Still there are a lot of MOM 2005 sites all waiting to be transferred to Opsmgr. But sometimes  the old site needs be be running for some old really apps and sometimes you break some thing on the agent. the last hotfix for the MOM 2005 agent was Article ID: 942736 - Last Review: November 13, 2007 - Revision: 1.2 but I had some problem with some agents and it turned out there was a fix

Article ID: 930770 - Last Review: August 9, 2007 - Revision: 2.3

http://support.microsoft.com/kb/930770/

Event ID 9014 and Event ID 9015 are logged, and MOMservice.exe stops unexpectedly after you configure a Collect Specific Events (Collection) rule in Microsoft Operations Manager 2005.

This problem may occur if the Collect Specific Events (Collection) rule is configured to collect security event parameters. In this scenario, the Collect Specific Events (Collection) rule may occasionally collect more parameters than requested. This behavior may cause the MOM service to stop.

this brings the agent to build 5.0.2911.50

But now there is build 5.0.2911.52.

http://support.microsoft.com/kb/949874

In Microsoft Operations Manager (MOM) 2005, the MOM service (Momservice.exe) may crash when you run the discovery process on many agent computers. Therefore, the functionality that this service provides is lost.
When this problem occurs, the following event is logged in the System log:

Source: Service Control Manager
Date: Date
Event ID: 7031
Level: Error
User: N/A
Computer: Computer Name
Description: The MOM service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000

Additionally, the following events are logged in the Application log:

Event Type: Error
Event Source: Microsoft Operations Manager
Event Category: None
Event ID: 9014
Date: Date
Time: Time
User: N/A
Computer: Computer Name
Description: The Microsoft Operations Manager service (MOMService.exe) terminated due to an unhandled exception. It will attempt to restart itself.

Event Type: Error
Event Source: Microsoft Operations Manager
Event Category: None
Event ID: 9015
Date: Date
Time: Time
User: N/A
Computer: Computer Name
Description: The Microsoft Operations Manager service (MOMService.exe) received an unexpected exception.
Thread Id: ID
Thread Name: Name
Exception code: 0x00000000c0000005
Exception description: Access Violation
Exception address: address
Exception flags: 0x0

http://support.microsoft.com/kb/949874

Sometimes in mom 2005 you want to know the value thats in a log file.
In this Sample I do a step by step how to read / email the defrag Log file to a MOM 2005 alert / event.

Create a batch file. called SCCdefrag.cmd

This is a sample batch file for defrag your server. For emailing this log file I used BLAT.  below is a default script i got from the WEB
SCCdefrag.cmd:


set mailsrv=mail server
set remail=defrag@domain.com
set semail= defrag@domain.com defrag
set log=defrag.log
set progdir=c:\defrag
:Start
c:
cd %progdir%
:DEFRAG
DATE /T >> %progdir%\%log%
TIME /T >> %progdir%\%log%
:d1
SET volume=D:
EventCreate /T INFORMATION /SO Defrag /L application /ID 1 /D "SCCDefrag started on volume %volume%"
%SystemRoot%\system32\defrag.exe %volume% /v >> %progdir%\%log%
EventCreate /T INFORMATION /SO Defrag /L application /ID 2 /D "SCCDefrag ended on volume %volume%"
DATE /T >> %progdir%\%log%
TIME /T >> %progdir%\%log%
goto MAIL
:MAIL
%progdir%\blat.exe mail.txt -to "%remail%" -s "SCCDefrag Report %ComputerName%" -mime -server %mailsrv% -f "%semail%" -attach "%log%"
GOTO END
:END
EXIT

Go to your MOM administrator Console and add a new provider.

Choose Application log file

Filin the logfile directory and the logfile name

Now Create A management pack that kicks the Rule. Create a new rule and choose the just created Provider. in our case the defragmentatie

Remember use parameter 4 and the text must be 100% the same as in your log file, and the rule reads only the first log line. Text is case sensitive.

How To repair Your MRAS. MOM Availability Management Pack, sometimes the scheduled task wil never stop running. So you need to fix this. But what can you do so many tables so little time. first we check the version. but In my case I removed the Availability Reporting just to make sure.

First step :Check your version

Use SystemCenterReporting

SELECT * FROM MRAS_MRASInstallVersion

The procversion should be 1.8 this indicates that you are using the latest available MP version

Which versions of the Availability MP are affected

Remember always use the latest version this is MP 05.0.5000.0001

Second Step :check if you have Orphaned Servers

Use SystemCenterReporting

Select uidServer as ComputerID,nvcServerName as OrphanedServer from mras_server A where A.uidServer not in (Select ComputerID from sc_computerdimension_table)

Output :If the above query does return rows it is most likely the Orphaned server column contains the server names of those servers missing from reports or containing stale data.

Third step :The Fix For this run the SQL query.

Use SystemCenterReporting

Select uidServer into #Orphans From MRAS_Server a Where a.uidServer Not In (Select ComputerID From SC_ComputerDimension_View)

Declare @uidToRemove uniqueidentifier

Declare uidCur cursor forward_only for

Select uidServer From #Orphans

Open uidCur

fetch next from uidCur into @uidToRemove

while @@FETCH_STATUS = 0

Begin

exec MRAS_pcDeleteServer @uidToRemove

Delete From MRAS_Server Where uidServer=@uidToRemove

Fetch next from uidCur into @uidToRemove

End

Drop table #Orphans

Re running de query

Next step is use the report cleaner from clive. you can download it here

Reinstall the Reporting not the MMC UI

Now this is done I checked the Scheduled task yeb it is there.

And started the MMC for my reports.

So I kicked the task else I have to wait. and it is running Remember the first run can take some time.

Yeb and done with a 0x0

Just wait a few day's to see the Reports.

If you want to make a fresh new management pack than tools are handy

tools to use the Eventcreator. get this from the MOM 2005 Resource kit.

But there are other commands that are often forgotten to use like the SC command.

in a command line you can create a windows service.  this service can be use full to test your fresh MP.

the new services don't have to be something from the original services but a fake services to create your MP

So how does it work, there are several Items on the net about it but here is a brief description.

Sc.exe uses the following syntax:
Syntax1 (use Syntax1 to run Sc.exe)

sc [Servername] Command Servicename [Optionname= Optionvalue...]

Syntax2 (use Syntax2 to display help information, except for the query command)

sc [Command]

DESCRIPTION:
        SC is a command line program used for communicating with the
        NT Service Controller and services.
USAGE:
        sc <server> [command] [service name] <option1> <option2>...

        The option <server> has the form "\\ServerName"
        Further help on commands can be obtained by typing: "sc [command]"
        Commands:
          query-----------Queries the status for a service, or
                          enumerates the status for types of services.
          queryex---------Queries the extended status for a service, or
                          enumerates the status for types of services.
          start-----------Starts a service.
          pause-----------Sends a PAUSE control request to a service.
          interrogate-----Sends an INTERROGATE control request to a service.
          continue--------Sends a CONTINUE control request to a service.
          stop------------Sends a STOP request to a service.
          config----------Changes the configuration of a service (persistant).
          description-----Changes the description of a service.
          failure---------Changes the actions taken by a service upon failure.
          qc--------------Queries the configuration information for a service.
          qdescription----Queries the description for a service.
          qfailure--------Queries the actions taken by a service upon failure.
          delete----------Deletes a service (from the registry).
          create----------Creates a service. (adds it to the registry).
          control---------Sends a control to a service.
          sdshow----------Displays a service's security descriptor.
          sdset-----------Sets a service's security descriptor.
          GetDisplayName--Gets the DisplayName for a service.
          GetKeyName------Gets the ServiceKeyName for a service.
          EnumDepend------Enumerates Service Dependencies.

        The following commands don't require a service name:
        sc <server> <command> <option>
          boot------------(ok | bad) Indicates whether the last boot should
                          be saved as the last-known-good boot configuration
          Lock------------Locks the Service Database
          QueryLock-------Queries the LockStatus for the SCManager Database
EXAMPLE:
        sc start MyService

So in real it looks like this.

sc create "Service Name" displayName= "Service Display Name" binPath= "C:\WINDOWS\system32\clipsrv.exe" start= auto depend= "use this if you want to use a depend - put service name here"
sc description "Service Name" "This service handles agent tasks configured in Clipbook"
pause

If you use a batch file a pause is handy to see if the services is created. You should see this if the services is created.

[SC] CreateService SUCCESS

[SC] ChangeServiceConfig2 SUCCESS

And delete the service is easy.

Just do SC DELETE " Service Name "

• <> Agent version 5.0.2911.28

The Microsoft Operations Manager (MOM) agent does not back up event logs and does not perform a system state backup if the Action account is configured to run as the local system account

http://support.microsoft.com/kb/913366/en-us

• <> Agent version 5.0.2911.29

The Snmp.exe process generates an access violation when the event is converted to an SNMP trap in MOM 2005

http://support.microsoft.com/kb/912704/en-us

•  <> Agent version 5.0.2911.30

• <> Agent version 5.0.2911.31

• <> Agent version 5.0.2911.32

Microsoft Operations Manager 2005 Service Pack 1 agents do not appear in the MOM Operator console and cannot communicate with the MOM Management Server

http://support.microsoft.com/kb/921288

• <> Agent version 5.0.2911.38

Source : http://www.microsoft.com/downloads/details.aspx?FamilyID=79f151c7-4d98-4c2b-bf72-ec2b4ae69191&DisplayLang=en

Overview

Source : http://www.microsoft.com/downloads/details.aspx?FamilyID=df07094c-59e9-4ce6-9802-478c35c12614&DisplayLang=en

Overview

Source : http://www.microsoft.com/downloads/details.aspx?FamilyID=df07094c-59e9-4ce6-9802-478c35c12614&DisplayLang=en

http://www.microsoft.com/downloads/details.aspx?FamilyID=1428ecfd-8c3e-4779-a383-4c491d2684f3&DisplayLang=en

Source : https://connect.microsoft.com

and

source :  http://weblog.stranger.nl

Overview

source :http://support.microsoft.com/default.aspx?scid=kb;en-us;933556&sd=rss&spid=2548

Restart requirement

You do not have to restart the computer after you apply this hotfix. However, you must apply this hotfix to the MOM 2005 management server. When you apply this hotfix, the MOM service automatically restarts.

Hotfix replacement information

This hotfix does not replace any other hotfixes.

File information

The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.

WORKAROUND

 Source :http://support.microsoft.com/default.aspx?scid=kb;en-us;930770&sd=rss&spid=2548

Using the operator console task is a nice tool to do things fast and often.

There are a couple of things that you can do with a task. Open a mmc with the services opened.

Use the command line and the operator console See figure services

Or a defragmentation check or defrag use the commandline and the agent managed-computer

See figure defrag

Syntax for defrag : cmd.exe /c defrag c: /f /v

Syntax for defrag check : cmd.exe /c defrag c: /a

You can use the WMIC Use the command line and the operator console See figure show servicepacks

wmic /node:'$Computer Name$' qfe GET description,hotfixid,installedby,installedon,servicepackineffect

Use the command line and the operator console See figure show tasklist

tasklist.exe /s $TargetComputer$ /FI "status eq running"

Use the command line and the operator console See figure show the HP 2200printer count and snmp

snmputil get 10.1.100.1 public .1.3.6.1.2.1.43.11.1.1.6.1.1

snmputil get 10.1.100.1 public .1.3.6.1.2.1.43.10.2.1.4.1.1

snmputil get 10.1.100.1 public .1.3.6.1.2.1.43.5.1.1.16.1

snmputil get 10.1.100.1 public .1.3.6.1.2.1.43.5.1.1.17.1

You can use the WMIC Use the command line and the operator console See figure show process list

wmic /node:$Computer Name$ process list brief

or open a remote CMD use the psexec from sysinternals/Microsoft you have them on the machine where you execute the task

psexec \\$Computer Name$ cmd

Or find a broken rule with a findruleutility

FindRulebyGUID "$Description$"

So there a lots of ideas to use with the tasks but it takes time to set them up and to get them working

See all the screen shots