Troubleshooting: Microsoft Monitoring Agent Freezes on Startup in Operations Manager

Table of Contents

This article addresses a specific issue encountered in Microsoft System Center Operations Manager (SCOM) where the Microsoft Monitoring Agent service fails to start correctly. Users report that the service remains stuck in the Starting state within the Windows Service Control Manager. This problem prevents the agent from functioning, impacting monitoring capabilities and overall system health reporting for the affected server. Understanding the root cause and implementing the correct sequence of troubleshooting steps is crucial for resolving this persistent startup failure.

Symptoms¶

In environments utilizing System Center 2012 Operations Manager or System Center 2012 R2 Operations Manager, administrators may observe that the Microsoft Monitoring Agent service does not successfully transition to the Running state. Instead, it consistently stays in the Starting status indefinitely. This behavior is typically visible when attempting to manage services via the standard Services console (services.msc). Attempts to stop the service through the graphical interface or command-line tools like sc stop or net stop prove unsuccessful.

Further investigation often reveals that the underlying process, Healthservice.exe, might appear in Task Manager, consuming some system resources but failing to initialize fully. If an administrator manually terminates the Healthservice.exe process using Task Manager and then attempts to restart the service, the same issue recurs, with the service again getting stuck in the Starting state. This persistent failure indicates a block during the initial phases of the service’s startup routine, preventing it from reaching operational readiness and impacting its ability to communicate or perform monitoring tasks.

Note: Prior to Operations Manager 2012 R2, the Microsoft Monitoring Agent service was commonly referred to as the System Center Management service. While the name has changed, the core function and potential startup issues like this one can be similar across versions, though troubleshooting steps might have minor variations depending on the exact SCOM version and operating system.

Cause¶

The primary cause for the Microsoft Monitoring Agent service freezing during startup is often related to its dependency on writing critical information to event logs as part of its initialization process. During its startup sequence, the agent attempts to access and write data to the Operations Manager event log channel, and potentially other system logs, to record its status and any encountered issues. This operation relies heavily on the proper functioning of the Windows Event Log service.

If the Windows Event Log service is not running, is unable to start itself due to internal errors, or is facing issues such as event log file corruption, the Microsoft Monitoring Agent service’s attempt to log information will fail or become blocked. This dependency failure prevents the agent from completing its startup routine successfully. Consequently, the agent service remains suspended in the Starting state, waiting indefinitely for the logging operation to succeed or time out, which it often does not, leading to the freeze. Event log corruption is a common reason why the Windows Event Log service itself might be unstable or unable to process writes requests efficiently.

Resolution¶

Resolving the issue of the Microsoft Monitoring Agent service being stuck in the Starting state primarily involves ensuring that its core dependencies, particularly the Windows Event Log service, are functioning correctly and addressing any underlying issues like event log corruption. Follow these detailed steps to diagnose and fix the problem:

Step 1: Verify the Status of the Windows Event Log Service¶

The first step is to check the operational status of the service that the Microsoft Monitoring Agent depends on for logging.

1. Open the Services management console. You can do this by pressing Windows Key + R, typing services.msc, and pressing Enter.
2. Locate the service named Windows Event Log.
3. Check its current status in the “Status” column. It should ideally show as Running.
4. If the status is anything other than Running (e.g., Stopped, Paused, or blank), attempt to start it by right-clicking the service and selecting Start.
5. Observe if the service starts successfully or if it throws an error message. Note down any specific error codes or descriptions provided if it fails to start.

If the Windows Event Log service starts without issue after being manually initiated, try starting the Microsoft Monitoring Agent service again. If the Event Log service was the sole problem, the agent might now start correctly. However, if the Windows Event Log service itself fails to start or if starting it doesn’t resolve the agent issue, proceed to the next step, as event log corruption is likely the culprit.

Step 2: Check System and Application Event Logs for Errors¶

Even if the Windows Event Log service appears to be running, it might be experiencing underlying issues, including corruption, that prevent other services like the Microsoft Monitoring Agent from writing to logs. Examining the Event Viewer can provide clues.

1. Open Event Viewer. You can do this by pressing Windows Key + R, typing eventvwr.msc, and pressing Enter.
2. Navigate to Windows Logs > System and Windows Logs > Application.
3. Filter or look for recent Error or Warning events around the time you attempted to start the Microsoft Monitoring Agent service.
4. Specifically look for events related to Service Control Manager, EventLog, or HealthService. These events might indicate why services are failing to start or why logging operations are failing.
5. Also, check the Applications and Services Logs > Operations Manager log if it is accessible. Look for any entries from HealthService that might shed light on the startup failure, although access to this log might be limited if the agent is completely frozen.

Error messages indicating issues with file access, corrupted structures, or service timeouts related to logging strongly suggest event log corruption or underlying file system problems affecting the log files.

Step 3: Address Potential Event Log Corruption¶

If the Event Viewer or the inability of the Windows Event Log service to start points towards corruption, the most effective resolution is often to clear the existing event log files. It is recommended to back up the logs before clearing them if retaining historical data is necessary, though corrupted logs may not be fully recoverable.

1. Stop both the Microsoft Monitoring Agent service and the Windows Event Log service. This might require using Task Manager to end the Healthservice.exe process for the agent if it’s stuck, and you might need to attempt stopping the Event Log service even if it’s failing. Setting the startup type of these services to Disabled temporarily can help prevent them from starting unexpectedly during the process.
2. Open File Explorer and navigate to the directory where event logs are stored. The default location is %SystemRoot%\System32\winevt\Logs. You can type this path directly into the File Explorer address bar.
3. In this directory, you will find files with a .evtx extension (e.g., System.evtx, Application.evtx, Operations Manager.evtx).
4. Backup: Before proceeding, it is advisable to copy the entire Logs folder or at least the potentially corrupted .evtx files to a safe location as a backup.
5. Clear/Rename: Select the .evtx files located in the Logs directory. You can either delete these files or, preferably, rename them (e.g., append .old to their names) so that Windows will create new, fresh log files upon the next service start. Renaming is safer as it allows you to potentially recover data later if needed. You might need administrator privileges to perform these actions.
6. If you encounter errors deleting or renaming files, it could indicate that the files are still in use. Ensure the Windows Event Log service is stopped. If necessary, restart the server in Safe Mode or boot from recovery media to access and manipulate the files. However, try renaming while in normal mode first after stopping services.

Once the .evtx files are renamed or deleted from the original Logs directory, Windows will automatically recreate them the next time the Windows Event Log service starts.

Step 4: Restart Services¶

After addressing the potential corruption by clearing or renaming the log files, it’s time to restart the necessary services in the correct order.

1. Open the Services management console (services.msc) again.
2. Locate the Windows Event Log service. If you disabled it in Step 3, set its startup type back to Automatic.
3. Start the Windows Event Log service. It should now start cleanly as it creates new log files. Verify its status is Running. If it fails, there might be a deeper issue with the operating system or file system that needs investigation (e.g., run sfc /scannow in an elevated Command Prompt).
4. Locate the Microsoft Monitoring Agent service (or System Center Management service). If you disabled it, set its startup type back to Automatic.
5. Start the Microsoft Monitoring Agent service.

Monitor the status of the Microsoft Monitoring Agent service. With the underlying logging dependency resolved, the service should now transition successfully from Starting to Running. Check the newly created Operations Manager event log in Event Viewer for successful startup messages from HealthService.

Step 5: Verify Agent Functionality¶

Once the service is running, verify that the agent is functioning correctly.

1. Check the status of the agent in the Operations Manager console (under Administration > Agent Managed). The agent should report a healthy status.
2. Verify that data is being collected from the agent (e.g., check performance counters, events, or state changes from the monitored server).
3. Check the Operations Manager event log on the agent server for ongoing activity and lack of critical errors.

If the agent service starts but goes into a “grey” or “not monitored” state in the SCOM console, there might be other connectivity or configuration issues, but the primary startup freeze caused by event log corruption should be resolved.

Additional Considerations¶

• Permissions: Ensure the NETWORK SERVICE account (or the account configured for the HealthService) has the necessary permissions to write to the %SystemRoot%\System32\winevt\Logs directory. Incorrect permissions can also prevent logging.
• Disk Space: Low disk space on the system drive can prevent logs from being written or expanded, potentially causing similar issues. Ensure there is adequate free space.
• Antivirus: Occasionally, overzealous antivirus software might interfere with service startup or file access. Temporarily disabling antivirus (in a controlled test environment) can help rule this out, but this should be done cautiously.
• Other Dependencies: While the Event Log service is the most common culprit for this specific “Starting” freeze, the Microsoft Monitoring Agent has other dependencies (e.g., Windows Installer, RPC, WMI). Ensure these services are also running correctly.
• SCOM Hotfixes/Updates: Ensure the SCOM agent and the SCOM environment are updated with the latest relevant hotfixes, as known issues related to agent stability or logging might have been addressed.

Addressing event log corruption by clearing or renaming the log files, followed by restarting the Windows Event Log and Microsoft Monitoring Agent services in sequence, is the most frequent resolution for this specific startup problem. This process effectively provides the agent with a clean logging environment necessary for successful initialization.

If you have followed these steps and the Microsoft Monitoring Agent service still fails to start, it might indicate a more complex issue, potentially involving the SCOM agent installation itself, deeper operating system problems, or conflicts with other software. In such cases, further diagnostic steps, including potentially reinstalling the agent or engaging Microsoft Support, might be necessary.

Were these steps helpful in resolving the Microsoft Monitoring Agent startup issue in your Operations Manager environment? Do you have any specific error messages or scenarios you’d like to discuss further? Please share your experiences or questions in the comments below!