Here's a great tip on troubleshooting agent installation problems where you're getting Event ID 10005's. This is a cool one because the basic process can be used any time you're troubleshooting an issue that references a file already being in use by another process:
========
Issue: When trying to install the Operations Manager 2007 agent you may receive the following error:
Event Type: Error Event Source: MsiInstaller Event Category: None Event ID: 10005 Description: Product: System Center Operations Manager 2007 Agent -- Error 25211.Failed to install performance counters.. Error Code: -2147024864 (The process cannot access the file because it is being used by another process.).
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data: 0000: 7b 45 37 36 30 30 41 39 {E7600A9 0008: 43 2d 36 37 38 32 2d 34 C-6782-4 0010: 32 32 31 2d 39 38 34 45 221-984E 0018: 2d 41 42 38 39 43 37 38 -AB89C78 0020: 30 44 43 32 44 7d 0DC2D}
Resolution: The question here is What other process is using our file? The first step is to run Process Monitor during the installation attempt and take a look at the resulting .PML file:
Open .PML file in Process Monitor and filter on Results contain SHARING VIOLATION. You may notice something like this:
AM MsiExec.exe 7192 CreateFile C:\WINNT\system32\perfc009.dat SHARING VIOLATION Desired Access: Generic Write, Disposition: Supersede, Options: Synchronous IO Non-Alert, Attributes: N, ShareMode: Read, AllocationSize: 0
So now we know there's a sharing violation for perfc009.dat. The next step is to run Handle.exe from Sysinternals and pipe the output to a text file:
handle.exe > handle.txt
Search Handle.txt for SHARING VIOLATION and you'll probably find something similar to this:
118: File (RW-) C:\Program Files\CiscoSecure ACS v4.0\CSMon 124: File (R--) C:\Program Files\CiscoSecure ACS v4.0\CSMon\Logs\CSMon.log 140: File (RW-) C:\Program Files\CiscoSecure ACS v4.0\CSMon 244: File (RW-) C:\Program Files\CiscoSecure ACS v4.0\Logs 250: File (R--) C:\Program Files\CiscoSecure ACS v4.0\Logs\ServiceMonitoring\CSMonLog.csv 2B0: File (RW-) C:\WINNT\system32\perfc009.dat 2B8: File (RW-) C:\WINNT\system32\perfh009.dat 2CC: File (RW-) C:\WINNT\system32\Perflib_Perfdata_a18.dat 2D0: Section \BaseNamedObjects\Perflib_Perfdata_a18
Note that in my case the process is part of CiscoSecure but honestly it can be anything. This is just what it happened to be in my case.
Once you discover the process holding the file open, simply stop that service, retry your install, then once it completes successfully restart the service that you stopped.
Special thanks to Frank Novak, a Senior Support Engineer in our Washington state office for writing this up for us. Thanks Frank!
J.C. Hornbeck | Manageability Knowledge Engineer