Submit a ticketCall us

Looking to compare latest NPM features with previous versions of NPM?
The NPM new feature summary offers a comparison of new features and improvements offered with this release.

 

Home > Success Center > Server & Application Monitor (SAM) > RPCSS memory leak on the Orion poller: WMI error 0x80010002 (RPC_E_CALL_CANCELED)

RPCSS memory leak on the Orion poller: WMI error 0x80010002 (RPC_E_CALL_CANCELED)

Created by Karen Valdellon, last modified by MindTouch on Jun 23, 2016

Views: 137 Votes: 0 Revisions: 5

Overview

This article addresses a potential memory leak on the RPCSS process (C:\Windows\System32\svchost.exe -k RPCSS) due to the  WMI error 0x80010002 (RPC_E_CALL_CANCELED) that occurs in the log file.

Environment

All SAM versions

Cause 

This can be caused by the firewall or antivirus configuration on the target node or because of a WMI polling failure on the node.

Resolution

  1. Check SolarWinds logs for the following error message to identify the node(s) causing the issue:
    Exception from HRESULT: 0x80010002 (RPC_E_CALL_CANCELED)
    Note: The IP address can be found within the error message. For example:

    SolarWinds.APM.Probes_[].log:
    2016-03-24 14:30:47,607 [STP Pool:2271 Thread #0] [C0] DEBUG SolarWinds.APM.Probes.WMI.WMIHelper - Connection Attempt to XXX.XX.X.XXX as trafglobal\SVC_Solarwinds_Prod Failed.
    System.Runtime.InteropServices.COMException (0x80010002): Call was canceled by the message filter. (Exception from HRESULT: 0x80010002 (RPC_E_CALL_CANCELED))
       at System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode, IntPtr errorInfo)
       at System.Runtime.InteropServices.Marshal.ThrowExceptionForHR(Int32 errorCode)
       at System.Management.ManagementScope.InitializeGuts(Object o)
       at System.Management.ManagementScope.Initialize()
       at System.Management.ManagementScope.Connect()
       at SolarWinds.APM.Probes.WMI.WMIHelper.DoActionWithRetry(Action action, Int32 retries, TimeSpan retryInterval, String logMessage)

    Core.CollectorJobs_[*].log:
    2016-02-28 03:28:43,685 [STP SmartThreadPool Thread #68] ERROR SolarWinds.Orion.Pollers.Framework.PollerBase - WMI Poller IW.Statistics.WMI.WinV6 on XXX.XX.X.XXX failed: Call was canceled by the message filter. (Exception from HRESULT: 0x80010002 (RPC_E_CALL_CANCELED)) Scope: XXX.XX.X.XXX\root\cimv2[\trafglobal\SVC_Solarwinds_Prod] ErrorCode: 0x80010002

  2. Perform any of the following:
    • Fix WMI access to the node from the Orion server. An third-party tool such as WBEMTest can be used to verify.
    • Disable all WMI polling for Orion on the problematic node. 

 

Last modified
03:01, 23 Jun 2016

Tags

Classifications

Public