Licensing Server failed to start due to insufficient resources

LS_failed_to_start_due_to_insufficient_resources_2000 (Rule)

Knowledge Base article:

Summary

Terminal Server Licensing failed to start due to insufficient resources. This causes the terminal server to stop accepting connections.

This rule covers the following event IDs: 1, 3, 4, 5, 6, 8, 15, 18, 19, 21, 24, 27, 28, 30, 36, 37

Other Information:

The event IDs described in this topic apply to Microsoft® Windows® 2000 Server and Microsoft Windows Server® 2000 operating systems.

Causes

Possible causes include:

Event 1: Terminal Server Licensing cannot start work scheduler.

Event 3: Terminal Server Licensing cannot allocate an Extensible Storage Engine (ESE) session.

Event 4: Terminal Server Licensing cannot open the ESE database file.

Event 5: Terminal Server Licensing cannot create the ESE database file.

Event 6: Terminal Server Licensing cannot create or open the ESE database table.

Event 8: Terminal Server Licensing is unable to receive data on the remote procedure call (RPC) port.

Event 15: Terminal Server Licensing RPC thread failed to start

Event 18: Terminal Server Licensing was unable to start its socket connection.

Event 19: Terminal Server Licensing experienced a general initialization failure.

Event 21: The license server cannot allocate the required memory.

Event 23: The license server cannot retrieve Terminal Server Licensing ID.

Event 24: The license server cannot save the Terminal Server Licensing ID.

Event 27: Terminal Server Licensing is unable to connect to Service Control Manager.

Event 28: Terminal Server Licensing cannot report status to Service Control Manager.

Event 30: The license server cannot create service initialization thread.

Event 36: The license server cannot start Terminal Server Licensing due to lack of system resources.

Event 37: The license server cannot start Terminal Server Licensing because of an error.

Resolutions

Possible resolutions include:

Events 1, 3, 4, 5, 6, 18, 19, 21, 24, 37, 30, 36, 27, 28, 30: Low memory can cause this problem. Check resources.

Events 8, 15: Check RPC service; the most likely cause is that the RPC service has stopped.

Element properties:

TargetMicrosoft.Windows.Server.2000.TerminalServicesLicensingServerRole
CategoryEventCollection
EnabledTrue
Event SourceTermServLicensing
Alert GenerateTrue
Alert SeverityError
Alert PriorityNormal
RemotableTrue
Alert Message
Licensing Server failed to start due to insufficient resources
{0}
Event LogSystem
CommentMom2005ID='{748D429D-DC85-496B-BF9D-F800BE516CB8}'

Member Modules:

ID Module Type TypeId RunAs 
Event_Data_Source DataSource Microsoft.Windows.EventProvider Default
GenerateAlert WriteAction System.Health.GenerateAlert Default

Source Code:

<Rule ID="LS_failed_to_start_due_to_insufficient_resources_2000" Target="Microsoft.Windows.Server.2000.TerminalServicesLicensingServerRole" Enabled="onEssentialMonitoring" Remotable="true" Comment="Mom2005ID='{748D429D-DC85-496B-BF9D-F800BE516CB8}'">
<Category>EventCollection</Category>
<DataSources>
<DataSource ID="Event_Data_Source" TypeID="Windows!Microsoft.Windows.EventProvider">
<ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>
<LogName>System</LogName>
<Expression>
<And>
<Expression>
<RegExExpression>
<ValueExpression>
<XPathQuery>EventNumber</XPathQuery>
</ValueExpression>
<Operator>MatchesMOM2005RegularExpression</Operator>
<Pattern>^(-1073676273|-1073676270|-1073676269|-1073676267|-1073676265|-1073676264|-1073479672|-1072431101|-1072431100|-1072431099|-1072431098|-1071579135|27|28|30|36|37)$</Pattern>
</RegExExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery>PublisherName</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>TermServLicensing</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</And>
</Expression>
</DataSource>
</DataSources>
<WriteActions>
<WriteAction ID="GenerateAlert" TypeID="SystemHealth!System.Health.GenerateAlert">
<Priority>1</Priority>
<Severity>2</Severity>
<AlertOwner>$Data/PublisherName$</AlertOwner>
<AlertMessageId>$MPElement[Name="LS_failed_to_start_due_to_insufficient_resources_2000.AlertMessage"]$</AlertMessageId>
<AlertParameters>
<AlertParameter1>$Data/EventDescription$</AlertParameter1>
</AlertParameters>
<Suppression>
<SuppressionValue/>
</Suppression>
</WriteAction>
</WriteActions>
</Rule>