Failed Accessing Windows Event Log Microsoft-Windows-Dhcp-Server

  • Article

Failed Accessing Windows Event Log Microsoft-Windows-Dhcp-Server is affecting the Agent Health State (Warning) for non-DHCP 2008 R2 computers

Alert Description:

The Windows Event Log Provider is still unable to open the Microsoft-Windows-Dhcp-Server/Operational event log on computer 'ServerName.Domain'.
The Provider has been unable to open the Microsoft-Windows-Dhcp-Server/Operational event log for 5760 seconds.

Most recent error details: The system cannot find the file specified.

 

One or more workflows were affected by this.

Workflow name: Microsoft.Windows.2008R2.DHCP.Server.Monitor.ActivityLogging

Instance name: ServerName.Domain

Instance ID: {1C306FEA-3578-5DBE-DDCA-705B9393F80E}

Management group: ManagemenGroupName

 

Cause:

This is a incorrct discovey, the affected servers are not Windows Server 2008 R2 computers, mostly (in the cases I faced) Windows Server 2003 Computers,

 

Resolution:

Disable the Windows Server 2008 R2 DHCP Descovery for a group (Windows Server 2003 Computer Group)

  1. Open the Operations Console | Monitoring 
  2. Management Pack Objects
  3. Object Discoveries
  4. Find "Microsoft.Windows.2008R2.DHCP.Server.Discovery"
  5. Right click the discovery Override for a group "Windows Server 2003 Computer Group" - Enabled false
  6. From Operations Manager shell >> Remove-DisabledMonitoringObject

Couple of minutes and the warnings will disappear, you might need to restart the HealthService on the affected agents..