Archive for the Uncategorized Category

Event ID 10303 in Operations Manager Event Log

Posted in Uncategorized on 2014/09/22 by CRCerr0r


Every once in a while you get an Error event in the Operations Manager event log, with event ID 10303. Here is an example:

Log Name: Operations Manager
Source: Health Service Modules
Date: 9/18/2014 9:16:51 AM
Event ID: 10303
Task Category: None
Level: Error
Keywords: Classic
User: N/A
The Microsoft Operations Manager Expression Filter Module failed to process a data item and dropped it.

Error: 0x80004005

One or more workflows were affected by this.

Workflow name: UIGeneratedMonitor73d5bd10284341c0936c93f5f43409cf
Instance name: YourApplicationName
Instance ID: {F4ED789B-F363-A9F6-F4F5-09CC14FB9CDC}
Management group: YourManagementGroup

Resulting Behavior/Symptoms:

What ends up happening is you do not get alerts triggered based on monitors watching an Event Log for specific events, after the above event is logged. All other monitors work, just the specific one mentioned in Workflow name (you can figure out which one it actually is, if you export your MPs and search for that string, although I am sure there probably is a PowerShell command or SQL query you can run to get that as well, like one of these, I just have not needed to)


There is a bug in the filtering module’s parser that chokes on certain events. That happens on SCOM 2007 and 2012 (pre-R2, have not tested on R2, but that may have it as well). When the parser chokes, it unloads the monitor and you effectively get a silent death of a monitor. This happens when you have the following in place:

You are monitoring event log for events, with a filter such as “Event Level Equals Error AND Event Source Equals MyService AND Parameter 1 Matches Wildcard *some string here*”. The key word here is Matches Wildcard. Apparently that is where the parser chokes.


You can do one of two things (not both, although it probably won’t cause an issue if you did):

1. Modify your monitor to read (as in the above example) “Event Level Equals Error AND Event Source Equals MyService AND Parameter 1 Contains ‘some string here'”

2. Edit the registry on the agent computer:

Create the following key: HKLM\Software\Microsoft\Microsoft Operations Manager\v3\Modules\Global\ExpressionFilter

Then create a DWORD value under this key: MaxExpressionDepth

This value can be between 500 and 100000, the default is/should be 2000.


Hope this helps someone… 🙂


SharePoint 2010 Tools

Posted in Uncategorized with tags , on 2010/11/07 by CRCerr0r

A short list of companies and tools they offer to complement SharePoint 2010 migration, administration, security, auditing and more.

Idera – Idera SharePoint Security Manager, formerly a product of iDevFactory; Sonar Performance Management, formerly a product of Binary Wave

Axceler – Davinci Migrator; ControlPoint

Quest Software – Server Administrator for SharePoint

MetaLogix Software Corp – MetaLogix Migration Manager for Blogs and Wikis; SharrPoint Site Migration Manager

AvePoint – DocAve

Tzunami Inc – Tzunami Deployer for content migration

The full article is available in August’s edition of Redmond Magazine and


Posted in Uncategorized on 2009/10/08 by CRCerr0r

I am an IT professional and, as most others in the same field, I run into all sorts of odd issues that take hours to figure out. Eventually either I or someone else out there will run into the same problem – it is inevitable. So I setup this blog so that I can have one place where I can log and share my experience and solutions. Hopefully the information would help someone. And if it doesn’t, at least I have it for my own sanity. 😉


P.S. Keep in mind the standard disclaimer – the information posted here is my own opinion and experience. I make no guarantees it is 100% accurate, so make sure you know what you are doing before you follow anything I write. And make backups BEFORE you start messing with things. 🙂