This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
dear community
we are using the official DHCP-management-pack (https://www.microsoft.com/en-us/download/details.aspx?id=54587) on our windows server 2022 - environment.
the MP is working well, but i have noticed the following 3 errors in our scom-management-server - log (Operations Manager - Log):
Event-ID: 26008
Level: Error
Source: Health SErvice Modules
Description:
The DhcpAdminEvents event log on computer 'Domain-Controller' is still corrupt. The Event Log Provider will attempt to recover by skipping over a possible bad record. The Provider may skip up to two records.
One or more workflows were affected by this.
Workflow name: Microsoft.Windows.DHCPServer.10.0.FailoverServerWatcher.UnitMonitor.LostCommunicationWithfailoverPartnerServer
.....
two other workflows are also affected:
Microsoft.Windows.DHCPServer.10.0.FailoverServerWatcher.UnitMonitor.ErrorCommunicationWithfailoverPartnerServer
Microsoft.Windows.DHCPServer.10.0.FailoverServerWatcher.UnitMonitor.OutOfTimeSync
i have already granted the scom management server action account the AD-group "event log readers" to access the DHCP-event-log. i have double-checked it and can access the provided event-log with the management-server-action-account without any problems.
but the error still exists and is logged once per minute
ok, final status-update:
we had opened a microsoft case to analyze this. root-cause was an error in the DHCP-server itself.
in the event-log of the dhcp server were the following entries:
Level: Error
Source: DHCP-Server
Event-ID: 20319
Task Category: Name Registration
General: Forward record registration for IPv4 address [IP-adress] and FQDN android-e3d9b053ff0d915a.fqdn.local failed with error 9560 (DNS name contains an invalid character.
according to the following KB-article:
after we fixed these DNS-entries / devices, the SCOM-error on the SCOM-management-server itself was gone too! it seems, that only these error-entries or incompatible characters in the hostname of the device were responsible for not accessing / gaining the requested informations of the DHCP-Log.
....that was a nasty one....
Hey Sandro,
please mark your replyy as an answer. Others need to know the solution here :) I have also seen this.
Thanks for sharing!
Regards,
Stoyan
hmmm unfortunately i can not mark my own answer :D (greyed out) could you kindly do this task?
Hi Sandro,
I just did a bit of troubleshooting regarding this, although I must say I had to troubleshoot a RPC Server unavailbale" exceptrion withiun the same event.
First I need to say that the action:
i have already granted the scom management server action account the AD-group "event log readers" to access the DHCP-event-log.
is correct in case you have an "Access Denied" in the exception. In your particular case the exception is:
The DhcpAdminEvents event log on computer 'Domain-Controller' is still corrupt. The Event Log Provider will attempt to recover by skipping over a possible bad record. The Provider may skip up to two records.
Can you please do me a fvour and empty the DhcpAdminEvents event logs on the affected systems, make sure you can access those in the Events Viewer and then check if theose events come up again?
----------
(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)
Regards
Stoyan Chalakov
i have cleared the dhcp admin event log (also disabled and enabled it) but the error still occurs.
i'm able to connect to the affected log from the scom-management-server with the management server action account.
very strange...
Hmm...I am not quite sure how to troubleshoot either :(
What is the story with the SCOM agent on the Domain Controller in question? Can you please filter the event log Operations Manager and check for related events?
I am really guessing now..
on the scom-agent-log on the domain-controller, the log-output is excactly the same.
i will delete and reinstall the MP again and flush the agent-caches on the domain-controllers. maybe there is some kind of stuck in there....
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(92.8, 31%, 18%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EC%3C/text%3E%3C/svg%3E)
These workflows are trying to access the DHCP event log on the failover dhcp server, not on the local domain controller. You need to make sure that everything's fine on the other dhcp server (likelyanother domain controller) and that opening remote event viewer from one to the other works, and that the runas account used has proper permissions to read remote events.
as already mentioned above, the management server action account can access the event-logs without any problems. i double-checked it -> logged on with the msa-account on my scom-server and then opened the dhcp-event-log of the domain-controller and can access these logs without any problems.
agent-cache-flush and reinstall the scom-agent didn't help :-( this is driving me crazy....
It's from one dhcp to the other, not from SCOM MS to dhcp.
And it's using the dhcp server action account, which by default is local system and likely doesnt have permissions to open dhcp event log on the other dhcp server.
Also the scom server action account has no real reason to have the permission to open logs on the dhcp server, so that might be something you want to tighten
but on the affected server in the operations-manager-log itself, the event is telling me that he can't access to his own DHCP admin - event - log.
so i'm not sure thats a dependency from one DC to another DC.
This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.