AK162055

Monitor_AK162055 (UnitMonitor)

Missing Operating System Update may cause Svchost.exe process with the WMI service to crash on Windows Server 2008 R2

Knowledge Base article:

External

http://go.microsoft.com/fwlink/?LinkId=215403

Element properties:

Target

Microsoft.KnowledgeServices.Windows.OperatingSystem

Parent Monitor

System.Health.ConfigurationState

Category

Alert

Enabled

True

Alert Generate

True

Alert Severity

Error

Alert Priority

High

Alert Auto Resolve

True

Monitor Type

Microsoft.KnowledgeServices.Library.SchedulerMonitorEx

Remotable

True

Accessibility

Public

Alert Message

Missing Operating System Update may cause Svchost.exe process with the WMI service to crash on Windows Server 2008 R2

<Details>
<Content>On a computer that is running Windows Server 2008 R2, the Svchost.exe process that hosts Windows Management Instrumentation (WMI) service may crash. You can prevent this by installing the fix available in KB 982293. See the Knowledge Base article for information on how to fix this issue.</Content>
<CollectedInformation>
<Info>
<Name>Wbemcomn.dll required version</Name>
<Value>6.1.7600.20710</Value>
</Info>
<Info>
<Name>Wbemcomn.dll installed version</Name>
<Value>{0}</Value>
</Info>
<Info>
<Name>Wmiprvse.exe required version</Name>
<Value>6.1.7600.20710</Value>
</Info>
<Info>
<Name>Wmiprvse.exe installed version</Name>
<Value>{1}</Value>
</Info>
<Info>
<Name>Wmiprvsd.dll required version</Name>
<Value>6.1.7600.20710</Value>
</Info>
<Info>
<Name>Wmiprvsd.dll installed version</Name>
<Value>{2}</Value>
</Info>
</CollectedInformation>
</Details>

RunAs

Default

Comment

SupportTopic=TBD;VersionNumber=1.0.0.3;

Source Code:

<UnitMonitor ID="Monitor_AK162055" Comment="SupportTopic=TBD;VersionNumber=1.0.0.3;" Accessibility="Public" Enabled="true" Target="MicrosoftKnowledgeServicesWindowsLibrary!Microsoft.KnowledgeServices.Windows.OperatingSystem" ParentMonitorID="Health!System.Health.ConfigurationState" Remotable="true" Priority="High" TypeID="KnowledgeServicesLibrary!Microsoft.KnowledgeServices.Library.SchedulerMonitorEx" ConfirmDelivery="true">

  <Category>Alert</Category>

  <AlertSettings AlertMessage="MonitorMessage756f1c2fe7ef407ea74dfe0b991d1566">

    <AlertOnState>Error</AlertOnState>

    <AutoResolve>true</AutoResolve>

    <AlertPriority>High</AlertPriority>

    <AlertSeverity>Error</AlertSeverity>

    <AlertParameters>

      <AlertParameter1>$Target/Property[Type="MicrosoftKnowledgeServicesWindowsLibrary!Microsoft.KnowledgeServices.Windows.OperatingSystem"]/WbemcomnDllVersion$</AlertParameter1>

      <AlertParameter2>$Target/Property[Type="MicrosoftKnowledgeServicesWindowsLibrary!Microsoft.KnowledgeServices.Windows.OperatingSystem"]/WmiPrvSEVersion$</AlertParameter2>

      <AlertParameter3>$Target/Property[Type="MicrosoftKnowledgeServicesWindowsLibrary!Microsoft.KnowledgeServices.Windows.OperatingSystem"]/WmiprvsdDllVersion$</AlertParameter3>

    </AlertParameters>

  </AlertSettings>

  <OperationalStates>

    <OperationalState ID="Success" MonitorTypeStateID="Success" HealthState="Success"/>

    <OperationalState ID="Error" MonitorTypeStateID="Error" HealthState="Error"/>

  </OperationalStates>

  <Configuration>

    <ErrorExpression>

      <And>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <Value Type="String">$Target/Property[Type="Windows!Microsoft.Windows.OperatingSystem"]/BuildNumber$</Value>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="String">7600</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <Or>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <Value Type="Integer">$Target/Property[Type="MicrosoftKnowledgeServicesWindowsLibrary!Microsoft.KnowledgeServices.Windows.OperatingSystem"]/WbemcomnDllRevision$</Value>

                </ValueExpression>

                <Operator>Less</Operator>

                <ValueExpression>

                  <Value Type="Integer">20710</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <Value Type="Integer">$Target/Property[Type="MicrosoftKnowledgeServicesWindowsLibrary!Microsoft.KnowledgeServices.Windows.OperatingSystem"]/WmiPrvSERevision$</Value>

                </ValueExpression>

                <Operator>Less</Operator>

                <ValueExpression>

                  <Value Type="Integer">20710</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <Value Type="Integer">$Target/Property[Type="MicrosoftKnowledgeServicesWindowsLibrary!Microsoft.KnowledgeServices.Windows.OperatingSystem"]/WmiprvsdDllRevision$</Value>

                </ValueExpression>

                <Operator>Less</Operator>

                <ValueExpression>

                  <Value Type="Integer">20710</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

          </Or>

        </Expression>

      </And>

    </ErrorExpression>

    <SuccessExpression>

      <Not>

        <Expression>

          <And>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <Value Type="String">$Target/Property[Type="Windows!Microsoft.Windows.OperatingSystem"]/BuildNumber$</Value>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="String">7600</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

            <Expression>

              <Or>

                <Expression>

                  <SimpleExpression>

                    <ValueExpression>

                      <Value Type="Integer">$Target/Property[Type="MicrosoftKnowledgeServicesWindowsLibrary!Microsoft.KnowledgeServices.Windows.OperatingSystem"]/WbemcomnDllRevision$</Value>

                    </ValueExpression>

                    <Operator>Less</Operator>

                    <ValueExpression>

                      <Value Type="Integer">20710</Value>

                    </ValueExpression>

                  </SimpleExpression>

                </Expression>

                <Expression>

                  <SimpleExpression>

                    <ValueExpression>

                      <Value Type="Integer">$Target/Property[Type="MicrosoftKnowledgeServicesWindowsLibrary!Microsoft.KnowledgeServices.Windows.OperatingSystem"]/WmiPrvSERevision$</Value>

                    </ValueExpression>

                    <Operator>Less</Operator>

                    <ValueExpression>

                      <Value Type="Integer">20710</Value>

                    </ValueExpression>

                  </SimpleExpression>

                </Expression>

                <Expression>

                  <SimpleExpression>

                    <ValueExpression>

                      <Value Type="Integer">$Target/Property[Type="MicrosoftKnowledgeServicesWindowsLibrary!Microsoft.KnowledgeServices.Windows.OperatingSystem"]/WmiprvsdDllRevision$</Value>

                    </ValueExpression>

                    <Operator>Less</Operator>

                    <ValueExpression>

                      <Value Type="Integer">20710</Value>

                    </ValueExpression>

                  </SimpleExpression>

                </Expression>

              </Or>

            </Expression>

          </And>

        </Expression>

      </Not>

    </SuccessExpression>

    <Schedule>86393</Schedule>

  </Configuration>

</UnitMonitor>