Submit a ticketCall us

Systems Monitoring for Dummies
Our new eBook will teach you the fundamentals and help you create monitors and alerts that are effective, meaningful, and actionable. Monitoring is more than a checkbox on your to-do list. This free eBook will give you practical advice to help you succeed in all aspects of monitoring – discovery, alerting, remediation, and troubleshooting. Don’t miss out on this indispensable resource for newbies, experienced IT pros, and everyone in between. Register Now.

Home > Success Center > Server & Application Monitor (SAM) > RPCSS memory leak on the Orion poller: WMI error 0x80010002 (RPC_E_CALL_CANCELED)

RPCSS memory leak on the Orion poller: WMI error 0x80010002 (RPC_E_CALL_CANCELED)

Created by Karen Valdellon, last modified by MindTouch on Jun 23, 2016

Views: 421 Votes: 0 Revisions: 5


This article addresses a potential memory leak on the RPCSS process (C:\Windows\System32\svchost.exe -k RPCSS) due to the  WMI error 0x80010002 (RPC_E_CALL_CANCELED) that occurs in the log file.


All SAM versions


This can be caused by the firewall or antivirus configuration on the target node or because of a WMI polling failure on the node.


  1. Check SolarWinds logs for the following error message to identify the node(s) causing the issue:
    Exception from HRESULT: 0x80010002 (RPC_E_CALL_CANCELED)
    Note: The IP address can be found within the error message. For example:

    2016-03-24 14:30:47,607 [STP Pool:2271 Thread #0] [C0] DEBUG SolarWinds.APM.Probes.WMI.WMIHelper - Connection Attempt to XXX.XX.X.XXX as trafglobal\SVC_Solarwinds_Prod Failed.
    System.Runtime.InteropServices.COMException (0x80010002): Call was canceled by the message filter. (Exception from HRESULT: 0x80010002 (RPC_E_CALL_CANCELED))
       at System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode, IntPtr errorInfo)
       at System.Runtime.InteropServices.Marshal.ThrowExceptionForHR(Int32 errorCode)
       at System.Management.ManagementScope.InitializeGuts(Object o)
       at System.Management.ManagementScope.Initialize()
       at System.Management.ManagementScope.Connect()
       at SolarWinds.APM.Probes.WMI.WMIHelper.DoActionWithRetry(Action action, Int32 retries, TimeSpan retryInterval, String logMessage)

    2016-02-28 03:28:43,685 [STP SmartThreadPool Thread #68] ERROR SolarWinds.Orion.Pollers.Framework.PollerBase - WMI Poller IW.Statistics.WMI.WinV6 on XXX.XX.X.XXX failed: Call was canceled by the message filter. (Exception from HRESULT: 0x80010002 (RPC_E_CALL_CANCELED)) Scope: XXX.XX.X.XXX\root\cimv2[\trafglobal\SVC_Solarwinds_Prod] ErrorCode: 0x80010002

  2. Perform any of the following:
    • Fix WMI access to the node from the Orion server. An third-party tool such as WBEMTest can be used to verify.
    • Disable all WMI polling for Orion on the problematic node. 


Last modified