Submit a ticketCall us

Announcing NCM 7.7
With NCM 7.7, you can examine the rules that make up an access control list for a Cisco ASA device. Then you can apply filters to display only rules that meet the specified criteria, order the rules by line number or by the hit count, and much more.
See new features and improvements.

Home > Success Center > Server & Application Monitor (SAM) > RPCSS memory leak on the Orion poller: WMI error 0x80010002 (RPC_E_CALL_CANCELED)

RPCSS memory leak on the Orion poller: WMI error 0x80010002 (RPC_E_CALL_CANCELED)

Created by Karen Valdellon, last modified by MindTouch on Jun 23, 2016

Views: 331 Votes: 0 Revisions: 5


This article addresses a potential memory leak on the RPCSS process (C:\Windows\System32\svchost.exe -k RPCSS) due to the  WMI error 0x80010002 (RPC_E_CALL_CANCELED) that occurs in the log file.


All SAM versions


This can be caused by the firewall or antivirus configuration on the target node or because of a WMI polling failure on the node.


  1. Check SolarWinds logs for the following error message to identify the node(s) causing the issue:
    Exception from HRESULT: 0x80010002 (RPC_E_CALL_CANCELED)
    Note: The IP address can be found within the error message. For example:

    2016-03-24 14:30:47,607 [STP Pool:2271 Thread #0] [C0] DEBUG SolarWinds.APM.Probes.WMI.WMIHelper - Connection Attempt to XXX.XX.X.XXX as trafglobal\SVC_Solarwinds_Prod Failed.
    System.Runtime.InteropServices.COMException (0x80010002): Call was canceled by the message filter. (Exception from HRESULT: 0x80010002 (RPC_E_CALL_CANCELED))
       at System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode, IntPtr errorInfo)
       at System.Runtime.InteropServices.Marshal.ThrowExceptionForHR(Int32 errorCode)
       at System.Management.ManagementScope.InitializeGuts(Object o)
       at System.Management.ManagementScope.Initialize()
       at System.Management.ManagementScope.Connect()
       at SolarWinds.APM.Probes.WMI.WMIHelper.DoActionWithRetry(Action action, Int32 retries, TimeSpan retryInterval, String logMessage)

    2016-02-28 03:28:43,685 [STP SmartThreadPool Thread #68] ERROR SolarWinds.Orion.Pollers.Framework.PollerBase - WMI Poller IW.Statistics.WMI.WinV6 on XXX.XX.X.XXX failed: Call was canceled by the message filter. (Exception from HRESULT: 0x80010002 (RPC_E_CALL_CANCELED)) Scope: XXX.XX.X.XXX\root\cimv2[\trafglobal\SVC_Solarwinds_Prod] ErrorCode: 0x80010002

  2. Perform any of the following:
    • Fix WMI access to the node from the Orion server. An third-party tool such as WBEMTest can be used to verify.
    • Disable all WMI polling for Orion on the problematic node. 


Last modified
03:01, 23 Jun 2016