MOM 2005 agent logs an "existing connection was forcibly closed by the remote host" event (885416)

SYMPTOMS

The Microsoft Operations Manager (MOM) 2005 agent logs the following events in the Microsoft Windows NT Application event log. The events typically occur after a new agent is deployed, and the link between the agent and Management Server is slow.Event Type: Error
Event Source: Microsoft Operations Manager
Event Category: None
Event ID: 21293
User: NT AUTHORITY\SYSTEM
Description: The agent was unable to send data to the MOM Server at ManagementServerName. The error code is 10054. An existing connection was forcibly closed by the remote host. Event Type: Information
Event Source: Microsoft Operations Manager
Event Category: None
Event ID: 26021
User: NT AUTHORITY\SYSTEM
Description: The agent has restored communication to ManagementServerName

RESOLUTION

Service pack information

To resolve this problem, obtain the latest service pack for Microsoft Operations Manager 2005. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

905416 How to obtain the latest Microsoft Operations Manager 2005 service pack

Hotfix information

A supported hotfix is now available from Microsoft, but it is only intended to correct the problem that is described in this article. Only apply it to systems that are experiencing this specific problem. This hotfix may receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next MOM 2005 service pack that contains this hotfix.

To resolve this problem immediately, contact Microsoft Product Support Services to obtain the hotfix. For a complete list of Microsoft Product Support Services telephone numbers and information about support costs, visit the following Microsoft Web site:

http://support.microsoft.com/contactus/?ws=support

Note In special cases, charges that are ordinarily incurred for support calls may be canceled if a Microsoft Support Professional determines that a specific update will resolve your problem. The usual support costs will apply to additional support questions and issues that do not qualify for the specific update in question.

Prerequisites

Install this hotfix only on Management Servers.

Restart requirement

This hotfix installation stops and then starts the MOM service (MOMService.exe).

Hotfix replacement information

This hotfix does not replace any other hotfixes.

File information

The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in coordinated universal time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.

   Date         Time   Version            Size    File name
   --------------------------------------------------------------
   28-Sep-2004  15:45  6.0.2800.1106     602,624  Mom2005-rtm-kb885416-x86-enu.exe

After the hotfix is installed, the following files will have the listed attributes or later versions:

   Date         Time   Version            Size    File name
   --------------------------------------------------------------
   27-Sep-2004  21:26  5.0.2749.2      1,629,424  Momengine.dll

To install this hotfix

Create a folder on each MOM 2005 Management Server.
Copy the Mom2005-rtm-kb885416-x86-enu.exe file to the new folder on each server.
Log on locally to the Management Server, and then run the Mom2005-rtm-kb885416-x86-enu.exe file.

The hotfix installer program performs these steps:

Stops the MOM service.
Replaces the MomEngine.dll file on the Management Server.
Starts the MOM service.

MORE INFORMATION

After you install this hotfix, the connection time-out value on the Management Server is increased from one second to fifteen seconds. The new default value resolves the symptoms in most situations. Therefore, no additional action is typically necessary after you install the hotfix. However, the symptoms may still occur on slow WAN connections. If you continue to experience this problem after you apply this hotfix, you can use a new registry value to increase the time-out value. The new registry value is named ServerIOTimeoutMS and is implemented with this hotfix.

You must manually create the ServerIOTimeoutMS value. If this registry value does not exist, the Management Server uses the default value of 15,000 milliseconds (ms), or 15 seconds. To create the ServerIOTimeoutMS registry value and to increase the default time-out value, follow these steps on each Management Server that is experiencing the problem:

Start Registry Editor.
Locate and right-click the following registry subkey:
HKEY_LOCAL_MACHINE\Software\Mission Critical Software\OnePoint\Configurations\configuration group name\Operations\Consolidator
Point to New, and then click DWORD Value.
Type ServerIOTimeoutMS as the value name, and then press ENTER.
Double-click the ServerIOTimeoutMS value, type a value that is larger than 15,000 ms. This value is the time that elapses before the Management Server times out an active agent connection if no response is received. The recommended maximum value for this registry entry is 120,000 ms, or 2 minutes. However, the value can be larger if it is required.
Close Registry Editor.
Stop and then start the MOM service on the Management Server.

For more information about other problems that are resolved by Microsoft Operations Manager 2005 Service Pack 1, click the following article number to view the article in the Microsoft Knowledge Base:

905420 List of bugs that are fixed in Microsoft Operations Manager 2005 service packs

For additional information, click the following article number to view the article in the Microsoft Knowledge Base:

824684 Description of the standard terminology that is used to describe Microsoft software updates