Hi SCOM buddies,
I have a little bit of an annoying scenario which I have seen reference to once previously in the forums (conclusion it was a Microsoft confirmed bug). I wanted to ensure this was still the case, the detail:
Event 4666 is occurring about 20 times a minute in my security log. This flooding is causing me some storage issues over time and is plain annoying as event ID spam!
Event 4666 is an Audit Failure in this case against the SCOM Data Reader Account. Unfortunately the secure nature of the environment I am working in means I must Audit to the is level , so the old "turn off auditing" trick is a no go.
The old MonitoringHost.exe is running one thread against the Data Reader Account and this is what is causing the repeat 4666 event. Kill the process or stop the service and of course this kills the problem.
I have 3 completely separate SCOM installs with the same symptom. These were built pretty thoroughly and my SCOM Data Reader account has the permissions it needs.
Anyone else seeing this behaviour and better yet how to kill it off?
I think its a bug but if a friend from MS could confirm I could at least take that on board and hope for a fix shortly!
Thanks
Mooky