mom: correcting a most troublesome mom 2005 agent...

after a long holiday, the first thing i want to do is jump right into disciplining a bad agent.  i wish i could say it was something really painful to lament over.  unfortunately, it wasn't.  nor exciting.  it was like a cockroach: elusive and slippery.  i couldn't make it go away.  this is probably the third time that various corrective actions were done against this server.

it seems the real issue was wmi corruption.  i have no idea what caused it or how it happened.  i suppose as far as wmi goes it's always a mystery.  anyway, it started off that way.  didn't quite end that way.  some of the errors i was seeing:

The response processor failed to execute a response.  The response returned the error message: The remote procedure call failed.

Response Details:

Rule ID:  {E8665A8F-17B6-4C7C-BA62-CAC4E33C13CD}
Response description: script: AD CPU Overload

The response 'script: AD CPU Overload' has been running more than 300 seconds and exceeded the time allowed to run. 
This might indicate the response is engaged in an infinite loop or is hanging.

An error occurred on line 250 while executing script 'Microsoft Windows File Server SMB counters calculation'
Source: SWbemRefresher
Description: Invalid class 

 

and now... the things i did to fix it:

1. repair wmi:
• Rundll32 wbemupgd, CheckWMISetup
• Rundll32 wbemupgd, RepairWMISetup
2. register all wmi components:
• cd /d %windir%\system32\wbem
• for %i in (*.dll) do RegSvr32 -s %i
• for %i in (*.exe) do %i /RegServer
3. resync wmi performance counters:
• winmgmt /clearadap
• winmgmt /resyncperf
4. recompile all mofs:
• cd /d %windir%\system32\wbem
• for /r %i in (*.mof *.mfl) do mofcomp %i
5. reinstall the mom agent (just to make sure all components are placed back into wmi correctly)

 

after running all of the above steps, i still encountered mom errors where script executions continued to fail.  the next step is a bit unusual because everything in the environment suggests that it doesn't need to be done.  i verified that we were running at least patch 11 (which supposedly addresses this issue) as noted in this article.  since it still continued to fail, i checked out the scriptscan settings to verify that it was turned off.  after verifying both of those things, i decided... what the hell?  i'll just unregister it.  so i did...

 

1. unregister mcafee 8.0i scriptproxy.dll:

• cd /d %programfiles%\network associates\virusscan
• regsvr32 –u scriptproxy.dll

 

and now... it finally works.