Rory Primrose

Learn from my mistakes, you don't have time to make them yourself

View project on GitHub

SCOM event collection fails with (0x8007000E)

I have written some custom SCOM management packs that read from a database and populate event collection data (see here and here for some examples from other people). My first management pack works without any problems. The second management pack (essentially a copy of the first) fails with an out of memory exception. The Operations Manager event log on the SCOM server contains an entry that starts with the following:

Converting data batch to XML failed with error “Not enough storage is available to complete this operation.” (0x8007000E) in rule “[RuleName]”

This has been plaguing me for weeks but I now have an answer.

The definition of a collection event record includes a description field. The description field may be defined with a static value, a property bag (params) value or combination of both. The property bag value can be fully qualified (in the format of $Data/Property[@Name=’<PropertyBagItemName>’]$) or referenced by index. See here for more information.

My management pack originally contained the following:

<Description>%16</Description> 

In the case of my second management pack, the index is incorrect. There were field differences in the database output between the two management packs such that the param index was pointing to a different field from the database. I fixed this up so that it was pointing to a “Message” property bag value populated from the database.

<Description>$Data/Property[@Name='Message']$</Description> 

Now the management pack works. The difference between the two fields was that the original field (identified by index 16) had a null value whereas the “Message” field did have a value. My scripts deal with null values by ensuring they are always converted to empty strings using the following old VBA trick:

Call propertyBag.AddValue("Message", rs.Fields("Message").Value & "") 

After a bit of playing around, I found that there isn’t a problem with the property bag containing empty values, but there does seem to be an issue with the event collection properties themselves having empty values when identified by index. If the fully qualified reference to the property bag item is used and it has an empty value, there is no problem.

Always make references using the fully qualified property bag reference in order to avoid this problem. This will also avoid problems should the structure of your property bag change.

Written on March 11, 2009