event filter with query "select * from HP_AlertIndication

[WW74407]

Hello All,
We have been using the new HP SmartStart 8 CD.
Many of our machine are experiencing the same problem.

In the application event log there is this error:

Event filter with query "select * from HP_AlertIndication" could not be (re)activated in namespace "//./root/CIMV2" because of error 0x80041010. Events may not be delivered through this filter until the problem is corrected.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Tried to search any solutions but I can't find any.

Any help appreciated.

[Rune J. Winje]

Hi,
you could check out http://www.microsoft.com/technet/scriptcenter/topics/help/wmi.mspx#EHAAC

and

http://bizsupport.austin.hp.com/bc/docs/support/SupportManual/c01382288/c01382288.pdf

"At the Server Deployment â Management Instrumentation screen, select HP Insight Management WBEM Providers for Windows (WMI-based providers)."


Cheers,
Rune

[MeierDavid]

Hello,

I have the same problem?
Did you found a solution?

Thanks and regards

[WW74407]

No I have not found any solution.

What I think you need to do is to install the WMI service on Windows 2003.

Did not try that one yet

[WW39626]

I have only had a chance to try this on one server thus far and it has since resolved the Event from occurring.

Per HP...

"After applying PSP 8, the following error may occur in the Windows Application Event log after a reboot and/or after restarting the WMI service".

"This issue is a result of the sim server subscribing to an incorrect name space. The issue is resolved in SIM 5.3."

SIM 5.3 is not available yet just for the record ;)

Solution:

1. On the managed node, open the wbemtest tool: C:\WINDOWS\system32\wbem\wbemtest.exe
2. Run : wbemtest
3. Connect to desired name space â in this example root/cimv2
4. Select "Enum Instances"
5. Type: __EventFilter
6. Click OK
7. Select the instance then select "delete"

[WW39626]

I have gone through 20 plus servers this morning and the issue has not reoccurred after making the change.

Just an FYI is all.

[preid0gr]

Hello,

We too are seeing the Error in the event viewer listed in this thread.

I followed the instructions listed regarding wbemtest, but was not successful.
Step 7 states to select the instance then "delete". When I get to that that step, there is nothing to delete.

We are running PSP 7.91. The 8 versions have caused too many issues to move to them at this point.

Any suggestions would be great as I am starting to see this on more servers.

Thank you.

[WW39626]

Seeing that i already "wacked" all my entries the only thing i can suggest at this time is...

1. Verify that the namespace is "root/cimv2"
2. Verify Enum Instances is "__EventFilter" (contains 2 underscores)

Not sure if any of those makes a difference or not.

3. Wait for HP Sim 5.3 which should be out sometime soon.

Sorry, i dont have anything more at this time to offer.

[Franck_21]

Hello

We are having the same issue on 2 servers. I have followed the instruction but on step 7 I have several instances (see attached screenshot), including one whose name is:
HPSIM_srv-mgmt_0 Is it the one to be deleted?

Thank you

[Marco Gubitzer]

Hi, having the same issue - but only since the update from SIM 5.2 to 5.3! Deleting the entry with wbemtest doesn't help, it reappeares after a reboot of the server. Any help would be appreciated!

[swsadmin]

Hello WW39626,

got the same Errors on all Servers Updated to PSP 8.20.
Also have an Updated SIM 5.3 Server.

HP Support does not help me, but You!

Thank you, is works for me.

Armin

[Fabian Flasche]

Hello,

i can't delete __EventFilter.

Has everyone any idea?

[Armin Kerl]

This Help's me too.

Connect to: root\cimv2
Class: __EventFilter
Name=HPWEBES....

Delete it and it is Quiet now.

Thank You.

[claudio7c0]

I had WinMmgmt Error 10 and 24 in my Eventlog.

For example (and many more):
5/12/2010,04:04:30,1,0,24,WinMgmt,N/A,SSGTSE1.sg.bauengineering.local,ProviderSubSystem select * from Msft_WmiProvider_OperationEvent Msft_WmiProvider_OperationEvent //./root/CIMV2
5/12/2010,04:04:30,1,0,24,WinMgmt,N/A,SSGTSE1.sg.bauengineering.local,RouteEventProvider select * from Win32_IP4RouteTableEvent Win32_IP4RouteTableEvent //./root/CIMV2
5/12/2010,04:04:30,1,0,24,WinMgmt,N/A,SSGTSE1.sg.bauengineering.local,RegistryEventProvider select * from RegistryEvent RegistryEvent //./root/CIMV2
5/12/2010,04:04:30,1,0,10,WinMgmt,N/A,SSGTSE1.sg.bauengineering.local,//./root/CIMV2 select * from __instancemodificationevent within 30 where targetinstance isa 'Win32_PerfFormattedData_PerfDisk_LogicalDisk' and targetinstance.PercentFreeSpace < 1 and targetinstance.Name != '_Total' 0x80041010

In Safe Mode (Abgesicherter Modus):
Open Start - Run... - CMD and type the following commands:
Winmgmt /verifyrepository
Winmgmt /resetrepository
Winmgmt /resyncperf

Solution from Microsoft Support: If the errors persist, execute the following commands in CMD:
1. Backing up the WMI Repository
cd %windir%\system32\wbem
//Create folder on â C:\â called "wmibackup"
winmgmt /backup C:\wmibackup\backup01
// Check if backup is created under â C:\wmibackupâ with name â backup1â
// If it hasnâ t been created DO NOT perform next steps

2. Rebuilding the Repository
sc config winmgmt start= disabled
net stop winmgmt
del repository
sc config winmgmt start= auto
net start winmgmt
//reboot server (optional but recommended)
//If problem persists do next steps.

2. 1. Reseting the Repository to the initial state and register the system performance libraries with SMI
cd %windir%\system32\wbem
sc config winmgmt start= disabled
net stop winmgmt
del repository
sc config winmgmt start= auto
net start winmgmt
winmgmt /resetrepository
winmgmt /resyncperf
//server reboot (optional but recommended)

Regards. Claudio.