Windows service rule triggering with a value of "NotInstalled"
|Article:TECH145835|||||Created: 2010-12-08|||||Updated: 2011-01-13|||||Article URL http://www.symantec.com/docs/TECH145835|
A rule which checks for the status of a Windows service is falsely alerting with a metric value of "NotInstalled". The rule is resolved shortly after it triggers once a legitimate value is returned by the metric.
- Monitor Solution for Servers SP5 7.0.8641
- Windows Server 2008 R2
This behavior is caused a memory leak which occurs in the wmiprvse.exe process when queries are made to the "Win32_Service" WMI class. This process will continue to consume memory until it crashes which coincides with when the value of "NotInstalled" is reported by the metric.
The following Microsoft article addresses this issue:
The "Win32_Service" WMI class leaks memory in Windows Server 2008 R2 and in Windows 7
Windows Service metric sometimes returns value of "NotInstalled"
Article URL http://www.symantec.com/docs/TECH145835