Workflow Runtime: Failed to run a process or script

Microsoft.SystemCenter.BatchResponseModule.AlertOnFailedResponses (Rule)

This rule generates alerts when batch responses fail.

Knowledge Base article:

Summary

Operations Manager was attempting to run a script or executable and was unable to create the process.

This may affect some monitoring.

Causes

This can be caused by:

The executable could not be found.
The computer does not have enough resources (for example: memory) to run the executable.
The antivirus software on the computer blocking Visual Basic scripts or Java scripts. The following link is a link to the KB article regarding this issue.
The script extension is not properly registered.

Antivirus software blocking script execution

Resolutions

The alert description and context has information indicating which rule or monitor failed. The following link will display all events indicating a failure to run the executable:

View Script Events

After reviewing the error in the context, check:

That the path to the executable exists on the computer.

The antivirus software is not blocking scripts from running.

That the computer is not over utilized.

Check Task Manager to see if there is enough free memory.
Check Task Manager to see if there are any processes consuming all the CPU.
To ensure that all script extensions are registered, follow the steps in the “Let me fix it myself” section of Knowledge Base article 949140 (http://go.microsoft.com/fwlink/?LinkId=181825).

Check the error information in the event or alert context for the script path and name. There could be a problem with the script not handling an error correctly and exiting. If the script exits without outputting the data that is expected (e.g. property bag data), this error is raised.

Another error can be caused by the misconfiguration of the rule or monitor executing this script. The configuration (script parameters, policy, timeout) could be wrong causing no output or timeout.

Element properties:

Target

Microsoft.SystemCenter.HealthService

Category

EventCollection

Enabled

True

Alert Generate

True

Alert Severity

Warning

Alert Priority

Normal

Remotable

True

Alert Message

Operations Manager failed to start a process

{0}

Event Log

Operations Manager

Member Modules:

ID	Module Type	TypeId	RunAs
DS	DataSource	Microsoft.Windows.EventProvider	Default
Consolidator	ConditionDetection	Microsoft.SystemCenter.Overridable.ConsolidatorCondition	Default
GenerateAlert	WriteAction	System.Health.GenerateAlert	Default

Source Code:

<Rule ID="Microsoft.SystemCenter.BatchResponseModule.AlertOnFailedResponses" Enabled="true" Target="SCLibrary!Microsoft.SystemCenter.HealthService" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>EventCollection</Category>

  <DataSources>

    <DataSource ID="DS" TypeID="Windows!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>Operations Manager</LogName>

      <Expression>

        <And>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="String">PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="String">Health Service Modules</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="String">Params/Param[1]</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="String">$Target/ManagementGroup/Name$</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <Or>

              <Expression>

                <SimpleExpression>

                  <ValueExpression>

                    <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                  </ValueExpression>

                  <Operator>Equal</Operator>

                  <ValueExpression>

                    <Value Type="UnsignedInteger">21402</Value>

                  </ValueExpression>

                </SimpleExpression>

              </Expression>

              <Expression>

                <SimpleExpression>

                  <ValueExpression>

                    <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                  </ValueExpression>

                  <Operator>Equal</Operator>

                  <ValueExpression>

                    <Value Type="UnsignedInteger">21404</Value>

                  </ValueExpression>

                </SimpleExpression>

              </Expression>

              <Expression>

                <SimpleExpression>

                  <ValueExpression>

                    <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                  </ValueExpression>

                  <Operator>Equal</Operator>

                  <ValueExpression>

                    <Value Type="UnsignedInteger">21405</Value>

                  </ValueExpression>

                </SimpleExpression>

              </Expression>

              <Expression>

                <SimpleExpression>

                  <ValueExpression>

                    <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                  </ValueExpression>

                  <Operator>Equal</Operator>

                  <ValueExpression>

                    <Value Type="UnsignedInteger">21406</Value>

                  </ValueExpression>

                </SimpleExpression>

              </Expression>

              <Expression>

                <SimpleExpression>

                  <ValueExpression>

                    <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                  </ValueExpression>

                  <Operator>Equal</Operator>

                  <ValueExpression>

                    <Value Type="UnsignedInteger">21407</Value>

                  </ValueExpression>

                </SimpleExpression>

              </Expression>

            </Or>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <ConditionDetection ID="Consolidator" TypeID="Microsoft.SystemCenter.Overridable.ConsolidatorCondition">

    <ConsolidationProperties>

      <PropertyXPathQuery>Params/Param[1]</PropertyXPathQuery>

    </ConsolidationProperties>

    <IntervalSeconds>3600</IntervalSeconds>

    <Count>3</Count>

  </ConditionDetection>

  <WriteActions>

    <WriteAction ID="GenerateAlert" TypeID="Health!System.Health.GenerateAlert">

      <Priority>1</Priority>

      <Severity>1</Severity>

      <AlertMessageId>$MPElement[Name="Microsoft.SystemCenter.BatchResponseModule.AlertOnFailedResponses.AlertMessage"]$</AlertMessageId>

      <AlertParameters>

        <AlertParameter1>$Data/Context/DataItem/EventDescription$</AlertParameter1>

      </AlertParameters>

      <Suppression>

        <SuppressionValue>$EventData/Data[2]$</SuppressionValue>

      </Suppression>

    </WriteAction>

  </WriteActions>

</Rule>