Alert: IIS Discovery Probe Module Failed Execution

Issue: Non-recurring failure across multiple servers in the environment. Discussed here at http://www.eggheadcafe.com/conversation.aspx?messageid=32202280&threadid=31903288 with no resolution. This is occurring in IIS MP version 6.0.6539.0. We have approximately 115 IIS servers with 85 alerts of this type occurring weekly. Digging into these led to a list of object discoveries specific to the IIS management packs. These included multiple discovery rules set to run every 3600 seconds (hourly). Including:

IIS 2000:

Windows Internet Information Services Web Sites 0-25 Discovery Rule

Windows Internet Information Services Web Sites 26-50 Discovery Rule

Windows Internet Information Services Web Sites 51-75 Discovery Rule

Windows Internet Information Services Web Sites 76-100 Discovery Rule

IIS 2003:

Windows Internet Information Services Application Pools 0-25 Discovery Rule

Windows Internet Information Services Application Pools 26-50 Discovery Rule

Windows Internet Information Services Application Pools 51-75 Discovery Rule

Windows Internet Information Services Application Pools 76-100 Discovery Rule

Windows Internet Information Services Web Applications 0-25 Discovery Rule

Windows Internet Information Services Web Applications 26-50 Discovery Rule

Windows Internet Information Services Web Applications 51-75 Discovery Rule

Windows Internet Information Services Web Applications 76-100 Discovery Rule

Windows Internet Information Services Web Sites 0-25 Discovery Rule

Windows Internet Information Services Web Sites 26-50 Discovery Rule

Windows Internet Information Services Web Sites 51-75 Discovery Rule

Windows Internet Information Services Web Sites 76-100 Discovery Rule

Each of these various discoveries was occasionally failing with an error 0x80070006 error (The handle is invalid).

Resolution: Set overrides on these alerts to run every 86400 seconds (daily) instead of every 3600 seconds (hourly). This greatly decreased the frequency (down from 85 a day to 10 a day) but did not completely remove these alerts.

The new MP version (the after version 6.0.6539.0) will use a consolidator rule to only alert if this occurs multiple times a day so these overrides should not be required unless the objective is to decrease the overhead associated with this management pack.