Observability

"System.NullReferenceException" Logged in Windows Application Event Log on Polling Engine When Polling WinRM Objects in SolarWinds Platform

This article provides information about a known issue where a .NET Runtime error (Event ID 1026) may appear in the Windows Application Event Log on the Polling Engine server when SolarWinds is polling WinRM-monitored nodes. The affected Job Engine Worker process restarts automatically and polling resumes without any user intervention. No data is lost and no errors will appear in the SolarWinds Web Console.

First published date

5/13/2026 6:39 PM

Last published date

5/13/2026 8:31 PM

Overview

On a polling engine that polls one or more Windows nodes using WinRM (either "WinRM Only" or "WinRM Preferred / WMI Fallback" connection type), the Windows Application event log may occasionally show an error similar to the sample below. The crashing application is the Job Engine v3 worker process that executes scheduled polling jobs.

 

Sample event (values such as time, computer name, EventRecordID, and CoreCLR build are environment-specific and will differ on each occurrence):

Log Name:      Application
Source:        .NET Runtime
Event ID:      1026
Level:         Error
Computer:      <POLLING-ENGINE-FQDN>
Time:          <YYYY-MM-DDTHH:MM:SS.sssZ>

Application: SolarWinds.JobEngine.Worker.v3.exe
CoreCLR Version: <x.y.z.build>
.NET Version: <x.y.z>
Description: The process was terminated due to an unhandled exception.

Exception Info: System.NullReferenceException: Object reference not set to an instance of an object.
   at SolarWinds.Net.WMI.WinRm.CimInstanceObserver.OnError(Exception error)
   at Microsoft.Management.Infrastructure.Internal.Operations.CimAsyncObserverProxyBase`1.<>c__DisplayClass6_0.<OnErrorInternal>b__0()
   at Microsoft.Management.Infrastructure.Internal.Operations.CimAsyncCallbacksReceiverBase.CallUnderOriginalExecutionContext(Action action)
   at Microsoft.Management.Infrastructure.Internal.Operations.CimAsyncCallbacksReceiverBase.CallIntoUserCallback(...)
   at Microsoft.Management.Infrastructure.Internal.Operations.CimAsyncObserverProxyBase`1.OnErrorInternal(...)
   at Microsoft.Management.Infrastructure.Internal.Operations.CimAsyncObserverProxyBase`1.ProcessEndOfResultsWorker(...)
   ... (additional Microsoft.Management.Infrastructure stack frames)

 

Observed behavior when the event is logged:

  • The Job Engine v3 worker process (SolarWinds.JobEngine.Worker.v3.exe) on the polling engine terminates.
  • The worker process restarts automatically (no manual action is required).
  • The polling job that was running on the terminated worker is automatically rescheduled to another worker.
  • A small polling delay (typically 1–2 seconds) may occur for the affected job; no statistics or events are lost.
  • No errors are surfaced in the SolarWinds Web Console.
  • The condition is intermittent and rare; it does not occur on every WinRM poll.

Product section

Hybrid Cloud Observability

Cause

A rare race condition in the WinRM/CIM result-handling code path of the Job Engine v3 worker. When a CIM operation reports an error, the CimInstanceObserver.OnError method may attempt to access an object reference that has not yet been initialized (or has already been released) by the underlying Microsoft.Management.Infrastructure layer, resulting in a System.NullReferenceException. Because the exception occurs outside the existing exception handler, the .NET runtime terminates the process and Windows logs the .NET Runtime Event ID 1026 entry.

The condition is timing-dependent and occurs only under very specific orderings of asynchronous CIM callbacks; the probability of occurrence on any given poll is very low.

Resolution

No user action is required.

The Job Engine Worker process automatically restarts after the crash and reschedules any affected polling jobs. Polling resumes normally within approximately 1–2 seconds. No data loss occurs and no errors will appear in the SolarWinds UI.

 

Permanent fix: A code-level fix is planned for a future release of the SolarWinds Platform. The fix introduces a try-catch block to properly handle the exception before it causes a process termination.

 

If a user is concerned, the following can be performed:

  1. Confirm their SolarWinds nodes are still actively being polled (check the SolarWinds web console — data should be updating normally)
  2. Confirm no related errors are showing in the SolarWinds UI
  3. Note that the Windows event log entry can be disregarded as the system has already self-recovered