This Powershell Script is basically intended to stop and start OpsMgr related services (“cshost”, “healthservice”, “omsdk”) on all SCOM Management Servers in a mass. This script can be used to stop and start other windows services too. You basically need to enter the server and service name into the related arrays.

The Script is also available on TechNet Script Gallery for download.
https://gallery.technet.microsoft.com/Start-Stop-all-OpsMgr-on-3231855f

Powershell Script :

# Start-or-Stop-all-OpsMgr-Services-on-all-ManagementServers.ps1
# Version 7.0
# Date: 7/17/2017
# Author: Cengiz KUSKAYA
# Description: A script to stop or start OpsMgr Services on all SCOM Management Servers in mass.

# START OpsMgr Services on Management Servers #
#######################################
$Server = @(“SCOMMS01”, “SCOMMS02”, “SCOMMS03”) # Note: Multiple Server Names can be added in the following format (“SCOMMS01”, “SCOMMS02”, “SCOMMS03”)
$ServiceList = @(“cshost”, “healthservice”, “omsdk”) # Note: Multiple Service Names can be added in the following format (“cshost”, “healthservice”, “omsdk”)
$ServicesStateStopped = get-service -computername $Server -name $ServiceList

foreach ($Service in $ServicesStateStopped)
{
if ($Service.status -eq “Stopped”)
{
$Service | Start-Service
Write-Host ($Service).Name “Service has been STARTED on Server” $Service.MachineName “….!” -Separator ” -> ” -foregroundcolor white -backgroundcolor green
}
else
{
Write-Host ($Service).Name “Service is already in RUNNING State on Server” $Service.MachineName “….!” -Separator ” -> ” -foregroundcolor DARKRED -backgroundcolor yellow
}
}

# STOP OpsMgr Services on Management Servers #
######################################

$Server = @(“SCOMMS01”, “SCOMMS02”, “SCOMMS03”) # Note: Multiple Server Names can be added in the following format (“SCOMMS01”, “SCOMMS02”, “SCOMMS03”)
$ServiceList = @(“cshost”, “healthservice”, “omsdk”) # Note: Multiple Service Names can be added in the following format (“cshost”, “healthservice”, “omsdk”)
$ServicesStateRunning = get-service -computername $Server -name $ServiceList

foreach ($Service in $ServicesStateRunning)
{
if ($Service.status -eq “Running”)
{
$Service | Stop-Service
Write-Host ($Service).Name “Service has been STOPPED on Server” $Service.MachineName “….!” -Separator ” -> ” -foregroundcolor white -backgroundcolor red
}
else
{
Write-Host ($Service).Name “Service is already in STOPPED State on Server” $Service.MachineName “….!” -Separator ” -> ” -foregroundcolor DARKRED -backgroundcolor yellow
}
}

Source : Start & Stop all OpsMgr Services on all SCOM Management Servers in a mass with Powershell

EventID=15000
Severity=Informational Message=The pool member has initialized %n%nManagement Group: %1 %nManagement Group ID: %2 %nPool Name: %3 %nPool ID: %4 %nPool Version: %5 %nNumber of Pool Members: %6 %nNumber of Observer Only Pool Members: %7 %nNumber of Members Added: %8 %nNumber of Members Removed: %9 %nNumber of Instances: %10 %nNumber of Instances Added: %11 %nNumber of Instances Removed: %12

EventID=15001
Severity=Informational Message=More than half of the members of the pool have acknowledged the most recent initialization check request The pool member will send a lease request to acquire ownership of managed objects assigned to the pool %n%nManagement Group: %1 %nManagement Group ID: %2 %nPool Name: %3 %nPool ID: %4 %nPool Version: %5 %nNumber of Pool Members: %6 %nNumber of Observer Only Pool Members: %7 %nNumber of Instances: %8

EventID=15002
Severity=Error Message=The pool member cannot send a lease request to acquire ownership of managed objects assigned to the pool because half or fewer members of the pool acknowledged the most recent initialization check request The pool member will continue to send an initialization check request %n%nManagement Group: %1 %nManagement Group ID: %2 %nPool Name: %3 %nPool ID: %4 %nPool Version: %5 %nNumber of Pool Members: %6 %nNumber of Observer Only Pool Members: %7 %nNumber of Instances: %8

EventID=15003
Severity=Informational Message=The availability of one or more members of the pool has changed The ownership for all managed objects assigned to the pool will be redistributed between available pool members %n%nManagement Group: %1 %nManagement Group ID: %2 %nPool Name: %3 %nPool ID: %4 %nPool Version: %5 %nLocal Pool Member Available: %6 %nNumber of Pool Members: %7 %nNumber of Observer Only Pool Members: %8 %nNumber of Members Available: %9 %nNumber of Instances: %10 %nNumber of Instances Locally Activated: %11 %nNumber of Instances Locally Deactivated: %12

EventID=15004
Severity=Error Message=The pool member no longer owns any managed objects assigned to the pool because half or fewer members of the pool have acknowledged the most recent lease request The pool member has unloaded the workflows for managed objects it previously owned %n%nManagement Group: %1 %nManagement Group ID: %2 %nPool Name: %3 %nPool ID: %4 %nPool Version: %5 %nNumber of Pool Members: %6 %nNumber of Observer Only Pool Members: %7 %nNumber of Instances: %8

Source : Part 12 : SCOM 2012 R2 HealthService Event Reference / PoolManager

Cengiz KUSKAYA

EventID=9000
Severity=Error Message=The task status was changed to Failed on restart and was unable to be resumed because the System Center Management service was shut down

EventID=9001
Severity=Warning Message=The task is not active, and the task status was not correctly updated There is no way to determine if the task has run

EventID=9002
Severity=Error Message=The task is not active, and the task status was not correctly updated There is no way to determine if the task has run

EventID=9003
Severity=Error Message=The task attempted to suspend itself but could not because no suspend capability was defined in the task definition

EventID=9004
Severity=Error Message=The task could not be delivered to the targeted object’s System Center Management service

Source : Part 11 : SCOM 2012 R2 HealthService Event Reference / JobManager

Cengiz KUSKAYA

EventID=8000
Severity=Warning Message=A subscriber data source in management group %1 has posted items to the workflow, but has not received a response in %5 minutes Data will be queued to disk until a response has been received This indicates a performance or functional problem with the workflow%n Workflow Id : %2%n Instance : %3%n Instance Id : %4

EventID=8001
Severity=Success Message=A subscriber data source in management group %1 has caught up processing queued data%n Workflow Id : %2%n Instance : %3%n Instance Id : %4

EventID=8002
Severity=Warning Message=A subscriber data source in management group %1 has groomed data due to the queue size of %5 MB being exceeded%n Workflow Id : %2%n Instance : %3%n Instance Id : %4

Source : Part 10 : SCOM 2012 R2 HealthService Event Reference / DataPublisherManager

Cengiz KUSKAYA

EventID=10000
Severity=Warning Message=A scheduled discovery task was not started because the previous task for that discovery was still executing %n%nDiscovery name: %2 %nInstance name: %3 %nManagement group name: %1

EventID=10001
Severity=Warning Message=An error occurred starting a discovery task %nError Code: %1 %n%nDiscovery name: %3 %nInstance name: %4 %nManagement group name: %2 EventID=10002 Severity=Warning Message=Unable to write discovery data for discovery The discovery task will be run again at its next scheduled time %nError Code: %1 %n%nDiscovery name: %3 %nInstance name: %4 %nManagement group name: %2

EventID=10003
Severity=Warning Message=Non-empty incremental data submitted and will be dropped %n%nDiscovery name: %2 %nInstance name: %3 %nManagement group name: %1

EventID=10004
Severity=Warning Message=Discovery manager has detected an unsupported topology On demand discovery is being disabled and the health service will be restarted in legacy mode

EventID=10005
Severity=Warning Message=An unexpected error has occurred in a discovery task %nError: %1 %n%nDiscovery name: %3 %nInstance name: %4 %nManagement group name: %2

EventID=10006
Severity=Warning Message=Discovery task has timed out %n%nDiscovery name: %2 %nInstance name: %3 %nManagement group name: %1

EventID=10007
Severity=Warning Message=Discovery task has been canceled unexpectedly %n%nDiscovery name: %2 %nInstance name: %3 %nManagement group name: %1

EventID=10008
Severity=Warning Message=Discovery task has been suspended unexpectedly %n%nDiscovery name: %2 %nInstance name: %3 %nManagement group name: %1

EventID=11350
Severity=Error Message=Discovery failed to initialize due to invalid schedule configuration %n%nInvalid Configuration: %1 %n%nDiscovery name: %3 %nInstance name: %4 %nManagement group: %2

EventID=11351
Severity=Error Message=Discovery failed to initialize due to invalid schedule configuration %n%nRejected Item: %1 %n%nRejected Value: %2 %n%nDiscovery name: %4 %nInstance name: %5 %nManagement group: %3

EventID=11352
Severity=Error Message=Discovery failed to initialize because the recurring interval can not be greater than the full re-sync interval for the schedule %n%nRecurring Interval Length (seconds): %1 %n%nFull Re-Sync Interval Length (seconds): %2 %n%nDiscovery name: %4 %nInstance name: %5 %nManagement group: %3

EventID=11353
Severity=Error Message=Discovery failed to initialize because the maximum number of schedule windows has been reached %n%nNumber of windows: %1 %n%nMaximum number of windows allowed: %2 %n%nDiscovery name: %4 %nInstance name: %5 %nManagement group: %3

EventID=11354
Severity=Error Message=Discovery failed to initialize because there is no schedule window specified %n%nDiscovery name: %2 %nInstance name: %3 %nManagement group: %1

EventID=11355
Severity=Error Message=Discovery failed to initialize because some schedule window has a negative start %n%nDiscovery name: %2 %nInstance name: %3 %nManagement group: %1

EventID=11356
Severity=Error Message=Discovery failed to initialize because some schedule window has a non-positive length of time %n%nDiscovery name: %2 %nInstance name: %3 %nManagement group: %1

EventID=11357
Severity=Error Message=Discovery failed to initialize because some schedule windows overlap with each other %n%nDiscovery name: %2 %nInstance name: %3 %nManagement group: %1

EventID=11358
Severity=Error Message=Discovery failed to initialize because the last and first schedule windows overlap %n%nDiscovery name: %2 %nInstance name: %3 %nManagement group: %1

EventID=11359
Severity=Error Message=Discovery failed to initialize because the first schedule window is after the full interval %n%nDiscovery name: %2 %nInstance name: %3 %nManagement group: %1

EventID=11360
Severity=Error Message=Discovery failed to initialize because the number of excluded dates in the schedule is greater than the maximum allowed %n%nNumber of excluded dates: %1 %n%nMaximum number allowed: %2 %n%nDiscovery name: %4 %nInstance name: %5 %nManagement group: %3

EventID=11361
Severity=Error Message=Discovery failed to initialize because the exclude date interval in the schedule failed to parse using the MM/dd format %n%nDay of the year in error: %1 %n%nDiscovery name: %3 %nInstance name: %4 %nManagement group: %2

EventID=11362
Severity=Error Message=Discovery failed to initialize because the specified schedule is not recognized as a weekly or simple recurring one %n%nDiscovery name: %2 %nInstance name: %3 %nManagement group: %1

EventID=11363
Severity=Error Message=Discovery failed to initialize because the specified schedule interval number is out of range %n%nInterval: %1 %n%nMinimum Unit Number: %2 %n%nMaximum Unit Number: %3 %n%nDiscovery name: %5 %nInstance name: %6 %nManagement group: %4

EventID=11364
everity=Error Message=Discovery failed to initialize because the specified schedule interval is greater than the maximum allowed %n%nInterval (seconds): %1 %n%nMaximum (seconds): %2 %n%nDiscovery name: %4 %nInstance name: %5 %nManagement group: %3

EventID=11365
Severity=Error Message=Discovery failed to initialize because the specified schedule contains an invalid multiple days interval The start and end mask validation failed Make sure to choose only one day of the week for each, and that they differ from each other %n%nDiscovery name: %2 %nInstance name: %3 %nManagement group: %1

EventID=11366
Severity=Error Message=Discovery failed to initialize because some schedule window has no day of the week set %n%nDiscovery name: %2 %nInstance name: %3 %nManagement group: %1

EventID=11367
Severity=Error Message=Discovery failed to initialize because some “hour in the day” in the schedule could not be parsed on the HH:mm format %n%nHour in the day: %1 %n%nDiscovery name: %3 %nInstance name: %4 %nManagement group: %2

EventID=11368
Severity=Error Message=Discovery failed to initialize because in a single day window, the start hour is greater than the end hour %n%nDiscovery name: %2 %nInstance name: %3 %nManagement group: %1

EventID=11369
Severity=Error Message=Discovery failed to initialize because some value in its schedule configuration is too long %n%nValue: %1 %n%nDiscovery name: %3 %nInstance name: %4 %nManagement group: %2

EventID=11370
Severity=Error Message=Discovery failed to initialize because the specified schedule spread initialization interval number is out of range %n%nInterval: %1 %n%nMinimum Unit Number: %2 %n%nMaximum Unit Number: %3 %n%nDiscovery name: %5 %nInstance name: %6 %nManagement group: %4

EventID=11371
Severity=Error Message=Discovery failed to initialize because the specified schedule spread initialization interval is greater than the maximum allowed %n%nInterval (seconds): %1 %n%nMaximum (seconds): %2 %n%nDiscovery name: %4 %nInstance name: %5 %nManagement group: %3

Source : Part 9 : SCOM 2012 R2 HealthService Event Reference / DiscoveryManager

Cengiz KUSKAYA

EventID=7000
Severity=Error Message=The Health Service could not log on the RunAs account %1\%2 for management group %5 The error is %3(%4) This will prevent the health service from monitoring or performing actions using this RunAs account

EventID=7001
Severity=Warning Message=The password for RunAs account %1\%2 for management group %5 is expiring on %3 If the password is not updated by then, the health service will not be able to monitor or perform actions using this RunAs account There are %4 days left before expiration

EventID=7002
Severity=Error Message=The Health Service could not log on the RunAs account %1\%2 for management group %3 because it has not been granted the “%4” right

EventID=7004
Severity=Warning Message=The Health Service received a secure message from management group %1 which was encrypted using the wrong public key This message has been discarded and the public key will be re-published

EventID=7005
Severity=Error Message=The Health Service was unable to publish its public key to management group %1 and will be unable to receive secure messages until this key is published Attempts to publish the key will continue

EventID=7006
Severity=Success Message=The Health Service has published the public key [%2] used to send it secure messages to management group %1 This message only indicates that the key is scheduled for delivery, not that delivery has been confirmed

EventID=7007
Severity=Warning Message=The Health Service has defaulted to using the action account for RunAs Profile %1 because it did not receive any information about this RunAs Profile Depending on your configuration monitoring may not be able to proceed for modules which depend on this RunAs Profile

EventID=7008
Severity=Warning Message=The Health Service has defaulted to using the action account for RunAs Profile Id %1 requested by Rule %2 because it did not receive any information about this RunAs Profile Depending on your configuration, monitoring may not be able to proceed for modules which depend on this RunAs Profile Other rules may be affected and this event will not continue to be published for each failing rule

EventID=7009
Severity=Error Message=The Health Service cannot find the credential for the action account for management group %1 Monitoring will be significantly impacted

EventID=7010
Severity=Warning Message=The Health Service has downloaded new configuration for management group %1, and that configuration has specified a new action account, but the account is not of type ‘Action Account’ or ‘Windows Credential’ This change has been ignored as it would significantly impact monitoring Please fix the Action Account RunAs Profile to be an Action Account or Windows Credential

EventID=7011
Severity=Warning Message=The Health Service has downloaded a new account in management group %1, but the password is blank The Health Service does not support managing Windows credentials with blank passwords The account has not been updated If this account existed previously, it’s old password will be used and logon may fail If this is a new account, the action account will be used instead The name of the account has been withheld for security purposes

EventID=7012
Severity=Warning Message=The health service received a credential from management group %1 to run a task with, but the credential has a blank password and has been rejected for security purposes The account name has been withheld, also for security purposes

EventID=7013
Severity=Warning Message=The keypair that the health service uses to receive secure messages is expiring on %1 The health service will be recycled and the key regenerated

EventID=7014
Severity=Warning Message=The RunAs account %1\%2 for management group %5 is expiring on %3 If the account expiration is not extended by then, the health service will not be able to monitor or perform actions using this RunAs account There are %4 days left

EventID=7015
Severity=Error Message=The Health Service cannot verify the future validity of the RunAs account %1\%2 for management group %5 The error is %3(%4)

EventID=7016
Severity=Error Message=The Health Service cannot verify the future validity of the RunAs account %1\%2 for management group %5 due to an error retrieving information from Active Directory (for Domain Accounts) or the local security authority (for Local Accounts) The error is %3(%4)

EventID=7017
Severity=Warning Message=The health service blocked access to the windows credential %1\%2 because it is not authorized on management group %3 You can run the HSLockdown tool to change which credentials are authorized

EventID=7018
Severity=Error Message=The health service blocked access to the non-windows credential with ID %2 because it is not authorized on management group %2 You can run the HSLockdown tool to change which credentials are authorized

EventID=7019
Severity=Success Message=The Health Service has validated all RunAs accounts for management group %1

EventID=7020
Severity=Warning Message=The Health Service has validated all RunAs accounts for management group %1, except those we could not monitor

EventID=7021
Severity=Error Message=The Health Service was unable to validate any user accounts in management group %1

EventID=7022
Severity=Error Message=The Health Service has downloaded secure configuration for management group %1, and processing the configuration failed with error code %2(%3)

EventID=7023 Severity=Success Message=The Health Service has downloaded secure configuration for management group %1 successfully

EventID=7024
Severity=Success Message=The Health Service successfully logged on all accounts for management group %1

EventID=7025
Severity=Success Message=The Health Service has authorized all configured RunAs accounts to execute for management group %1

EventID=7026
Severity=Success Message=The Health Service successfully logged on the RunAs account %1\%2 for management group %3

EventID=7027
Severity=Success Message=The Health Service authorized the RunAs account %1\%2 to execute for management group %3

EventID=7028
Severity=Success Message=All RunAs accounts for management group %1 have the correct logon type EventID=7029 Severity=Error Message=The Health Service was detected that the private key for secure data processing has been removed or is invalid The certificate and key will be regenerated

Source : Part 8 : SCOM 2012 R2 HealthService Event Reference / SecureStorageManager

Cengiz KUSKAYA

EventID=5101
Severity=Error Message=Get the snapshot of current health states for selected instance failed with error: %7 %n%nInstance ID: %6 %nManagement Group ID: %5

EventID=5102
Severity=Error Message=Get the state of the monitor failed with error: %8 %n%nMonitor ID: %7 %nInstance ID: %6 %nManagement Group ID: %5

EventID=5200
Severity=Warning Message=One of the state change notification rules failed to process state change request %n%nManagement Group ID: %2 %nData item type: %1

EventID=5201
Severity=Warning Message=Failed to generate string representing post pending data item(s) This data will be lost %n%nManagement Group ID: %2 %nData item type: %1

EventID=5202
Severity=Warning Message=Failed to persist string representing post pending data item(s) This data will be lost %n%nManagement Group ID: %2 %nData item type: %1

EventID=5203
Severity=Warning Message=Failed to retrieve previously persisted data This data may be lost %n%nManagement Group ID: %2 %nData item type: %1

EventID=5204
Severity=Warning Message=Failed to store post pending data item(s), created from previously persisted string, internally This data will be lost %n%nManagement Group ID: %2 %nData item type: %1

EventID=5205
Severity=Warning Message=Failed to store post pending data item(s) internally while acknowledgement for previous post was pending delivery This data will be lost %n%nManagement Group ID: %2 %nData item type: %1

EventID=5206
Severity=Warning Message=In memory container (%1) had to drop data because it reached max limit Possible data loss

EventID=5207
Severity=Warning Message=Failed to store post pending data item(s) internally while no subscribed module was present This data will be lost %n%nManagement Group ID: %2 %nData item type: %1

EventID=5208
Severity=Warning Message=Failed to persist post pending data item(s) while shutting down local health service This data will be lost %n%nManagement Group ID: %2 %nData item type: %1

EventID=5209 Severity=Warning Message=Failed to store at least one posted data item internally It will be lost if acknowledgement is not delivered for original post %n%nManagement Group ID: %2 %nData item type: %1

EventID=5300
Severity=Error Message=Local health service is not healthy Entity state change flow is stalled with pending acknowledgement %n%nManagement Group: %2 %nManagement Group ID: %1

EventID=5301
Severity=Success Message=Entity state change flow in local health service resumed %n%nManagement Group: %2 %nManagement Group ID: %1

EventID=5302
Severity=Error Message=Local health service is not healthy Monitor state change flow is stalled with pending acknowledgement %n%nManagement Group: %2 %nManagement Group ID: %1

EventID=5303
Severity=Success Message=Monitor state change flow in local health service resumed %n%nManagement Group: %2 %nManagement Group ID: %1

EventID=5304
Severity=Error Message=Local health service is not healthy Alert flow is stalled with pending acknowledgement %n%nManagement Group: %2 %nManagement Group ID: %1

EventID=5305
Severity=Success Message=Alert flow in local health service resumed %n%nManagement Group: %2 %nManagement Group ID: %1

EventID=5399
Severity=Warning Message=A rule has generated %6 alerts in the last %7 seconds Usually, when a rule generates this many alerts, it is because the rule definition is misconfigured Please examine the rule for errors In order to avoid excessive load, this rule will be temporarily suspended until %8 %nRule: %2 %nInstance: %3 %nInstance ID: %4 %nManagement Group: %1

EventID=5400
Severity=Warning Message=Failed to replace parameter while creating the alert %n%nAlert: %6 %nWorkflow: %2 %nInstance: %3 %nInstance ID: %4 %nManagement Group: %1 %n%nFailing replacement: %7 EventID=5401 Severity=Warning Message=Failed to replace parameter while creating the alert for monitor state change %n%nWorkflow: %7 %nInstance: %8 %nInstance ID: %5 %nManagement Group: %6 %n%nFailing replacement: %4

EventID=5402
Severity=Warning Message=Parameter replacement during creation of the alert failed causing unexpected suppression used %n%nAlert: %6 %nWorkflow: %2 %nInstance: %3 %nInstance ID: %4 %nManagement Group: %1 %n%nFailing replacement: %7

EventID=5404
Severity=Warning Message=Invalid value for alert priority used with configuration of the rule It was outside of allowed range and had to be adjusted to closest valid value %n%nAlert: %5 %nWorkflow: %2 %nInstance: %3 %nInstance ID: %4 %nManagement Group: %1 %n%nUsed priority value: %6

EventID=5405
Severity=Warning Message=Invalid value for alert severity used with configuration of the rule It was outside of allowed range and had to be adjusted to closest valid value %n%nAlert: %5 %nWorkflow: %2 %nInstance: %3 %nInstance ID: %4 %nManagement Group: %1 %n%nUsed severity value: %6

EventID=5406
Severity=Warning Message=Incorrect value for health state was used while overriding monitor property ‘DefaultState’ It was not recognized and monitor registration will fail until it is corrected %nManagement Group: %5 %nManagement Group ID: %1 %nInstance: %7 %nInstance ID: %2 %nMonitor: %6 %n%nMonitor ID: %3 %n%nRequested State: %4

EventID=5407
Severity=Success Message=Invalid value for health state was used while overriding monitor property ‘DefaultState’ It was outside of allowed range and had been adjusted to use state ‘Success’ %nManagement Group: %5 %nManagement Group ID: %1 %nInstance: %7 %nInstance ID: %2 %nMonitor: %6 %n%nMonitor ID: %3 %n%nRequested State: %4

EventID=5408
Severity=Error Message=Failed to replace parameter while creating the alert It was possibly caused by incorrect XPATH and will result in rule unload %n%nAlert: %6 %nWorkflow: %2 %nInstance: %3 %nInstance ID: %4 %nManagement Group: %1 %n%nFailing replacement: %7

EventID=5409
Severity=Error Message=Failed to replace parameter while creating the alert for monitor state change It was possibly caused by incorrect XPATH and will result in monitor unload %n%nWorkflow: %7 %nInstance: %8 %nInstance ID: %5 %nManagement Group: %6 %n%nFailing replacement: %4 EventID=5500 Severity=Informational Message=Frequent state change requests caused the incoming state change request to be dropped due to it being older than the currently recorded state change for this monitor This could also be due to an invalid configuration for this monitor %n%nAffected monitor: %9 %nInstance: %10 %nInstance ID: %2 %nManagement Group: %8 %n%nRequest generated time: %4 %nRequested state: %6 %n%nRecorded time: %5 %nRecorded state %7

Source : Part 7 : SCOM 2012 R2 HealthService Event Reference / HealthManager

Cengiz KUSKAYA

EventID=4000
Severity=Error Message=A monitoring host is unresponsive or has crashed. The status code for the host failure was %1

EventID=4001
Severity=Error Message=ESE failure trying to remove module state. The status code for the failure was %1

Source : Part 6 : SCOM 2012 R2 HealthService Event Reference / ExecutionManager 

Cengiz KUSKAYA

EventID=1100
Severity=Error Message=Property reference with id:”%5″ in workflow “%4”, running for instance “%3″ with id:”%2” cannot be resolved Workflow will not be loaded Management group “%1”

EventID=1101
Severity=Error Message=Host reference in workflow “%4”, running for instance “%3″ with id:”%2” cannot be resolved Workflow will not be loaded Management group “%1”

EventID=1102
Severity=Error Message=Rule/Monitor “%4” running for instance “%3″ with id:”%2” cannot be initialized and will not be loaded Management group “%1”

EventID=1103
Severity=Warning Message=Summary: %2 rule(s)/monitor(s) failed and got unloaded, %3 of them reached the failure limit that prevents automatic reload Management group “%1” This is summary only event, please see other events with descriptions of unloaded rule(s)/monitor(s)

EventID=1104
Severity=Error Message=RunAs profile in workflow “%4”, running for instance “%3″ with id:”%2” cannot be resolved Workflow will not be loaded Management group “%1”

EventID=1105
Severity=Error Message=Type mismatch for RunAs profile in workflow “%4”, running for instance “%3″ with id:”%2” Workflow will not be loaded Management group “%1”

EventID=1106
Severity=Error Message=Cannot access plain text RunAs profile in workflow “%4”, running for instance “%3″ with id:”%2” Workflow will not be loaded Management group “%1”

EventID=1108
Severity=Error Message=An Account specified in the Run As Profile “%7” cannot be resolved Specifically, the account is used in the Secure Reference Override “%6” %n%nThis condition may have occurred because the Account is not configured to be distributed to this computer To resolve this problem, you need to open the Run As Profile specified below, locate the Account entry as specified by its SSID, and either choose to distribute the Account to this computer if appropriate, or change the setting in the Profile so that the target object does not use the specified Account %n%nManagement Group: %1 %nRun As Profile: %7 %nSecureReferenceOverride name: %6 %nSecureReferenceOverride ID: %4 %nObject name: %3 %nObject ID: %2 %nAccount SSID: %5

EventID=1109
Severity=Informational Message=All credential references resolved successfully %n%n %n%nManagement Group: %1

EventID=1200
Severity=Informational Message=New Management Pack(s) requested Management group “%1″, configuration id:”%2″

EventID=1201
Severity=Informational Message=New Management Pack with id:”%1″, version:”%2″ received

EventID=1202
Severity=Warning Message=New Management Pack with id:”%1″, version:”%2″ conflicts with cached Management Pack Condition indicates wrong server configuration

EventID=1203
Severity=Warning Message=Management Pack with id:”%1″, version:”%2″ has been changed locally Management Pack cache file will be deleted and re-requested from server

EventID=1204
Severity=Informational Message=Management Pack with id:”%1″, version:”%2” is no longer used by HealthService and will be deleted from cache

EventID=1205
Severity=Informational Message=Configuration reload request received Configuration for management group “%1” will be reloaded

EventID=1206
Severity=Error Message=Rule/Monitor “%2”, running for instance “%3″ with id:”%4” failed, got unloaded and reached the failure limit that prevents automatic reload Management group “%1”

EventID=1207
Severity=Warning Message=Rule/Monitor “%4” running for remote instance “%3″ with id:”%2” will be disabled as it is not remotable Management group “%1″

EventID=1208
Severity=Warning Message=Ignoring file %1 as it is not a Management Pack EventID=1209 Severity=Error Message=Management Pack with id:”%1″, version:”%2” has been requested “%3” times Management group “%4”

EventID=1210
Severity=Informational Message=New configuration became active Management group “%1″, configuration id:”%2”

EventID=1215
Severity=Informational Message=Suspending monitoring for instance “%3″ with id:”%2” as the instance maintenance mode is ON Management group “%1”

EventID=1216
Severity=Informational Message=Resuming monitoring for instance “%3″ with id:”%2” as the instance maintenance mode is OFF Management group “%1”

EventID=1217
Severity=Informational Message=The Microsoft Monitoring Agent running on computer “%1″ is suspended for the following reason:%n”%2”

EventID=1220
Severity=Error Message=Received configuration cannot be processed Management group “%1” The error is %2(%3)

EventID=1221
Severity=Informational Message=Received configuration successfully processed after failure(s) Management group “%1”

EventID=1230
Severity=Error Message=New configuration cannot be loaded, the error is %2(%3) Management group “%1”

EventID=1231
Severity=Informational Message=New configuration successfully loaded after failure(s) Management group “%1”

EventID=1232
Severity=Warning Message=Could not resolve override “%2” for workflow “%3” because the forbidden “$RunAs” token was found in the override value Management group “%1”

Source : Part 5 : SCOM 2012 R2 HealthService Event Reference / ConfigurationManager

Cengiz KUSKAYA

EventID=2000
Severity=Error Message=The Management Group %1 failed to start The error message is %2(%3) A previous message with more detail may have been logged

EventID=2001
Severity=Error Message=No Management Group could be started See previous errors for more specific details If no errors are present, verify the machine has sufficient memory and has at least one Management Group configured Because Active Directory Integration is disabled, the Health Service will not remain running

EventID=2002
Severity=Informational Message=Management Group “%1” was started

EventID=2003
Severity=Informational Message=No management groups were started This may either be because no management groups are currently configured or a configured management group failed to start The Health Service will wait for policy from Active Directory configuring a management group to run

EventID=2010
Severity=Error Message=The Health Service cannot connect to Active Directory to retrieve management group policy The error is %1 (%2)

EventID=2011
Severity=Informational Message=The Health Service did not find any policy in Active Directory

EventID=2012
Severity=Success Message=The Health Service successfully retrieved policy from Active Directory

EventID=2013
Severity=Success Message=The Health Service successfully retrieved policy from Active Directory However, that policy is corrupt and has been discarded

EventID=2015
Severity=Error Message=A workflow in the Health Service has generated a message which exceeds the size limit, and has been discarded%n Management Group Id : %1%n Monitor or Rule Id : %2%n

EventID=2016
Severity=Informational Message=The set of management groups in Active Directory has changed The Health Service will reinitialize to pick up the changes

EventID=2017
Severity=Informational Message=Active Directory integration has been disabled To enable Active Directory integration, set the value ‘SYSTEM\CurrentControlSet\Services\HealthService\Parameters\ConnectorManager\EnableADIntegration’ in the registry to ‘1’

EventID=2018
Severity=Warning Message=The Management Group %1 found in Active Directory has not been approved on this Health Service and will not be started%n To approve this Management Group, create the following key in the registry of this Health service : SYSTEM\CurrentControlSet\Services\HealthService\Parameters\ConnectorManager\Approved AD Management Groups\%1%n %nYou can also remove all entries to implicitly approve all management groups

EventID=2019
Severity=Informational Message=The Management Group %1 has been discovered in Active Directory

EventID=2020
Severity=Informational Message=The Management Group %1 which was originally discovered via Active Directory has been removed from Active Directory and will be removed from this Health Service

EventID=2023
Severity=Warning Message=The health service has removed some items from the send queue for management group “%1” since it exceeded the maximum allowed size of %2 megabytes

EventID=2110
Severity=Success Message=Health Service successfully transferred file %n%nSource File Name : %1 %nManagement Group : %2 %nDestination Health Service Id : %3

EventID=2111
Severity=Error Message=A file transfer from this health service failed %n %nSource File Name : %1 %nManagement Group : %2 %nDestination Health Service Id : %3 %nError Code: %4(%5)

EventID=2112
Severity=Error Message=The Health Service has deleted one or more items for management group “%1” which could not be delivered after %2 attempts

EventID=2113
Severity=Error Message=The Health Service received a malformed data item This item was received on management group %2 from health service %1 Multiple occurrences of this event will be throttled and occur only once every 5 minutes

EventID=2114
Severity=Error Message=The Health Service received a malformed data item The origin of the item could not be determined Multiple occurrences of this event will be throttled and occur only once every 5 minutes

EventID=2115
Severity=Warning Message=A Bind Data Source in Management Group %1 has posted items to the workflow, but has not received a response in %5 seconds This indicates a performance or functional problem with the workflow%n Workflow Id : %2%n Instance : %3%n Instance Id : %4%n

EventID=2119
Severity=Warning Message=Active Directory Integration has been disabled because this Health Service is running on a Domain Controller To suppress this message, set the value ‘SYSTEM\CurrentControlSet\Services\HealthService\Parameters\ConnectorManager\EnableADIntegration’ in the registry to ‘0’

EventID=2120
Severity=Warning Message=The Health Service has deleted one or more items for management group “%1” which could not be sent in %2 minutes

EventID=2121
Severity=Warning Message=A file upload could not be started since the source file path could not be determined in rule “%2” running for instance “%3″ with id:”%4” in management group “%1″%n%n Configured File Path: “%5″%n Upload Channel Id: %6%n Input Data Item XML:%n

EventID=2122
Severity=Warning Message=A file upload could not be started since the source file path could not be determined in rule “%2” running for instance “%3″ with id:”%4” in management group “%1″%n %n Configured File Path: “%5″%n Error Code: %6(%7)%n Upload Channel Id: %8%n Input Data Item XML:%n

EventID=2123
Severity=Warning Message=A file upload could not be started since the source file path was invalid in rule “%2” running for instance “%3″ with id:”%4” in management group “%1” The upload will not be retried since the path was invalid%n %n Resolved File Path: “%5″%n Configured File Path: “%6″%n Upload Channel Id: %7%n Input Data Item XML:%n

EventID=2124
Severity=Warning Message=A file upload could not be started in rule “%2” running for instance “%3″ with id:”%4” in management group “%1″%n %n Resolved File Path: “%5″%n Configured File Path: “%6″%n Error Code: %7(%8)%n Upload Channel Id: %9%n Input Data Item XML:%n

EventID=2125
Severity=Warning Message=A request to download a file (%3) from the Health Service with id %2 in management group “%1” was rejected due to the file being too large The file was %4 megabytes and the maximum allowed size is %5 megabytes Multiple occurrences of this event will be throttled and occur only once every 15 minutes

EventID=2126
Severity=Warning Message=A request to download a file (%3) from the Health Service with id %2 in management group “%1” was temporarily rejected due to the sender being over quota The file was %4 megabytes in size (0 megabytes: the actual file size was less that 1 megabyte) The file download will be retried by the sender Multiple occurrences of this event will be throttled and occur only once every 15 minutes

EventID=2127
Severity=Error Message=Health Service HTTP module in management group “%1” failed to %3 data to/from url (%2) with error (%4)

EventID=2128
Severity=Error Message=Health Service HTTP module in management group “%1” failed to resolve DNS name for url (%2)

EventID=2129
Severity=Error Message=Health Service HTTP module in management group “%1” failed to connect to url (%2) The service can be offline or not deployed to this DNS name

EventID=2130
Severity=Error Message=Health Service HTTP module in management group “%1” timed out connecting to url (%2) EventID=2132 Severity=Error Message=Health Service HTTP module in management group “%1” is not authorized to connect to (%2)

Source : Part 4 : SCOM 2012 R2 HealthService Event Reference / ConnectorManager

Cengiz KUSKAYA