Ok, so I am working on the event message id tool dumper I discussed previously and I run into something very odd.
First off the tool, it is progressing nicely, output is considerably cleaned up by filtering out categories, etc and writing headers to the files, etc.
So I start spot checking the output to double check just in case I did something wrong even though I am really sure I haven’t. Everything is checking out well until I hit a COM+ message.
The message is
“The threading model of the component specified in the registry is inconsistent with the registration database. The faulty component is: %1%0”
this message is listed in Technet as 4266 and indeed in Windows 2000 the COM+ Message File is comsvcs.dll and message ID 4266 is the message above…
However in Windows Server 2003, COM+ uses the Message File comres.dll and there is no message ID 4266, there is however a message ID 4858 that has the exact same message
“The threading model of the component specified in the registry is inconsistent with the registration database. The faulty component is: %1%0”.
So here we have the same exact message for the same exact source but completely different Event ID numbers…
Is anyone out there monitoring Windows with event log scrapers looking for specific COM+ error messages based on event IDs? If you are, hopefully you generated a new monitoring policy on a K3 machine instead of copying one made on a 2K machine, if not, you may not be monitoring what you think you are monitoring.
I sent a note to my friend Eric about this because quite honestly, this seems so weird to me, I have no clue who to really contact about it to verify that this was indeed the intent. All documentation I can find on this points at the fact that the event ID is supposed to be 4266.
If you know where I might have screwed up, please comment, I am completely confused.
If you are an MS person who knows this isn’t right and need more info, email me and I can send Tab Delimited dumps of the COM+ source messages from a 2K and a K3 machine.
