Health Service Script Event 4001

Problem

The event log is littered with regular copies of the following event:

SNAGHTML23ad5ff5

“GetSQL2008SPNState.vbs : The Query ‘SELECT ProtocolName FROM ServerNetworkProtocol where Enabled = true and InstanceName = ‘INSTANCE” did not return any valid instances.  Please check to see if this is a valid WMI Query.. Invalid class”

I do not know what impact this has on SCOM  (if any), but the warning is escalated to the Administrative Events view and is thus making it harder to spot other errors as it occurs very frequently. On one of my servers this error occurred every 10 minutes or so. Furthermore, I suspect the cause of the problem to be changes in RunAS accounts in SCOM, but I am not certain.

Solution

I found this on the Technet forums http://social.technet.microsoft.com/Forums/en-US/operationsmanagermgmtpacks/thread/01eff618-1087-4b6a-9d3f-9f1402ddf3f4:

Reregister SQL management object (MOF) data. I have yet to figure out exactly what MOF data is, but SCOM is using it to monitor the SQL server instance(s) on the server. Perform the following operations:

  • Start an administrative command prompt
  • Browse to “C:\Program Files (x86)\Microsoft SQL Server\100\Shared”
  • Run mofcomp sqlmgmproviderxpsp2up.mof
  • Restart the SCOM agent service (System Center Management)

image

Author: DizzyBadger

SQL Server DBA, Cluster expert, Principal Analyst

5 thoughts on “Health Service Script Event 4001”

    1. Could it be related to permissions? I have had other similar issues where the culprit have been the SCOM run-as account not being a member of local server admins on the sql server. You may also have to add it to the SQL sysadmins role in SSMS. If there is no run-as account defined for this management pack, try to add one.

    1. “File not found” usually points to SCOM agent issues. It could be firewall/network issues between the SQL server and the SCOM servers. In such cases I usually try to remove the SCOM agent, reboot the server and then reinstall the agent. Then monitor the Operations manager event log for issues regarding management pack distribution. It could take a considerable amount of time before the SCOM server tries to push the SQL server MP, so I usually leave it alone for at least 24 hours and then inspect the log in chronological order. The SCOM agent is very chatty when it comes to log messages, so analysis may take some time

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.