OpsMgr 2007: Backup programs may fail to backup the event log when the 64-bit agent is installed


Here’s an interesting issue sent to me by one of the top Tech Leads on our OpsMgr support team by the name Ritesh Grover.  If you’re getting event log related backup errors then this might be what you’re running into:


Symptoms: VSS aware backup applications may experience a failure of the Event Log Writer.  The exact error will depend on the backup program being used.

Cause:  When the 64-bit System Center Operations Manager 2007 agent is installed on a 64-bit Windows 2003 server it doesn’t properly identify the full path to the Operations Manager event log in the registry. 

For example, when this happens the registry key below will contain a value of Config\MOMLog.evt:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Operations Manager\File

Since the value does not contains the full path to the actual event log file it can cause backup programs (such as Tivoli Storage Manager agent) to fail when backing up the event log.

Resolution: To resolve this issue, manually change the registry value to reflect the correct, full path to the MOMLog.evt file (e.g. C:\windows\system32\Config\MOMLog.evt).


Thanks Ritesh!

J.C. Hornbeck | Manageability Knowledge Engineer

Comments (2)

  1. Daryl Roach says:

    Will Microsoft ever fix this bug.  I see the bug has extended itself into the R2 version.

  2. Ian C. says:

    Funny thing is, we never got hit with this until we upgraded to CU4 two weeks ago.

    Additionally, if the fix was not applied before a reboot, Windows 2003 servers would not start completely. Some applications / services would respond, but others would not. More often than not, you could also not log in to troubleshoot.

    MS KB article available here: support.microsoft.com/…/970219