ReSearch This KB – Operations Manager failed to run a WMI query

Alert: Operations Manager failed to run a WMI query

Management Pack Name: System Center Core Monitoring

Management Pack Version: 7.0.9538.0

Rule or Monitor: Rule

Rule or Monitor Name: Workflow Runtime: Failed to run a WMI query

Rule or Monitor Notes: Generic rule alerting on WMI failures

Issue:

Description:

Object enumeration failed Query: ‘SELECT Name FROM Win32_ServerFeature WHERE ID= 18’ HRESULT: 0x80041001 Details: Generic failure One or more workflows were affected by this. Workflow name: Microsoft.Windows.Server.2008R2.RemoteDesktopServicesRole.Discovery Instance name: servername.domain.org Instance ID: {996DB404-AD83-CCDF-B67A-694A00282C72}
Management group: MG

Object enumeration failed
Query: ‘SELECT Name FROM Win32_ServerFeature WHERE ID = 18’
HRESULT: 0x80041001
Details: Generic failure

Resolution:

There are few alerts from this server with the similar failed queries:

“SELECT Name FROM Win32_ServerFeature WHERE ID =’X’” , the only difference in those alerts is ID.

First I am logged in to this server and tried to run WBEMTEST and run those queries. After a few minutes all of them failed with the ‘Generic Failure’ error.

I am noticed other odd issues with this server :

• There is a performance issue. CPU load is very high, every 5-10 minutes it jumps up to 100% and stays almost stuck for a minute.

• If you start Server Manager ‘Server Roles’ and ‘Server Features’ both showing the “Error” instead of a role\features list. “Add role\Remove role” and “Add feature\Remove feature” are grayed out.

• There is a lot of events in Application Event Log like this: “Faulting application name: TrustedInstaller.exe, version: 6.1.7600.16385 bla-bla”. And a lot of “The Windows Modules Installer service terminated unexpectedly. It has done this 2067 time(s).” in System Event Log.

First of all, we nailed the process consuming CPU: TrustedInstaller.exe. When it takes 100% CPU we can see a lot of side-effects like monitoring scripts timeouts.

TrustedInstaller.exe is Windows Module Installer, it manages update installation and servicing processes.

How to investigate and resolve this?

The root cause is the corrupted package in %systemroot%\servicing\packages. We need to find it out and replace.

Note: you can’t just copy\paste updates from other server, you will have to use TAKEOWN and CACLS to get ownership and change permissions before you proceed.

How to find corrupted packages?

First, download SURT: System Update Readiness Tool for Windows Vista, for Windows Server 2008, for Windows 7, and for Windows Server 2008 R2 (http://support.microsoft.com/kb/947821). Please read the KB article carefully.

Run SURT.

Now we need to check logfiles:

• %SYSTEMROOT%\Logs\CBS\CheckSUR.log
• %SYSTEMROOT%\Logs\CBS\CheckSUR.persist.log
• %SYSTEMROOT%\Logs\CBS\CBS.log

I have found this in CBS.log:

2010-10-03 14:44:08, Info CBS Failed to get internal update: NetFx2-ServerCore-WOW64 in Package:
Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7600.16385
[HRESULT = 0x800f080c – CBS_E_UNKNOWN_UPDATE]

2010-10-03 14:44:08, Info CBS Failed to get internal update: MicrosoftWindowsPowerShell-WOW64 in Package: Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7600.16385
[HRESULT = 0x800f080c – CBS_E_UNKNOWN_UPDATE]

2010-10-03 14:44:08, Info CBS Failed to get internal update: NetFx3-ServerCore-WOW64 in Package:
Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7600.16385 [HRESULT = 0x800f080c – CBS_E_UNKNOWN_UPDATE]

2010-10-03 14:44:08, Info CBS Failed to get internal update: Printing-ServerCore-Role-WOW64 in Package: Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7600.16385
[HRESULT = 0x800f080c – CBS_E_UNKNOWN_UPDATE]

2010-10-03 14:44:08, Info CBS Failed to get internal update: FailoverCluster-Core-WOW64 in Package:
Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7600.16385 [HRESULT = 0x800f080c – CBS_E_UNKNOWN_UPDATE]

2010-10-03 14:44:09, Info CBS Failed to get internal update:
ServerCore-EA-IME-WOW64 in Package: Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7600.16385 [HRESULT = 0x800f080c – CBS_E_UNKNOWN_UPDATE]

2010-10-03 14:44:09, Info CBS Failed to get internal update: SUACore-WOW64 in
Package: Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7600.16385
[HRESULT = 0x800f080c – CBS_E_UNKNOWN_UPDATE]

All entries are referencing to the same package: Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7600.16385.

Now we need to copy those files from a ‘healthy’ server:

Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7600.16385.cat
Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7600.16385.mum

If you have no ‘healthy’ servers near you:

You will need to find (download from the Microsoft Support website) this update and extract files. How to extract contents from an .msu file:

expand -F:* Windows6.1-KB982293-x64.msu c:\updates\982293

You’ll get a few .cab files. Now it’s time to extract your .cut and .mum files:

expand -F:* Windows6.1-KB982293-x64.cab c:\updates\982293\cab

Now you  can copy those files to the package store.

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.