Jump to content


CraigSCCM

SMS_STATE_SYSTEM Critical, loads of errors :(

Recommended Posts

Morning guys, I've recently upgraded SCCM from R2 to R2 SP1

 

Very smooth upgrade actually (first time it's gone well with no draw backs) except.....

 

After a couple of days, I noticed the Component Status for SMS_STATE_SYSTEM was just on a critical state, with hundreds and hundreds of the below errors

 

The State System message file processing processed one or more files that contained errors or invalid data. Review the statesys.log file for further details.
The State System message file processing could not process file 'N_hn1meweb.SMX' and moved it to the corrupt directory. Review the statesys.log file for further details.
The State System message file processing could not process file 'N_bh01fr1u.SMX' and moved it to the corrupt directory. Review the statesys.log file for further details.
The State System message file processing processed one or more files that contained errors or invalid data. Review the statesys.log file for further details.
The State System message file processing could not process file 'N_yuz1deaw.SMX' and moved it to the corrupt directory. Review the statesys.log file for further details.
The State System message file processing could not process file 'N_f5o4kgn1.SMX' and moved it to the corrupt directory. Review the statesys.log file for further details.
The State System message file processing processed one or more files that contained errors or invalid data. Review the statesys.log file for further details.
The State System message file processing could not process file 'N_wuiyugtq.SMX' and moved it to the corrupt directory. Review the statesys.log file for further details.
The State System message file processing could not process file 'N_svg0wvy0.SMX' and moved it to the corrupt directory. Review the statesys.log file for further details.
I've attached the StateSyslog as I'm completely at a dead end with this, I can't find anything on Google that relates to this either :(
I'm on Windows Server 2012 R2, The Server hasn't been patched recently and it was fine before the upgrade, I saw a few posts regarding dot.net removing the KB updates
  1. KB2835393, KB2804576 or KB2840628 for Windows 2012. These are .NET Framework 4.0 patches and Windows 2012 comes with .NET Framework 4.5.

    KB2833958 and KB2840632
None of those patches are on my server
Any help would be greatly appreciated

StateSysLog.txt

post-29597-0-62000700-1446629612.png

Share this post


Link to post
Share on other sites

I can report that we have the same errors, it startade November 3rd 02:59, before that no problems what so ever.

We have SCCM 2012 R2 SP1 CU1, we installed CU1 September 25 so we have had that installed for some time. And installed hotfix KB3081699 on Oktober 12 to fix a issue with IOS 9 Compliance.

 

So my guess is that your update isnt the problem.

If you check the .smx files is it your mobile devices that are sending the file? Or normal computers also?

Share this post


Link to post
Share on other sites

If you open the .smx file in notepad. Or make a copy of it and add xml at the end you can read it more easily in internet explorer.

There is a section were the hostname is presented.

 

Go to Microsoft Configuration Manager folder then inboxes\auth\statesys.box\corrupt

You will see that it puts the files there.

 

Take the latest message and copy it to another location and add xml then open it in IE or any other browser, otherwise you can open the .smx in notepad directly.

  • Like 1

Share this post


Link to post
Share on other sites

Yep, your right mate, it's the users Windows Phones

 

 

WindowsPhone_11/2/2015_9:20 AM</NetBIOSName><CodePage>437</CodePage><SystemDefaultLCID>1033</SystemDefaultLCID><Priority>5</Priority></Machine></Identification><ReportDetails><ReportContent>State Message Data</ReportContent><ReportType>Full</ReportType><Date>20151105113737.513000+000</Date><Version>1.0</Version><Format>1.0</Format></ReportDetails></ReportHeader><ReportBody><StateMessage MessageTime="20151105113737.513000+000" SerialNumber="1"><Topic ID="0" Type="8001" IDType="0" User="SYSTEM" /><State ID="0" Criticality="0" /><UserParameters Flags="0" Count="0" /></StateMessage></ReportBody></Report>

 

 

 

How do I fix this issue :(

Share this post


Link to post
Share on other sites

Sadly i have no idea at the moment as i cant find any viable solution other then contacting microsoft and registering a case.

They will most likely classify this as a bugg and then we dont have to pay for their time.

 

The active phones we have on the server right now are android phones, and iphones. So it seem to affect all mobile devices.

Do you use intune integration as well? We use Intune for mobile devices.

Share this post


Link to post
Share on other sites

:( Yeah we have the intune connector set up too, so we don't use the portal, everything is managed through CM12

 

Logging a call with Microsoft is the only way I can see this getting fixed, unless CM release a CU in the next few days? lol

 

I don't understand though, everyone else seems to upgrade from R2 to SP1 fine... Unless they are experiencing the same issue and haven't noticed...if not ...why us? :(:huh:

Share this post


Link to post
Share on other sites

From what i heard i a new CU will be released soon.

 

I will most likely register a case with Microsoft to get this fixed.

 

My personal opinion is that this isnt a problem with the upgrade to r2 sp1, but rather a problem with the intune service.

As the phones all of a sudden are sending messages to the MP with a type that isnt recognised.

 

We installed the server in june with r2 sp1, and in sepember applied CU1. So we have had the server running for a while(didnt add mobile devices until mid october), and the hotfix we installed after that was installed about 1 month ago.

So i have a hard time seeing that there was a problem with any update, but more a problem with the Intune service sending a new type that the sccm doesnt know about

 

 

Correct me if i am wrong in any way

Share this post


Link to post
Share on other sites

I fully agree with you, my clients SCCM server was always green with no Component or Site issue's, since the Upgrade to SP1 that's when it's started happening - Im not 100% how In-tune gets updated? Does it auto update it'self?

 

I've just seen this on the server .... not sure if it;s related

 

 

Waiting for update

 

just found this... https://support.microsoft.com/en-us/kb/3106034

post-29597-0-07102800-1446731934.png

Share this post


Link to post
Share on other sites

Im thinking more in the line that the mobile units report via intune app to intune cloud services, which then relays the information to the SCCM:en. So if they made a update to the intune client or cloud service.

 

On our server we have the iOS 9 Extension which we have enabled (you could require at hotfix for this if you enable it as we hade problem with Configuration Items after we enabled that, and we have the Conditional Access Extensions(which we dont use). The reason we dont have Windows Phone is that the customer doesnt use them so we havent enabled enrollment for that type of phone

 

Conditional Access Extension has to do with exchange online (http://blogs.technet.com/b/configmgrteam/archive/2015/03/12/conditional-access-for-exchange-online.aspx) and it only adds 2 new features as the others are already implemented in r2 sp1:

  • Minimum OS compliance rule

  • Maximim OS compliance rule

Share this post


Link to post
Share on other sites

I think I'm going to get Microsoft on-board with this, luckily the logs aren't filling up with excessive amounts of space, so I've just quickly created a Powershell script schedule too delete everything in the corrupted directory every hour, until this is resolved i don't know what sort of impact it's having on the users though, i haven't heard anything as of yet...

Share this post


Link to post
Share on other sites

I have the same issue >>> http://www.windows-noob.com/forums/topic/13210-intune-sccm-topic-type-8001/

 

I decided to create a new SCCM instance in my home lab (SCCM 2012 R2 CU4) and none of the extensions have come down so it looks like whatever they've done to the Intune connector within the last week has broken it.

 

Also logged a call with Microsoft to which I get the standard response "we'll get the engineer to call you back with an update straight away"...that was 2 days ago!

 

Hope this gets fixed soon.

Share this post


Link to post
Share on other sites

Not yet. Tweeted MS Intune over the weekend and ticket was escalated (how much good that'll do I don't know!). Ended up getting a diagnostics tool from MS which compresses all of the logs from the SCCM server and sends it to the engineer. Sent that back last night so should hopefully hear something within the next 24/48 hours.

 

The Intune service dashboard showed this update for the 7th:

 

=========

[Resolved] Service is restored.
(Started on 11/7/2015 1:45:00 AM UTC)
11/7/2015 5:19:37 AM (UTC)
Final Status: By design, the service took the appropriate action to remediate impact. Engineers then validated that service was restored. User Impact: Affected users may have been unable to retire or wipe their devices. Customer Impact: Analysis of incident scope indicated that a very limited number of customers and users appeared to be impacted. Incident Start Time: Saturday, November 7, 2015, at 1:45 AM UTC Incident End Time: Saturday, November 7, 2015, at 4:26 AM UTC Preliminary Root Cause: The root cause of this incident is not known but is under investigation. Next Steps: The following is a list of known action item(s) associated with this incident. As part of the Office 365 problem management process, additional engineering actions may be identified to improve the overall service. - Action: Identify the underlying root cause and develop a solution to prevent reoccurrences. Please consider this service notification the final update on the event.
11/7/2015 4:33:28 AM (UTC)
Current Status: Engineers continue to investigate an issue in which some users may be experiencing problems accessing or using Microsoft Intune services or features. User Impact: Affected users may be unable to complete wipes for devices. Customer Impact: Analysis of incident scope is underway. Some customers may be impacted by this event. Incident Start Time: Saturday, November 7, 2015, at 1:45 AM UTC Next Update by: Saturday, November 7, 2015, at 5:30 AM UTC
11/7/2015 3:31:00 AM (UTC)
Current Status: Engineers continue to investigate alerts indicating a possible issue with the Microsoft Intune service. Customer Impact: Analysis of incident scope is underway. Some customers may be impacted by this event. No customer reports of the issue have been identified at this time.
11/7/2015 3:03:43 AM (UTC)
Current Status: Engineers are investigating an issue in which some users may be experiencing problems accessing or using Microsoft Intune services or features. This event is actively being investigated. More information will be provided shortly. Customer Impact: Analysis of incident scope is underway. Some customers may be impacted by this event. No customer reports of the issue have been identified at this time.

=========


Share this post


Link to post
Share on other sites

Spoke to someone in SCCM support this morning. Mentioned the ID 8001 error and they didn't know much about it.

 

First set of logs didn't get through to them :angry: so just waiting on another link from them to send them over again.

Share this post


Link to post
Share on other sites

Nothing. Phone call from MS this morning saying they had the logs but will call me once they have an update.

 

On a separate note, found these errors in the compmon.log from when i first enabled the Intune connector on my new SCCM environment:

 

Failed to read the required Operations Management component registry key values on local computer; error = 6 (0x6).

Failed to read in current property values and refresh the COpsMgmtComponent object; error = 6 (0x6).

 

Not seen them since the 5th November but then the rest of the log is filled up with this:

 

Checking components ...

Can not get the current execution state for component Windows_Intune_Service since it is not installed or completed installing.

Waiting until the next polling cycle in 300 seconds from now.

Share this post


Link to post
Share on other sites

I logged a call with MS, STILL waiting for them to get back to me <_< i didn't have to enable the intune connector when i upgraded though Danny, was yours connected before or not?

Share this post


Link to post
Share on other sites

I checked compmon on the server now as well

 

and i have the same:

 

Checking components ... SMS_COMPONENT_MONITOR 2015-10-24 22:45:26 4276 (0x10B4)
Can not get the current execution state for component Windows_Intune_Service since it is not installed or completed installing. SMS_COMPONENT_MONITOR 2015-10-24 22:45:26 4276 (0x10B4)
But if i check the Microsoft Intune Connector under site status it's flagged as OK
So thats why im wondering if Windows_Intune_Service is the same as the connector...
As if i check the SCCM services there is a Windows_intune_Service and it's not running, i have checked 2 sccm servers and that services isnt active on any of them

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

Loading...

×
×
  • Create New...