ConfigMgr 2007 dependent service failure: Windows Management Instrumentation terminated unexpectedly

SMSv4_dependent_service_failure__Windows_Management_Instrumentation_terminated_unexpectedly_2_Rule (Rule)

Knowledge Base article:

Summary

This alert is triggered when the Windows Service Control Manager generates Windows event ID 7023, 7024, 7031, or 7034. These event IDs are not specific to Configuration Manager. The Service Control Manager might attempt to restart this service. If this service is not successfully restarted, Configuration Manager functionality is impaired on this computer.

To investigate this alert:

Click Start, click Control Panel, double-click Administrative Tools, and then double-click Event Viewer.
In the console tree, click the System log.
In the details pane, locate the event ID or IDs and double-click to view the description.

Causes

This condition could occur because there is a critical problem with the service or with one of its dependent components or services.

For event ID 7023, the message specifies the error that is encountered by the Service Control Manager.

For event ID 7024, the message includes a service-specific error code. To translate the error code in the message, type net helpmsg [error code] at the command prompt.

Additional

This alert is best handled by Configuration Manager administrators.

Sample Events:

7023 The %1 service terminated with the following error: %n%2\r\n.

7024 The %1 service terminated with service-specific error %2.\r\n.

7031 The %1 service terminated unexpectedly. It has done this %2 time(s). The following corrective action will be taken in %3 milliseconds: %5.\r\n.

7034 The %1 service terminated unexpectedly. It has done this %2 time(s).

External

For more assistance, see a list of additional support options in the support section of Configuration Manager Web site at Support for Configuration Manager.

Element properties:

Target	Microsoft.SystemCenter.ConfigurationManager.2007.Microsoft_SMSv4_Servers_Installation
Category	EventCollection
Enabled	True
Alert Generate	False
Remotable	True
Event Log	System
Comment	Mom2005ID='{184A7E5B-3D4E-43F4-98DB-F6D0F20988C5}';MOM2005ComputerGroupID={1D70EED8-03BD-4AA1-91F3-9C708DAF2E3D}

Member Modules:

ID	Module Type	TypeId	RunAs
_907D4578_146C_11D3_AB21_00A0C98620CE_	DataSource	Microsoft.Windows.EventProvider	Default
CollectEventData	WriteAction	Microsoft.SystemCenter.CollectEvent	Default
CollectEventDataWarehouse	WriteAction	Microsoft.SystemCenter.DataWarehouse.PublishEventData	Default
GenerateAlert	WriteAction	System.Mom.BackwardCompatibility.AlertResponse	Default

Source Code:

<Rule ID="SMSv4_dependent_service_failure__Windows_Management_Instrumentation_terminated_unexpectedly_2_Rule" Target="Microsoft.SystemCenter.ConfigurationManager.2007.Microsoft_SMSv4_Servers_Installation" Enabled="true" ConfirmDelivery="true" Comment="Mom2005ID='{184A7E5B-3D4E-43F4-98DB-F6D0F20988C5}';MOM2005ComputerGroupID={1D70EED8-03BD-4AA1-91F3-9C708DAF2E3D}">

  <Category>EventCollection</Category>

  <DataSources>

    <DataSource ID="_907D4578_146C_11D3_AB21_00A0C98620CE_" Comment="{907D4578-146C-11D3-AB21-00A0C98620CE}" TypeID="WindowsLibrary!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Host/Property[Type="WindowsLibrary!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>System</LogName>

      <Expression>

        <And>

          <Expression>

            <RegExExpression>

              <ValueExpression>

                <XPathQuery Type="Integer">EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>MatchesMOM2005RegularExpression</Operator>

              <Pattern>^(7031|7034|7023|7024)$</Pattern>

            </RegExExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="String">PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>Service Control Manager</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="String">Params/Param[1]</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>Windows Management Instrumentation</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="GenerateAlert" TypeID="System.Mom.BackwardCompatibility.AlertResponse">

      <GenerateAlert>true</GenerateAlert>

      <Owner/>

      <Description>

            $Data/LoggingComputer$

           - ConfigMgr 2007 dependent service failure: Windows Management Instrumentation terminated unexpectedly.



The  Windows Management Instrumentation service running on 

            $Data/LoggingComputer$

           was detected as stopped at 

            $Data/@time$

          .</Description>

      <AlertLevel>70</AlertLevel>

      <ResolutionState/>

      <Source>

            $Data/PublisherName$

          </Source>

      <Name>ConfigMgr 2007 dependent service failure: Windows Management Instrumentation terminated unexpectedly</Name>

      <InvokerType>0</InvokerType>

    </WriteAction>

    <WriteAction ID="CollectEventData" TypeID="SystemCenterLibrary!Microsoft.SystemCenter.CollectEvent"/>

    <WriteAction ID="CollectEventDataWarehouse" TypeID="DataWarehouseLibrary!Microsoft.SystemCenter.DataWarehouse.PublishEventData"/>

  </WriteActions>

</Rule>