About Us

Computer services tailored for small and medium businesses

You're here: Skip Navigation LinksHome > News > SBS Monitoring Event Log issue

SBS Monitoring Event Log issue

SBS Monitoring usually produces daily and weekly reports that include a count, and optionally detail, of Critical Events on the server.  Sometimes, the reports continue to be produced but show no Event log errors.

The first step is to look in the MonitoringDataCollection log file (in Program files-Windows Small Business Server-Logs-MonitoringServiceLogs) for clues.  There will be some error at the point where it tries to collect Event data, eg.

2012-06-21T06:30:06.054371 : Event collection is from 5/15/2012 2:30:00 PM to 6/21/2012 6:30:06 AM.
2012-06-21T06:30:06.059372 : filter event Microsoft-Windows-Kernel-EventTracing/Admin
System.UnauthorizedAccessException: Attempted to perform an unauthorized operation.
   at System.Diagnostics.Eventing.Reader.EventLogException.Throw(Int32 errorCode)
   at System.Diagnostics.Eventing.Reader.ProviderMetadata.GetProviderListProperty(EventLogHandle providerHandle, EvtPublisherMetadataPropertyId metadataProperty)
   at System.Diagnostics.Eventing.Reader.ProviderMetadata.CheckReleased()
   at System.Diagnostics.Eventing.Reader.ProviderMetadataCachedInformation.GetProviderMetadata(ProviderMetadataId key)
   at System.Diagnostics.Eventing.Reader.ProviderMetadataCachedInformation.GetFormatDescription(String ProviderName, EventLogHandle eventHandle)
   at Microsoft.WindowsServerSolutions.SystemHealth.Monitoring.EventLogInformation.CollectEventLogInformation(DateTime start, DateTime end, Logger log)
   at Microsoft.WindowsServerSolutions.SystemHealth.Monitoring.SBSWMITask.CollectEventLogInformation()
   at Microsoft.WindowsServerSolutions.SystemHealth.Monitoring.SBSWMITask.Run()
   at Microsoft.WindowsServerSolutions.SystemHealth.Monitoring.SBSTask.StartTheTaskStub()

Suggested further steps include:

  1. Run WMIDiags.  This tests the Windows Management Instrumentation system, and produces a report with suggested fixes for any issues. WMIDiags can be downloaded here. The data collection process uses WMI to read the Event log files.
  2. Review the SBS Monitoring Repair guide.  The SBS2011 version can be seen here.
  3. Recreate the SBS Monitoring Database. This a straightforward procedure detailed here.

The causes for this issue are unclear and varied.  Sometimes it has failed after updates have been applied and there has been some issue with SQL server.  On one installation, it did not work after new system installation.  On another system it failed after upgrade of some HP Management components including System Management Homepage, Version Control Agent, and Version Control Repository.