RequiresEncryption Flag

eilandd

We are using SQL Monitor 2.1.0.238.

One of our monitored instances is a remote, meaning in a different domain, SQL 2005 cluster running on Windows 2008 R2. The user specified for the connection is a windows user in the domain of the cluster and also an administrator for both nodes. While all aspects of the monitoring appear to be working the application logs on the cluster is being filled with 5605 warnings as shown below. We also have stand alone instances in remote domains on 2008 R2 that do not generate any events. This only happens on the Root\MSCluster namespace.

Any help would be appreciated



Log Name: Application
Source: Microsoft-Windows-WMI
Date: 1/21/2011 8:13:20 AM
Event ID: 5605
Task Category: None
Level: Warning
Keywords: Classic
User: N/A
Computer:
Description:
The Root\MSCluster namespace is marked with the RequiresEncryption flag. Access to this namespace might be denied if the script or application does not have the appropriate authentication level. Change the authentication level to Pkt_Privacy and run the script or application again.

Chris Spencer

Hi

Sorry for the late reply. I've looked into this and cannot see any reason our WMI calls should be failing in this way.

We do set the authentication level to Pkt_Privacy as suggested by this MS help page
http://technet.microsoft.com/en-us/libr ... 27103.aspx

I've raised a bug (reference: SRP-3222) to investigate this issue in more depth. Hopefully it's an issue that we'll be able to fix for a future release.

Regards
Chris

DoubleA

I have this exact same problem. It happens every 30 seconds and when I suspend monitoring, the error does not happen. As soon as I turn monitoring back on, the error starts happening again. Mine is in the same domain though. It is a two node SQL 2008 R2 x64 bit instance.

I also get this in the SQLMonitor log:

21 Feb 2011 9:54 AM WMI OpenNamespace: root\cimv2 Incorrect credentials or insufficient permissions ManagementException Access denied

Chris Spencer

Hi

Thanks for this information.

2008 R2 seems to be a recurring theme here. One question, is your SQL 2008 R2 instance running on a Windows 2008 R2 machine?

I've added your comments to SRP-3222. Hopefully it'll add further weight to this issue being investigated prior to the next release.

Thanks
Chris

James B

I've seen this previously and it may actually be a windows bug.

Try connecting to the cluster namespace using WBEMTest, ensuring you set the packet privacy option - you'll theoretically still get the same event being logged.
At least, that's the behaviour I've seen on 2 or 3 occasions previously.

DoubleA

Yes, it is windows enterprise 2008 R2 x64

Chris Spencer

There's very little information online about this issue. Is this a virtualized server by any chance? There may be an issue with WMI and Hyper V.

I recommend following James' suggestion and try connecting with WBEMTEST. We have more information about testing WMI issues on our data collection issues support page:
http://www.red-gate.com/supportcenter/C ... 402836.htm

Regards
Chris

eilandd

In my case all servers are physical. Monitoring is being done from a Windows 2003 Enterprise sp2 server and the monitored cluster is Windows 2008 R2.

I did connect with Wbemtest and received the same results.
The warning message was received on the connect with or without pkt-privacy being selected, but only for the \Root\MSCluster namespace.

James B

That's pretty much what I've seen, as mentioned before.

As this occurs even when using MS supplied test tools and outside of SQL Monitor, it's basically a bug in Windows, although I'm not sure that MS have acknowledged it. I've not been able to find very much online about it...

teschoen

I'm getting this error as well. Windwos 2008 R2 x64 enterprise. it occurs every minute and is quite a bother.

The error occurs on the passive node of a MSCS cluster.....

DoubleA

I also get this error. I'm running a 2 node active/passive SQL Cluster. Windows 2008 R2 x64 enterprise, SQL Server 2008 R2 enterprise. This error occurs once to twice a minute and is annoying, but the software seems to function ok. This ALWAYS occurs on NODE2, and NEVER happens on NODE1, regardless of what node is active.

dlkj

We've done quite a bit of research into this problem and unfortuntally the root cause is a bug in the WMI Provider in Windows when running as a failover cluster.

For some reason, remote WMI access is being refused even though we are using the correct encryption settings. We've also checked that the issue occurs when using WBEMTEST.

The following is deeply unsupported by Microsoft, but gets around the issue:

• Open a UACed command prompt
• Change the directory to %windir%\System32\Wbem
• Run “notepad”
• Open ClusWMI.mof
• Change [RequiresEncryption] to [RequiresEncryption(FALSE)]
• Run “Mofcomp.exe ClusWMI.mof”
• Retry the WMI Query using Wbemtest to see if this fixes the error logging issue.

I strongly suggest you take this issue up with Microsoft.

--
Daniel Kenyon-Jones
Software Engineer - DBA Tools
Red Gate Software Ltd

tsquillario

Anyone have success in trying the fix above?

I just got SQL Monitor running and this error started for me also. 2 Node Physical 2008R2, SQL 2008 SP3 Cluster.

traian

I had the same issue, found this posts when I googled the WMI error. Followed the steps and it was fixed, but please note that I couldn't overwrite the .mof file, event tho' I ran as an admin the notepad and tried to save the original file....anyways, I saved it as .mof.txt and then ran: Mofcomp.exe ClusWMI.mof.txt

tsquillario wrote:

Anyone have success in trying the fix above?

I just got SQL Monitor running and this error started for me also. 2 Node Physical 2008R2, SQL 2008 SP3 Cluster.