Welcome to Aquilaweb

MVP David Allen's weblog advising on
System Center Operations Manager

WARNING - SQL Instance SA Password Check

By default, this rule is disabled in the SQL 2000 Discovery management pack; but beware if you are looking at enabling it. During recent testing, I enabled this rule and then shortly after found a number of my SQL servers crippled. Upon further investigation, I found all the servers affected had multiple numbers of the cmd.exe process running. As the only changes that had been made were my changes enabling rules in OpsMan, the easiest thing to do was to disable those rules again and see if that resolved the issue.

I was surprised to find that disabling the rules did work, and specifically found that it was the SQL Instance SA Password Check rule which was causing all the cmd.exe processes to spawn. To discover exactly what was going on, I opened up the MP XML and found this....

Dim objShell,cmd
Set objShell = CreateObject("WScript.Shell")
objShell.Run "%comspec% /k osql -S " & connectString & " -U sa -P >" & filename & "& exit()", 0, True

The thing to note here is the "/k", as this switch carries out a command by string but remains open. Unfortunately, this means that every time the rule runs, a new cmd.exe process starts running the osql command but never closes; so after a number of hours you have 10's of cmd.exe processes running which start to consume significant system resources.

I have had this reported to Microsoft as a bug and they will be resolving the issue. However, in the meantime, I would urge against using this rule without full testing to confirm you are happy with its operation.

11 Apr, 2008 | David

Comments

Hi David,

It's in the SQLServer.2000.Monitoring MP and not the Discovery MP.

Regards,
Stefan Stranger

Stefan Stranger - 07 Jan, 2009 - 15:36:59
--------------------------

Leave comment