Submit a ticketCall us

AnnouncementsChange Is Inevitable

Get valuable help when it comes to tracking and monitoring changes. SolarWinds® Server Configuration Monitor (SCM) is designed to help you: detect, track, and receive alerts when changes occur, correlate system performance against configuration changes, compare server and application configuration against custom baselines, and verify application and system changes.

Learn more.

Home > Success Center > Server & Application Monitor (SAM) > SAM - Knowledgebase Articles > RPCSS memory leak on the Orion poller: WMI error 0x80010002 (RPC_E_CALL_CANCELED)

RPCSS memory leak on the Orion poller: WMI error 0x80010002 (RPC_E_CALL_CANCELED)

Created by Karen Valdellon_ret, last modified by MindTouch on Jun 23, 2016

Views: 2,064 Votes: 0 Revisions: 5


This article addresses a potential memory leak on the RPCSS process (C:\Windows\System32\svchost.exe -k RPCSS) due to the  WMI error 0x80010002 (RPC_E_CALL_CANCELED) that occurs in the log file.


All SAM versions


This can be caused by the firewall or antivirus configuration on the target node or because of a WMI polling failure on the node.


  1. Check SolarWinds logs for the following error message to identify the node(s) causing the issue:
    Exception from HRESULT: 0x80010002 (RPC_E_CALL_CANCELED)
    Note: The IP address can be found within the error message. For example:

    2016-03-24 14:30:47,607 [STP Pool:2271 Thread #0] [C0] DEBUG SolarWinds.APM.Probes.WMI.WMIHelper - Connection Attempt to XXX.XX.X.XXX as trafglobal\SVC_Solarwinds_Prod Failed.
    System.Runtime.InteropServices.COMException (0x80010002): Call was canceled by the message filter. (Exception from HRESULT: 0x80010002 (RPC_E_CALL_CANCELED))
       at System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode, IntPtr errorInfo)
       at System.Runtime.InteropServices.Marshal.ThrowExceptionForHR(Int32 errorCode)
       at System.Management.ManagementScope.InitializeGuts(Object o)
       at System.Management.ManagementScope.Initialize()
       at System.Management.ManagementScope.Connect()
       at SolarWinds.APM.Probes.WMI.WMIHelper.DoActionWithRetry(Action action, Int32 retries, TimeSpan retryInterval, String logMessage)

    2016-02-28 03:28:43,685 [STP SmartThreadPool Thread #68] ERROR SolarWinds.Orion.Pollers.Framework.PollerBase - WMI Poller IW.Statistics.WMI.WinV6 on XXX.XX.X.XXX failed: Call was canceled by the message filter. (Exception from HRESULT: 0x80010002 (RPC_E_CALL_CANCELED)) Scope: XXX.XX.X.XXX\root\cimv2[\trafglobal\SVC_Solarwinds_Prod] ErrorCode: 0x80010002

  2. Perform any of the following:
    • Fix WMI access to the node from the Orion server. An third-party tool such as WBEMTest can be used to verify.
    • Disable all WMI polling for Orion on the problematic node. 


Last modified