the WMI namespace, ROOT\CIMV2\MicrosoftHealthMonitor\PerfMon, but did not specify the HostingModel property.  This provider will be run using the LocalSystem account.  This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.  Ensure that provider has been reviewed for security behavior and update the HostingModel property of the provider registration to an account with the least privileges possible for the required functionality.

Event Type:      Warning
Event Source:      WinMgmt
Event Category:      None
Event ID:      5603
Date:            16/06/2006
Time:            14:42:28
User:            NT AUTHORITY\SYSTEM
Computer:      SERVERNAME
Description:
A provider, PerfProv, has been registered in the WMI namespace, ROOT\CIMV2\MicrosoftHealthMonitor\PerfMon, but did not specify the HostingModel property.  This provider will be run using the LocalSystem account.  This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.  Ensure that provider has been reviewed for security behavior and update the HostingModel property of the provider registration to an account with the least privileges possible for the required functionality.

Any help would be much appreciated as the documentation on the above errors is scarce.

Regards

Guy_Adams
0
Comment
Question by:Guy_Adams
  • 11
  • 10
21 Comments
 
LVL 2

Author Comment

by:Guy_Adams
ID: 16920880
Also I keep getting an email from the server with this information in it:

SERVERNAME has reported a Error.  Reported status is:
Queues - Unknown
Drives - Unknown
Services - Error
Memory - Unknown
CPU - Unknown

Regards

GuyAdams
0
 
LVL 74

Expert Comment

by:Jeffrey Kane - TechSoEasy
ID: 16925372
Have you installed Windows Server 2003 Service Pack 1 without installing the remainder of the required SBS Service Pack 1 components?

http://support.microsoft.com/kb/915148

http://sbsurl.com/sp1

Jeff
TechSoEasy

0
 
LVL 2

Author Comment

by:Guy_Adams
ID: 16926572
Originally before I had to reinstall IIS, I installed SP1, all 5 parts.

Then I reinstalled IIS, Exchange and Sharepoint and only installed the 2nd part (sharepoint sp1) and exchange SP2.

When I reinstalled SBS monitoring, I installed it from the cd3 folder of the SP1 for SBS.

Thanks for your response Jeff.

Regards

Guy_Adams
0
 
LVL 74

Expert Comment

by:Jeffrey Kane - TechSoEasy
ID: 16928450
If you've reinstalled all that stuff you need to repply SBS SP1 again.  (Any time you reinstall a component you have to reapply SBS SP1, just the SBS portion, not all 5 parts).  Because of this, I've actually just stored the Service Pack installation files on my server's hard drive in the same way you'd have an i386 folder with the OS install files.

Jeff
TechSoEasy
0
 
LVL 2

Author Comment

by:Guy_Adams
ID: 16929398
What's annoying is the fact since posting this the the issue seems to have stopped. Although I have still had two of the strange emails as I mentioned above. Dont understand why the server would send that email but not log any errors in the event log?

I will reapply SBS SP1 and see if this irons the issue out.

Regards

Guy Adams
0
 
LVL 74

Expert Comment

by:Jeffrey Kane - TechSoEasy
ID: 16931311
That email doesn't seem as though it is coming from the SBS Health Monitor.  Can you look at the headers on the email and post those here?

Jeff
TechSoEasy
0
 
LVL 2

Author Comment

by:Guy_Adams
ID: 16932459
Header information seems fine:

Microsoft Mail Internet Headers Version 2.0
Received: from SERVERNAME ([192.168.110.2]) by domainname.com with Microsoft SMTPSVC(6.0.3790.1830);
       Sun, 18 Jun 2006 21:13:00 +0100
Date: Sun, 18 Jun 2006 20:13:00 GMT
To: myemail@domainname.com
Cc:
From: <WMI@SERVERNAME>
Sender: <WMI@NAMESERVER>
Reply-To:
Subject: Error on SERVERNAME
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="- - =_HH_= - ---"
Return-Path: WMI@SERVERNAME
Message-ID: <SERVERNAME2gRs0000001c@domainname.com>
X-OriginalArrivalTime: 18 Jun 2006 20:13:00.0323 (UTC) FILETIME=[98C33730:01C69313]

--- - =_HH_= - ---
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit


--- - =_HH_= - -----

I checked the event logs and no critical errors or warnings.

Just thought I would let you know, not long after I reinstalled IIS, I got a load of database errors for DHCP in the system log, they all said consult the DHCP reports, I did so and there was nothing in them to indicate an issue. This behaviour has since stopped. There has been no problems with DHCP.

I expect a few errors when you reinstall such a massive piece of a server, I mean IIS, Exchange, Sharepoint and WSUS is quite a large part of the server and this is what I put the DHCP errors down to.

I will re-apply SP1 today.

Regards

GuyAdams

0
 
LVL 74

Expert Comment

by:Jeffrey Kane - TechSoEasy
ID: 16932518
WHOA!!!!  WSUS???? You seemed to have skipped that part in the beginning!!!

Actually, you've not been very revealing at all about what's changed lately... it's like pulling teeth to get this stuff outta you!  :-)

By chance, did you follow the SBS Guidelines for installing WSUS???  Please see http://sbsurl.com/wsus for details.  Not following these guidelines will cause all sorts of errors.  And I've reinstalled IIS, Exchange and Shrarepoint many times and there should NOT be any errors other than immediatly during and after the reinstall.

Jeff
TechSoEasy
0
 
LVL 74

Expert Comment

by:Jeffrey Kane - TechSoEasy
ID: 16932523
P. S.  a newsgroup post seems to have included this info... which I just now saw:  http://snipurl.com/ryus

Jeff
TechSoEasy
0
 
LVL 2

Author Comment

by:Guy_Adams
ID: 16932589
Jeff, thats not my post.

I have several none production SBS servers which I have been using for test labs, our network has only one SBS which acts as a GC, with other 2003 servers as secondary DC's.

The reason I had to reinstall IIS was because I have just taken this network on, the admin before this was a part time admin who as It turned out didnt really seem to know much. I've been trying to tidy some of the mess he's left but to be honest i was 50/50 as to if it would have been easier to reinstall 2 of the 5 servers completely.

IIS was in a mess and nothing much worked, no OWA, no OMA, no monitoring and reporting and a IUSR issue. Slowly but surely I have managed to get IIS sorted, with help from others, especially EE. Iam no expert with IIS or Sharepoint.

The DHCP errors came as a surprise to me, and have vanished now, the WMI / WINMGMT event log error have also now ceased, its just the email which I cannot figure out.

I hope this clears things a little.

Regards

GuyAdams



0
Highfive + Dolby Voice = No More Audio Complaints!

Poor audio quality is one of the top reasons people don’t use video conferencing. Get the crispest, clearest audio powered by Dolby Voice in every meeting. Highfive and Dolby Voice deliver the best video conferencing and audio experience for every meeting and every room.

 
LVL 2

Author Comment

by:Guy_Adams
ID: 16932610
When I first started trouble shooting IIS, I tried reinstalling it then restoring the metabase but the issues came back, so I then reinstalled IIS and all the applications that ran on it:

IIS
Exchange
Sharepoint
WSUS
Symantec Mail Security

Sorry I did not include this information, my fault.

Regards

GuyAdams
0
 
LVL 74

Expert Comment

by:Jeffrey Kane - TechSoEasy
ID: 16932925
Guy,

I truly understand your pain... especially when coming in and having to deal with all that.  The majority of my consulting practice these days is reinstalling SBS's that have been wrongly installed by apparently highly skilled individuals that had no concept of SBS.  Even though you've mostly figured things out, I hope you don't mind a bit of further info/review...

I would point out... that your comment "I am no expert with IIS or Sharepoint." boarders on this type of issue though... even if ever so slightly, and given that you seem quite knowledgeable about a number of other things and I'm probably reading A LOT into your quick tidbits of a post... so bear with me.

SBS requires that you pretty much check all of your enterprise server knowledge at the door.  Because SBS contains modules and roles that you would never combine in a single standard server it is managed much differently... EVERYTHING needs to be done the SBS way if there is an SBS way to do it.  Even though SBS is basically a preconfigured server, it unfortunately does not block the ability to configure something manually that could break something else.  So, it's even more important that if you are managing an SBS machine and you have other basic server management knowledge that you make sure you keep up with SBS information and announcements.

So... take a look at http://sbsurl.com/itpro and http:Q_21831460.html which has a host of other links that will provide good SBS info.

And... to help you solve the email issue... that message is NOT coming from the SBS Monitoring... it looks as though you may have another DNS server on your network???  (I'm guessing because of the SENDER being WMI@NAMESERVER -- this is NOT what a regular SBS alert would come from... if you have any available to you, compare the headers).

I'd take a look in your Exchange logs and see if you can track down the actual machine that's sending these out.

Jeff
TechSoEasy


0
 
LVL 2

Author Comment

by:Guy_Adams
ID: 16932987
Jeff,

Thanks for the advice, I love SBS, its a great product and although my knowledge of Windows Server 2000/2003 is good, SBS has been a learning curve for me, hence two none production test lab SBS servers and as little work as possible completed on the production server.

The headers I removed the servername / domain / email information from and used SERVERNAME and DOMAINNAME as replacements.

There are other DNS servers on the network but the email headers confirm this email was received from the SBS.

I have incorrectly changed one of the header entries, it was:

<WMI@NAMESERVER>

it should of been

<WMI@SERVERNAME>

That was my fault.

Its just really thrown me this, you would think that if you received an email saying there is an error then something would be posted in the event logs too.

Thanks for your help / advice so far Jeff, it is much appreciated.

Regards

Guy Adams
0
 
LVL 2

Author Comment

by:Guy_Adams
ID: 16933026
By the way, I enjoyed reading your articles on 'unified platform' I think since taking on an SBS I have begun to understand that more and more.

Thanks

Guy_Adams
0
 
LVL 74

Expert Comment

by:Jeffrey Kane - TechSoEasy
ID: 16933080
Even if your NAMESERVER/SERVERNAME was a typo... I'd still suggest that these are not coming form the SBS's Monitoring.  They very well may be going through Exchange though.... I think they are originating from another server on the network.

SBS Monitoring Alerts do not include a SENDER field, and by default they generally show 127.0.0.1 as the originating domain, not the actual private IP.

Here's a sample:

Microsoft Mail Internet Headers Version 2.0
Received: from sbs2003 ([127.0.0.1]) by sampleclient.com with Microsoft SMTPSVC(6.0.3790.1830);
       Tue, 13 Jun 2006 21:59:51 -0700
thread-index: AcaPb15SoQHHlfrrSnWpcIKxMPsrow==
Thread-Topic: Routing and Remote Access Alert on SBS2003
From: "Sample Client" <Administrator@sampleclient.com>
To: <recipient@destination.com>
Cc:
Bcc:
Subject: Routing and Remote Access Alert on SBS2003
Date: Tue, 13 Jun 2006 21:59:51 -0700
Message-ID: <000001c68f6f$5e52e2f0$0210a8c0@sampleclient.local>
MIME-Version: 1.0
Content-Type: text/plain
Content-Transfer-Encoding: 7bit
X-Mailer: Microsoft CDO for Exchange 2000
Content-Class: urn:content-classes:message
Importance: normal
Priority: normal
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.2663
Return-Path: Administrator@sampleclient.com
X-OriginalArrivalTime: 14 Jun 2006 04:59:51.0405 (UTC) FILETIME=[5E5EC9D0:01C68F6F]

These are fairly standard across all SBS's that I manage.

Jeff
TechSoEasy
0
 
LVL 2

Author Comment

by:Guy_Adams
ID: 16933105
I appreciate what you are saying but why would it say:

Sender: <WMI@OUR_SBS_SERVERNAME>

I'm currently check the logs of the other DC's for WMI / WINMGMT logs.

Regards

Guy_Adams
0
 
LVL 74

Expert Comment

by:Jeffrey Kane - TechSoEasy
ID: 16933112
well, if it does have your sbs servername, then perhaps there is some other wmi monitoring program running on the server?

Jeff
TechSoEasy
0
 
LVL 2

Author Comment

by:Guy_Adams
ID: 16933155
I have just located the WMI logs manual and found the following:

(Fri Jun 16 07:39:06 2006.221793968) : Received Event
(Fri Jun 16 07:39:14 2006.221802296) : Received Event
(Fri Jun 16 07:46:42 2006.209812) : WDM call returned error: 4200
(Fri Jun 16 07:46:43 2006.210812) : Received Event
(Fri Jun 16 07:46:43 2006.210828) : CreateFile FAILED for filename:
(Fri Jun 16 07:46:43 2006.210859) : inetinfo.exe(Fri Jun 16 07:46:43 2006.210859) :
(Fri Jun 16 07:46:43 2006.210859) : : GetlastError returned 2
(Fri Jun 16 07:46:49 2006.217453) : Received Event
(Fri Jun 16 07:49:09 2006.357484) : Impersonation failed - Access denied
(Fri Jun 16 07:49:39 2006.387171) : WDM call returned error: 4200
(Fri Jun 16 07:49:40 2006.387750) : CreateFile FAILED for filename:
(Fri Jun 16 07:49:40 2006.387765) : inetinfo.exe(Fri Jun 16 07:49:40 2006.387765) :
(Fri Jun 16 07:49:40 2006.387765) : : GetlastError returned 2
(Fri Jun 16 07:53:12 2006.600062) : CreateFile FAILED for filename:
(Fri Jun 16 07:53:12 2006.600062) : inetinfo.exe(Fri Jun 16 07:53:12 2006.600078) :
(Fri Jun 16 07:53:12 2006.600078) : : GetlastError returned 2
(Fri Jun 16 07:53:12 2006.600078) : WDM call returned error: 4200
(Fri Jun 16 08:06:40 2006.1407625) : Received Event
(Fri Jun 16 08:06:40 2006.1408156) : CreateFile FAILED for filename:
(Fri Jun 16 08:06:40 2006.1408156) : inetinfo.exe(Fri Jun 16 08:06:40 2006.1408171) :
(Fri Jun 16 08:06:40 2006.1408171) : : GetlastError returned 2
(Fri Jun 16 08:06:40 2006.1408171) : CreateFile FAILED for filename:
(Fri Jun 16 08:06:40 2006.1408187) : inetinfo.exe(Fri Jun 16 08:06:40 2006.1408187) :
(Fri Jun 16 08:06:40 2006.1408187) : : GetlastError returned 2
(Fri Jun 16 08:32:53 2006.208484) : WDM call returned error: 4200
(Fri Jun 16 08:32:55 2006.210078) : CreateFile FAILED for filename:
(Fri Jun 16 08:32:55 2006.210078) : inetinfo.exe(Fri Jun 16 08:32:55 2006.210093) :
(Fri Jun 16 08:32:55 2006.210093) : : GetlastError returned 2
(Fri Jun 16 08:32:59 2006.213953) : Received Event
(Fri Jun 16 08:33:08 2006.223453) : Received Event
(Fri Jun 16 08:35:53 2006.388234) : CreateFile FAILED for filename:
(Fri Jun 16 08:35:53 2006.388250) : inetinfo.exe(Fri Jun 16 08:35:53 2006.388250) :
(Fri Jun 16 08:35:53 2006.388250) : : GetlastError returned 2
(Fri Jun 16 08:35:53 2006.388265) : WDM call returned error: 4200
(Fri Jun 16 08:51:32 2006.1326687) : Received Event
(Fri Jun 16 10:21:00 2006.6695265) : Received Event
(Fri Jun 16 10:21:02 2006.6697093) : Received Event
(Fri Jun 16 10:21:02 2006.6697093) : CreateFile FAILED for filename:
(Fri Jun 16 10:21:02 2006.6697109) : CreateFile FAILED for filename:
(Fri Jun 16 10:21:02 2006.6697109) : inetinfo.exe(Fri Jun 16 10:21:02 2006.6697109) :
(Fri Jun 16 10:21:02 2006.6697109) : : GetlastError returned 2
(Fri Jun 16 10:21:02 2006.6697140) : inetinfo.exe(Fri Jun 16 10:21:02 2006.6697140) :
(Fri Jun 16 10:21:02 2006.6697140) : : GetlastError returned 2
(Fri Jun 16 10:32:22 2006.7377593) : Received Event
(Fri Jun 16 10:57:56 2006.8911578) : Received Event
(Fri Jun 16 10:58:22 2006.8936765) : WDM call returned error: 4200
(Fri Jun 16 10:59:11 2006.8985906) : Received Event
(Fri Jun 16 11:04:34 2006.9309500) : Received Event
(Fri Jun 16 11:07:02 2006.9457484) : Impersonation failed - Access denied
(Fri Jun 16 11:08:03 2006.9518171) : WDM call returned error: 4200
(Fri Jun 16 11:08:04 2006.9519625) : Impersonation failed - Access denied
(Fri Jun 16 11:08:06 2006.9521593) : WDM call returned error: 4200
(Fri Jun 16 11:12:07 2006.9762328) : WDM call returned error: 4200
(Fri Jun 16 11:14:30 2006.9905656) : Impersonation failed - Access denied
(Fri Jun 16 11:15:14 2006.9949734) : WDM call returned error: 4200
(Fri Jun 16 11:16:01 2006.9995906) : Received Event
(Fri Jun 16 11:16:06 2006.10001093) : CreateFile FAILED for filename:
(Fri Jun 16 11:16:06 2006.10001093) : inetinfo.exe(Fri Jun 16 11:16:06 2006.10001093) : Received Event
(Fri Jun 16 11:16:06 2006.10001187) :
(Fri Jun 16 11:16:06 2006.10001593) : : GetlastError returned 2
(Fri Jun 16 11:16:06 2006.10001640) : CreateFile FAILED for filename:
(Fri Jun 16 11:16:06 2006.10001640) : inetinfo.exe(Fri Jun 16 11:16:06 2006.10001640) :
(Fri Jun 16 11:16:06 2006.10001656) : : GetlastError returned 2
(Fri Jun 16 11:16:23 2006.10017890) : Received Event
(Fri Jun 16 11:16:24 2006.10019062) : Received Event
(Fri Jun 16 11:19:50 2006.10225468) : Impersonation failed - Access denied
(Fri Jun 16 11:23:17 2006.10431937) : WDM call returned error: 4200
(Fri Jun 16 11:23:47 2006.10462156) : Impersonation failed - Access denied
(Fri Jun 16 11:24:11 2006.10486281) : WDM call returned error: 4200
(Fri Jun 16 11:25:07 2006.10542046) : Received Event
(Fri Jun 16 11:25:12 2006.10547453) : Received Event
(Fri Jun 16 11:25:12 2006.10547453) : CreateFile FAILED for filename:
(Fri Jun 16 11:25:12 2006.10547468) : CreateFile FAILED for filename:
(Fri Jun 16 11:25:12 2006.10547468) : inetinfo.exe(Fri Jun 16 11:25:12 2006.10547468) :
(Fri Jun 16 11:25:12 2006.10547468) : : GetlastError returned 2
(Fri Jun 16 11:25:12 2006.10547500) : inetinfo.exe(Fri Jun 16 11:25:12 2006.10547500) :
(Fri Jun 16 11:25:12 2006.10547500) : : GetlastError returned 2
(Fri Jun 16 11:25:25 2006.10560609) : Received Event
(Fri Jun 16 11:25:26 2006.10561718) : Received Event
(Fri Jun 16 11:29:02 2006.10777281) : Received Event
(Fri Jun 16 11:29:03 2006.10778000) : Received Event
(Fri Jun 16 11:29:03 2006.10778234) : Received Event
(Fri Jun 16 11:29:03 2006.10778765) : Received Event
(Fri Jun 16 11:34:05 2006.11080250) : Received Event
(Fri Jun 16 11:34:05 2006.11080250) : CreateFile FAILED for filename:
(Fri Jun 16 11:34:05 2006.11080265) : CreateFile FAILED for filename:
(Fri Jun 16 11:34:05 2006.11080265) : inetinfo.exe(Fri Jun 16 11:34:05 2006.11080281) : inetinfo.exe(Fri Jun 16 11:34:05 2006.11080281) :
(Fri Jun 16 11:34:05 2006.11080296) :
(Fri Jun 16 11:34:05 2006.11080296) : : GetlastError returned 2
(Fri Jun 16 11:34:05 2006.11080312) : : GetlastError returned 2
(Fri Jun 16 11:34:10 2006.11085531) : Received Event
(Fri Jun 16 11:37:12 2006.11266843) : Received Event
(Fri Jun 16 11:37:16 2006.11270953) : Received Event
(Fri Jun 16 14:42:03 2006.22358390) : Impersonation failed - Access denied
(Fri Jun 16 14:42:18 2006.22373453) : WDM call returned error: 4200
(Fri Jun 16 14:42:18 2006.22373812) : CreateFile FAILED for filename:
(Fri Jun 16 14:42:18 2006.22373812) : inetinfo.exe(Fri Jun 16 14:42:18 2006.22373828) :
(Fri Jun 16 14:42:18 2006.22373828) : : GetlastError returned 2
(Fri Jun 16 14:46:07 2006.22602796) : CreateFile FAILED for filename:
(Fri Jun 16 14:46:07 2006.22602812) : inetinfo.exe(Fri Jun 16 14:46:07 2006.22602812) :
(Fri Jun 16 14:46:07 2006.22602812) : : GetlastError returned 2
(Fri Jun 16 14:46:07 2006.22602828) : WDM call returned error: 4200
(Fri Jun 16 15:23:46 2006.24861421) : Received Event
(Fri Jun 16 15:23:46 2006.24861500) : CreateFile FAILED for filename:
(Fri Jun 16 15:23:46 2006.24861515) : inetinfo.exe(Fri Jun 16 15:23:46 2006.24861531) :
(Fri Jun 16 15:23:46 2006.24861531) : : GetlastError returned 2
(Fri Jun 16 15:23:46 2006.24861546) : CreateFile FAILED for filename:
(Fri Jun 16 15:23:46 2006.24861546) : inetinfo.exe(Fri Jun 16 15:23:46 2006.24861562) :
(Fri Jun 16 15:23:46 2006.24861562) : : GetlastError returned 2
(Fri Jun 16 15:23:47 2006.24862890) : Received Event
(Fri Jun 16 15:26:10 2006.25005890) : Received Event
(Fri Jun 16 15:26:11 2006.25006031) : CreateFile FAILED for filename:
(Fri Jun 16 15:26:11 2006.25006031) : inetinfo.exe(Fri Jun 16 15:26:11 2006.25006046) : CreateFile FAILED for filename:
(Fri Jun 16 15:26:11 2006.25006046) : inetinfo.exe(Fri Jun 16 15:26:11 2006.25006046) :
(Fri Jun 16 15:26:11 2006.25006046) : : GetlastError returned 2
(Fri Jun 16 15:26:11 2006.25006078) :
(Fri Jun 16 15:26:11 2006.25006078) : : GetlastError returned 2
(Fri Jun 16 15:56:47 2006.26842328) : Received Event
(Fri Jun 16 15:56:47 2006.26842531) : CreateFile FAILED for filename:
(Fri Jun 16 15:56:47 2006.26842531) : CreateFile FAILED for filename:
(Fri Jun 16 15:56:47 2006.26842531) : inetinfo.exe(Fri Jun 16 15:56:47 2006.26842531) :
(Fri Jun 16 15:56:47 2006.26842546) : : GetlastError returned 2
(Fri Jun 16 15:56:47 2006.26842562) : inetinfo.exe(Fri Jun 16 15:56:47 2006.26842562) :
(Fri Jun 16 15:56:47 2006.26842562) : : GetlastError returned 2
(Fri Jun 16 15:56:50 2006.26844984) : Received Event
(Fri Jun 16 15:59:38 2006.27013812) : Received Event
(Fri Jun 16 15:59:38 2006.27013812) : CreateFile FAILED for filename:
(Fri Jun 16 15:59:38 2006.27013812) : CreateFile FAILED for filename:
(Fri Jun 16 15:59:38 2006.27013812) : inetinfo.exe(Fri Jun 16 15:59:38 2006.27013828) :
(Fri Jun 16 15:59:38 2006.27013828) : : GetlastError returned 2
(Fri Jun 16 15:59:38 2006.27013843) : inetinfo.exe(Fri Jun 16 15:59:38 2006.27013843) :
(Fri Jun 16 15:59:38 2006.27013843) : : GetlastError returned 2
(Fri Jun 16 16:24:41 2006.28516515) : Received Event
(Fri Jun 16 16:24:41 2006.28516593) : CreateFile FAILED for filename:
(Fri Jun 16 16:24:41 2006.28516609) : CreateFile FAILED for filename:
(Fri Jun 16 16:24:41 2006.28516609) : inetinfo.exe(Fri Jun 16 16:24:41 2006.28516609) :
(Fri Jun 16 16:24:41 2006.28516609) : : GetlastError returned 2
(Fri Jun 16 16:24:41 2006.28516640) : inetinfo.exe(Fri Jun 16 16:24:41 2006.28516640) :
(Fri Jun 16 16:24:41 2006.28516640) : : GetlastError returned 2
(Fri Jun 16 16:24:42 2006.28517140) : Received Event
(Fri Jun 16 16:38:30 2006.29345328) : Received Event
(Fri Jun 16 16:38:30 2006.29345343) : CreateFile FAILED for filename:
(Fri Jun 16 16:38:30 2006.29345390) : CreateFile FAILED for filename:
(Fri Jun 16 16:38:30 2006.29345390) : inetinfo.exe(Fri Jun 16 16:38:30 2006.29345406) : inetinfo.exe(Fri Jun 16 16:38:30 2006.29345406) :
(Fri Jun 16 16:38:30 2006.29345421) :
(Fri Jun 16 16:38:30 2006.29345437) : : GetlastError returned 2
(Fri Jun 16 16:38:30 2006.29345453) : : GetlastError returned 2
(Sun Jun 18 18:36:54 2006.209251250) : Received Event
(Sun Jun 18 18:56:41 2006.210438281) : Received Event
(Sun Jun 18 19:04:35 2006.210911968) : Received Event
(Sun Jun 18 21:11:55 2006.218552437) : Received Event
(Sun Jun 18 21:12:00 2006.218557421) : Received Event

What do you think? There are several WMI logs, most of which have an issue from friday. (IIS reinstall) I'm hoping to have the SBS SP1 reapplied in the next hour I will keep you posted.

Jeff, really appreciate your help.

Regards

Guy_Adams
0
 
LVL 74

Accepted Solution

by:
Jeffrey Kane - TechSoEasy earned 500 total points
ID: 16933187
I don't think it says much at all... I just took a look at a couple of my servers wmiprov.log files and didn't see anything different... I don't know much about this stuff... but it looks as though these are normal errors.  Plus, you have to look for what's sending the emails... it's not the Health Monitor, I can assure you.  You probably should take some time to look at the Health Monitor's Control Panel... it's rather cool... but there is something else sending those emails out.

I'd focus on EXCHANGE's logs to track down where the message is coming from.

Jeff
TechSoEasy
0
 
LVL 2

Author Comment

by:Guy_Adams
ID: 16933255
Ok, I will consult the logs abit further.

SBS SP1 has been reapplied just need to restart.

I usually get 1 or 2 WMI emails a day. So I will have a look through the logs while I wait to see if the reapplied SP has made a difference.

I have accepted your last answer as I appreciate the time and effort you have put into this question.

Regards

Guy_Adams

0
 
LVL 74

Expert Comment

by:Jeffrey Kane - TechSoEasy
ID: 16933665
No Problem... good luck!

Jeff
TechSoEasy
0

Featured Post

Maximize Your Threat Intelligence Reporting

Reporting is one of the most important and least talked about aspects of a world-class threat intelligence program. Here’s how to do it right.

Join & Write a Comment

This guide is intended for migrating Windows 2003 Standard with Exchange 2003 to Windows Small Business Server 2008. You will need the following: Exchange Best Practice Analyzer: http://www.microsoft.com/downloads/details.aspx?FamilyID=DBAB201F-…
This guide is intended to provide step by step instructions on how to migrate from Small Business Server 2003 to Small Business Server 2011. NOTE: This guide has been written using the preview version of SBS2011 therefore some of the screens may …
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.
This video shows how to remove a single email address from the Outlook 2010 Auto Suggestion memory. NOTE: For Outlook 2016 and 2013 perform the exact same steps. Open a new email: Click the New email button in Outlook. Start typing the address: …

758 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

17 Experts available now in Live!

Get 1:1 Help Now