High Number of DCOM communication errors when APM fails to connect...

Team,

Is there a relationship between DCOM (Event ID 10009 - DCOM was unable to communicate with the computer) errors and Orion APM being unable to connect to a host for monitoring? If so, is there a way to fix DCOM so that there are not so many retries and errors in the event console or is there a way to fix Orion APM so that it sends a "graceful" error to a log?

Have any of you seen this? I raised an issue with SolarWinds support as well.

Thanks for any ideas.

Find more posts tagged with

ping

network_connectivity

apm_3.1

windows_event

dcom_errors

secondary_poller

Accepted answers

All comments

MarieB

Hey benbree--

I haven't seen this but I did a search on DCOM and APM and here the link of the results it returned:

http://thwack.com/search/thwacksearch.aspx?q=DCOM+and+APM

Maybe something in there rings a bell?

When you get an answer from support, could you post it back for the community?

Many thanks,

benbree

Team,

Here is an update......

It appears I have some networking issues. I started to look at the systems that were the target of the DCOM errors and found that either I could not connect to the systems or if I pinged the system, it did not return the correct address. I am working with the networking team to resolve this.

The question that remains for SolarWinds is this - why does this present itself as a DCOM error when Orion makes the request and seems to continue to retry even after DCOM reports the failure. It seems to me that there should be an Orion message that indicates connectivity to the host and not a DCOM communication error. When this fails, there are more than 60 DCOM windows event log errors per node per hour.

chris.lapoint

Thanks for the update. To answer your question, for many Windows monitors, we use Microsoft WMI to collect performance counters. WMI relies on DCOM, which then causes the errors to appear in your event log.

arcadia17n

We are seeing thousands of errors for IPs that have no dns record and are not ping-able maybe it is checking devices off of an old list? Where does this "list" exist? Also we are getting the alerts at 66% on server 1 and 33% server 2. We are getting around 4000 every 15 minutes or 266 a minute.

example: (message and count)

DCOM was unable to communicate with the computer 129.58.21.55 using any of the configured protocols.

3729

aLTeReGo

SAM uses WMI to collect information from hosts. Essentially the request for information is passed to the operating system. The underlying Windows Operating System makes the call for information to the remote host via WMI no differently than any other Windows application which utilizes WMI would. WMI is built on another Windows technology called DCOM (Distributed COM). The errors you are seeing in the event viewer are from the operating system itself. They are triggered by requests for information by SAM, but they are not SAM events you are seeing in the event viewer. Unmanaging, disabling, or removing applications that are in a "down" or "unknown" state should reduce or even eliminate these messages from appearing in the Windows Event Log.

jim.couch

We were having this issue as well. In face, on locations where I use WMI I have more issues with monitoring due to DCOM errors, higher bandwidth to monitor, and just general unknown status'

I'm currently trying to weed most of those devices OFF WMI monitoring and just use it where I need to. It was a poor decision on my part when I was less knowledgable.

Jim