Rasman Service initialization failure

Rasman_Service_initialization_failure_1_Rule (Rule)

Knowledge Base article:

Management Pack
Summary
The Routing and Remote Access service could not start because of initialization failure.
 
Causes
The most common reasons for this error are:
  1. The enumeration of remote access ports failed. The most common reason for this error is that not enough memory is available on the server.
  2. One of the following DLLs could not be loaded:
    1. dhcpcsvc.dll
    2. iphlpapi.dll
    3. ipbootp.dll
  3. The Remote Access IP ARP driver (wanarp) failed to start. The service could not initialize the adapter name using the Remote Access IP ARP driver (wanarp).
 
Resolutions
  1. If the server is low on memory, take appropriate action to increase the available memory. See Help and Support Center for information on low memory.
  2. Verify that the DLLs exist in the %systemroot%\system32 folder. If not, you might need to repair or reinstall the Windows operating system.
  3. Verify whether the SYSTEM account has read/write permissions for the DLLs. To check the permissions:
    1. Right-click each registry key, and click Permissions.
    2. Verify whether the SYSTEM account has read/write permissions for the key. If it does not, add them.
  4. Verify that the wanarp.sys file exists in the %systemroot%\system32 folder and that the driver is started. To do this:
    1. Click Start, click Administrative Tools, and click Computer Management.
    2. Right-click Device Manager, click View, and click Show hidden devices.
    3. Double-click Non-Plug and Play Drivers.
    4. Right-click Remote Access IP ARP Driver, and click Properties.
    5. On the Driver tab, click Start.
 
Sample Event
Sample Event #1: Cannot enumerate the Remote Access Connection Manager ports. %1
Sample Event #2: Cannot initialize the Remote Access and Router service to accept calls usingthe TCP/IP transport protocol. The following error occurred: %1
 
© 2004 Microsoft Corporation, all rights reserved.

Element properties:

TargetMicrosoft.Windows.Server.RRAS.Microsoft_Windows_2003_Routing_and_Remote_Access_Servers_Installation
CategoryEventCollection
EnabledTrue
Event SourceRemoteAccess
Alert GenerateTrue
Alert SeverityError
Alert PriorityLow
RemotableTrue
Alert Message
Rasman Service initialization failure

$Data/EventDescription$
Event LogSystem
CommentMom2005ID='{A7963AC5-138D-46A0-B78E-A5AE8A9DF43B}';MOM2005ComputerGroupID={2C66DD87-4D20-48F6-B6A3-19A1598ED025}

Member Modules:

ID Module Type TypeId RunAs 
_907D4578_146C_11D3_AB21_00A0C98620CE_ DataSource Microsoft.Windows.EventProvider Default
CollectEventData WriteAction Microsoft.SystemCenter.CollectEvent Default
CollectEventDataWarehouse WriteAction Microsoft.SystemCenter.DataWarehouse.PublishEventData Default
GenerateAlert WriteAction System.Mom.BackwardCompatibility.AlertResponse Default

Source Code:

<Rule ID="Rasman_Service_initialization_failure_1_Rule" Target="Microsoft.Windows.Server.RRAS.Microsoft_Windows_2003_Routing_and_Remote_Access_Servers_Installation" Enabled="true" ConfirmDelivery="true" Comment="Mom2005ID='{A7963AC5-138D-46A0-B78E-A5AE8A9DF43B}';MOM2005ComputerGroupID={2C66DD87-4D20-48F6-B6A3-19A1598ED025}">
<Category>EventCollection</Category>
<DataSources>
<DataSource ID="_907D4578_146C_11D3_AB21_00A0C98620CE_" Comment="{907D4578-146C-11D3-AB21-00A0C98620CE}" TypeID="WindowsLibrary!Microsoft.Windows.EventProvider">
<ComputerName>$Target/Host/Property[Type="WindowsLibrary!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>
<LogName>System</LogName>
<Expression>
<And>
<Expression>
<RegExExpression>
<ValueExpression>
<XPathQuery Type="Integer">EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>MatchesMOM2005BooleanRegularExpression</Operator>
<Pattern>^(20005|20145)$</Pattern>
</RegExExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="String">PublisherName</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>RemoteAccess</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</And>
</Expression>
</DataSource>
</DataSources>
<WriteActions>
<WriteAction ID="GenerateAlert" TypeID="MomBackwardCompatibility!System.Mom.BackwardCompatibility.AlertResponse">
<AlertGeneration>
<GenerateAlert>true</GenerateAlert>
<Owner/>
<Description>
$Data/EventDescription$
</Description>
<AlertLevel>70</AlertLevel>
<ResolutionState/>
<Source>
$Data/PublisherName$
</Source>
<Name>Rasman Service initialization failure</Name>
<CustomFields>
<CustomField>
$Data/Params/Param[1]$
</CustomField>
<CustomField>
$Data/Params/Param[2]$
</CustomField>
<CustomField/>
<CustomField/>
<CustomField/>
</CustomFields>
</AlertGeneration>
<InvokerType>0</InvokerType>
</WriteAction>
<WriteAction ID="CollectEventData" TypeID="SystemCenterLibrary!Microsoft.SystemCenter.CollectEvent"/>
<WriteAction ID="CollectEventDataWarehouse" TypeID="DataWarehouseLibrary!Microsoft.SystemCenter.DataWarehouse.PublishEventData"/>
</WriteActions>
</Rule>