Documentation forServer & Application Monitor
Monitoring your applications and environment is a key capability of SolarWinds Observability Self-Hosted (formerly Hybrid Cloud Observability) and is available in the Essentials edition. Server & Application Monitor (SAM) is also available in a standalone module.

Microsoft Message Queuing Events

This SAM application monitor template assesses the status and overall performance of a MSMQ server by monitoring critical errors in the Windows Application log file.

Prerequisites

WMI access to the target server.

Credentials

Windows Administrator on the target server.

Component monitors

All monitors should return values of zero. Returned values other than zero may indicate an abnormality. If you believe an abnormality exists, examine the Windows Application log for details. Filter with the source name “MSMQ.”

Active Directory Integration Configuration

This monitor returns the following events:

  • Message Queuing was unable to create the msmq (MSMQ Configuration) object in the Active Directory;
  • The Message Queuing service was unable to obtain the properties of the msmq (MSMQ Configuration) object from the Active Directory.

Event ID: 2116, 2120.

The MSMQ configuration object cannot be created in Active Directory Domain Services (ADDS): This error might be caused by one of the following conditions:

  • The user who is installing Message Queuing does not have the correct permissions to create child objects in ADDS.
  • Replication delays are not configured properly.
  • A corrupted computer object exists in ADDS.
  • The Message Queuing service was unable to obtain the properties of the msmq (MSMQ Configuration) object from Active Directory: There is an issue with replication delays. This issue should be resolved after ADDS replicates itself.

Active Directory Operation

This monitor returns the following events:

  • The Message Queuing service cannot start. The Active Directory interface cannot be initialized;
  • The list of Message Queuing servers with directory service functionality in the Windows registry is empty;
  • This domain controller is not trusted for delegation. Therefore, the Message Queuing server cannot run;
  • The Message Queuing server cannot determine if the local domain controller is trusted for delegation. This may indicate a serious problem;
  • The sites where the computer resides cannot be resolved. Check that the subnets in your network are configured correctly in the Active Directory and that each site is configured with the appropriate subnet;
  • The Message Queuing service cannot join the Windows NT 4.0 domain. The Active Directory Integration subcomponent was therefore removed;
  • The local computer is a Message Queuing routing server that formerly belonged to the domain and is now operating in workgroup mode. Other Message Queuing clients still regard this computer as a routing server and will try to route messages through this computer.

Event ID: 2035, 2068, 2122, 2123, 2165, 2166, 2169.

The Active Directory interface cannot be initialized: There may be several reasons why the Active Directory interface cannot be initialized. Possible actions include the following:

  • Configure Message Queuing objects to be accessible in ADDS.
  • Make modifications so that Message Queuing can find and bind to the directory service.
  • Resolve issues that are preventing Message Queuing from synchronizing with ADDS.

The list of Message Queuing servers with directory service functionality in the Windows registry is empty: Confirm the presence of the Directory Service Integration feature by doing the following:

  1. Verify the registry key setting.
  2. Verify that the computer is joined to the correct domain.
  3. Verify Active Directory operation.

This domain controller is not trusted for delegation: The domain controller must have the Active Directory option “Trust computer for delegation” enabled.

The Message Queuing server cannot determine if the local domain controller is trusted for delegation: The domain controller must have the Active Directory option “Trust computer for delegation” enabled.

The sites where the computer resides cannot be resolved: The subnets may not be configured correctly. Possible actions include the following:

  • Reconfigure the Active Directory subnets in your network.
  • Configure each site with the appropriate subnet.

The local computer is a Message Queuing routing server that formerly belonged to the domain and is now operating in workgroup mode: Stale computer objects can cause the MSMQ Service to not operate properly. Deleting stale computer objects may solve this problem. However, deleting a computer object in (ADDS can cause problems on the client computer. Before you delete a computer object, make sure that no services running on the client computer will be affected. In this case, deleting the Message Queuing Active Directory object will delete public queues on the computer.

Clustering

This monitor returns the following events:

  • The Message Queuing service resource cannot bind to the cluster IP address;
  • The IP address specified in the registry value is not a valid IP address for this computer.

Event ID: 2168, 2220.

The Message Queuing service resource cannot bind to the cluster IP address: The MSMQ Service on the physical node must be cluster aware. If the service is not cluster aware, this prevents the Message Queuing resource from coming online on this node. This problem can occur if the MSMQ Service running on the physical node was started before the computer became a member of the server cluster. As a result, the MSMQ Service running on the physical node listens on all IP addresses of the computer and prevents the Message Queuing resource from listening on the cluster IP address.

The IP address specified in the registry value is not a valid IP address for this computer: The IP address is not configured properly in the registry. Either remove the registry value or set it to the IP address suggested in the event.

Network Configuration

This monitor returns the following events:

  • The queue cannot listen/bind to the multicast address;
  • Message Queuing failed to bind to port 1801. The port may already be bound to another process;
  • Message Queuing cannot bind to UDP port 3527;
  • Message Queuing failed to listen on the IPv6 protocol. Messages will not be accepted on IPv6;
  • Message Queuing failed to listen on the IPv4 protocol. Messages will not be accepted on IPv4.
  • Message Queuing Service failed to listen on both IPv4 and IPv6 protocol. Messages will not be accepted from the network through TCP/IP protocols.

Event ID: 2160, 2170, 2171, 2197, 2198, 2199.

The queue cannot listen/bind to the multicast address: The multicast address that is specified in the event is not valid. Enter a valid multicast address for the queue that is using this address. IP multicast addresses must consist of four bytes, and they must lie in the class D range from 224.0.0.0 to 239.255.255.255. However, only certain ranges of addresses in this range are available for sending multicast messages.

Message Queuing failed to bind to port 1801: Message Queuing must bind to port 1801 to function. Make sure that the port is free (that is, no other programs are trying to use it), and then try to start the MSMQ Service again after allowing time for the port to close. If this problem occurs during setup, you must free the port and run Setup again.

Message Queuing cannot bind to UDP port 3527: The Message Queuing internal ping mechanism uses UDP port 3527 to establish network connections. Another process may be using this port. Message Queuing can continue to operate without using this port, but connection times will not be optimal. To optimize the establishment of connections, free port 3527, and then restart the MSMQ Service.

Message Queuing failed to listen on the IPv6 protocol: Message Queuing is not able to listen to messages on IPv6 because the protocol may not be supported on this computer. Find out if IPv6 can be installed on this computer, because your hardware or software may not support IPv6.

Message Queuing failed to listen on the IPv4 protocol: Message Queuing is not able to listen to messages on IPv4 because of some issue. IPv4 may not be enabled, or your hardware or software may not support it.

Message Queuing Service failed to listen on both IPv4 and IPv6 protocol: The TCP/IP communication protocols are not functioning as expected. Try to restart TCP/IP services or the computer.

Connectivity

This monitor returns the following events:

  • The Message Queuing service cannot communicate with other computers, because the RPC interface cannot use the TCP/IP protocol;
  • This server was unable to resolve the IP addresses of other routing servers;
  • Message Queuing could not resolve the name to an IP address;
  • A socket operation failed with an error;
  • Message Queuing could not establish connection to, because connection was refused by the recipient computer;
  • The Message Queuing service cannot communicate with other computers because the select API socket failed.

Event ID: 2059, 2140, 2184, 2185, 2187, 2194.

The RPC interface cannot use the TCP/IP protocol: Try to resolve TCP/IP and RPC issues.

This server was unable to resolve the IP addresses of other routing servers: IP addresses must be assigned to all routing servers, and they must be registered properly in DNS. Assign IP addresses to all routing servers, and make sure that they are registered in DNS. If that does not work, check the routing server configuration to ensure that the routing settings (in/out server, service is running, and others) are correct.

Message Queuing could not resolve the name to an IP address: Confirm that the computer name that is specified in the event is a valid computer name on the network. If it is a valid computer name, confirm the recipient computer's DNS settings, and then use the ping command to contact the recipient computer by network name to confirm name resolution functionality.

A socket operation failed with error: The MSMQ Service failed to connect to the host that is referred to in the event description. Make sure that the host computer is online, and ensure that you have network connectivity to the host.

Connection was refused by the recipient computer: Confirm network connectivity to the host that is referred to in the event description. This error can also occur if there are no more Client Access Licenses (CALs) available on the host or if the connection limit for the host has been reached.

The select API for socket failed: The selected application programming interface (API) may have failed for several different reasons. The most common reason for this failure is socket connection time-out. Make sure that the computer has connectivity to the network.

Functioning in Domain

This monitor returns the following events:

  • The Message Queuing service failed to join the computer's domain;
  • Message Queuing objects cannot move automatically between domains;
  • The computer object for this computer was not found in Active Directory;
  • The Message Queuing service will not join the domain. An MSMQ Configuration (msmq) object exists in the new domain with an ID differing from the service ID;
  • Message Queuing could not access Active Directory and failed to compute routing path for messages sent to queue.

Event ID: 2124, 2127, 2145, 2164, 2188.

The Message Queuing service failed to join the computer's domain: Message Queuing was not able to join the domain or MSMQ Routing failed because of domain connectivity issues. This error might be caused by one of the following conditions:

  • Stale objects in ADDS prevent Message Queuing from joining the domain.
  • The computer does not have connectivity and cannot join a domain.
  • Appropriate permissions are needed to create and access objects.

Message Queuing objects cannot move automatically between domains: If you were not trying to perform an interforrest migration, uninstall Message Queuing and then reinstall it in the new domain.

The computer object for this computer was not found in Active Directory: There is an issue with replication delays. This issue should be resolved afterADDS replicates itself.

An MSMQ Configuration (msmq) object exists in the new domain with an ID differing from the service ID: Stale objects can prevent the MSMQ Service from operating properly. Deleting stale objects may solve this problem. However, deleting a computer object in ADDS can cause problems on the client computer. Before deleting the computer object, make sure that no services running on the client computer will be affected. In this case, deleting the Message Queuing Active Directory object will delete public queues on that computer.

Message Queuing could not access Active Directory and failed to compute routing path for messages sent to queue: Message Queuing was not able to join the domain or MSMQ Routing failed because of domain connectivity issues. This error might be caused by one of the following conditions:

  • Stale objects in ADDS prevent Message Queuing from joining the domain.
  • The computer does not have connectivity and cannot join a domain.
  • Appropriate permissions are needed to create and access objects.

Logging and Checkpoint

This monitor returns the following events:

  • The Message Queuing service has insufficient privileges to create audit log messages;
  • The incoming sequences checkpoint file failed to initialize;
  • The transactions checkpoint file failed to initialize;
  • The logger files cannot be initialized;
  • The Message Queuing service cannot start. The checkpoint files cannot be recovered;
  • The Message Queuing service cannot start. The log file cannot be recovered;
  • The Message Queuing service cannot start. The message file and the log file cannot be reloaded.

Event ID: 2044, 2053, 2064, 2076, 2078, 2079, 2083.

The Message Queuing service has insufficient privileges to create audit log messages: The user that the MSMQ Service runs under must be able to set the SE_AUDIT_NAME privilege. This privilege is automatically granted to the Network Service. To resolve this issue, confirm that the MSMQ Service is running as a Network Service.

The incoming sequences checkpoint file failed to initialize: Checkpoint files must be available for Message Queuing to function properly. To resolve this issue, you must delete the incoming sequence checkpoint files, as well as the QMLog file in the Message Queuing storage directory. This can result in some messages being duplicated. However, this will get the service running as soon as possible and usually without data loss.

The transactions checkpoint file failed to initialize: Checkpoint files must be available for Message Queuing to function properly. To resolve this issue, you must delete the transaction checkpoint files, as well as the QMLog file in the Message Queuing storage directory. This can result in some messages being duplicated. However, this resolution will get the service running as soon as possible and usually without data loss.

The logger files cannot be initialized: The MSMQ Service needs access permissions on the checkpoint and log files. If the service has permissions and you receive this error, then the file is probably corrupt. To start the MSMQ Service without losing consistency, you must correct or recover corrupted checkpoint and log files.

The checkpoint files cannot be recovered: Checkpoint files must be available for Message Queuing to function properly. To resolve this issue, you must delete all the checkpoint files, as well as the QMLog file in the Message Queuing storage directory. This can result in some messages being duplicated. However, this resolution will get the service running as soon as possible and usually without data loss.

The log file cannot be recovered: The MSMQ Service needs access permissions on the checkpoint and log files. If the service has permissions and you receive this error, then the file is probably corrupt. To start the MSMQ Service without losing consistency, you must correct or recover corrupted checkpoint and log files.

The message file and the log file cannot be reloaded: The MSMQ Service needs access permissions on the checkpoint and log files. If the service has permissions and you receive this error, then the file is probably corrupt. To start the MSMQ Service without losing consistency, you must correct or recover corrupted checkpoint and log files.

Mapping Operation

This monitor returns the following events:

  • The Message Queuing service stopped monitoring the mapping folder;
  • The mapping file was ignored. Its content cannot be read;
  • The mapping file was ignored because it was improperly formatted;
  • The mapping of the URL to the queue was ignored. This URL is already mapped to another queue;
  • The mapping of the URL to the queue is ignored. This queue name is not a valid URL-style queue name.

Event ID: 2155, 2156, 2158, 2157, 2161.

The Message Queuing service stopped monitoring the mapping folder: Verify that the MSMQ Service is installed and running. Also, verify the presence of the mapping directory.

The mapping file was ignored. Its content cannot be read: Verify that the MSMQ Service is installed and running. Also, verify the presence of the mapping directory.

The mapping file was ignored because it was improperly formatted: The mapping file that is referred to is not formatted properly. Confirm that the mapping file is a valid XML document with correct queue mappings.

The mapping of the URL to the queue was ignored. This URL is already mapped to another queue: Each alias can only be used once in a mapping file. If you have multiple mapping files in use, it is possible to have the same alias in different mapping files pointing to different queues, which also does not work.

The mapping of the URL to the queue is ignored. This queue name is not a valid URL-style queue name: The queue that is indicated in the event does not have a correctly formed URL-style queue name in an MSMQ SFD mapping file.

MSDTC Service Operation

This monitor returns the following events:

  • The Message Queuing service cannot start. A connection with the Distributed Transaction Coordinator cannot be established;
  • The Microsoft Distributed Transaction Coordinator (DTC) failed. The Message Queuing service cannot continue.

Event ID: 2047, 2143.

For these events, check if the MSDTC service is started.

System Resources

This monitor returns the following events:

  • The message file cannot be created. There is insufficient disk space or memory;
  • The Message Queuing folder cannot be created;
  • The service cannot start due to insufficient disk space or memory;
  • Machine MSMQ storage quota was exceeded or there is insufficient disk space;
  • Message Queuing failed to send a message due to low memory;
  • Message Queuing will not be able to accept messages temporarily because system paged pool is low;
  • Message Queuing will not be able to accept messages temporarily because system commit is high;
  • Storage quota exceeded for MSMQ queue.

Event ID: 2085, 2096, 2147, 2183, 2189, 2250, 2251, 2182.

The message file cannot be created. There is insufficient disk space or memory: Try identifying and closing other applications that may be consuming a large amount of memory. If it turns out that the MSMQ Service is the only program consuming a large amount of memory, try receiving the messages from the queues or increasing the rate of message processing.

The Message Queuing folder cannot be created: The Message Queuing access control list (ACL) needs appropriate permissions to the directory that it is trying to write to. Make sure that the MSMQ Service is running as an account that has permissions to create and modify directories to be used by the MSMQ Service. (By default, the MSMQ Service creates directories under the %windir%\System32\MSMQ directory.) You can do this by directly giving Modify, Read, and Write permissions to the account that the MSMQ Service runs under.

The service cannot start due to insufficient disk space or memory: The MSMQ Service needs adequate disk space and memory to function properly. Try freeing up disk space and memory and then restarting the MSMQ Service.

Machine MSMQ storage quota was exceeded or there is insufficient disk space: The Message Queuing machine quota has been reached. The sending application should request negative acknowledgements (NACK) from the computer to which it is sending messages. If a NACK is returned to the sending application and indicates that the quota for the destination queue or computer has been reached, the sending application can either stop sending messages or offload the messages to another destination.

Message Queuing failed to send a message due to low memory: Try identifying and closing other applications that may be consuming a large amount of memory. If it turns out that the MSMQ Service is the only program consuming a large amount of memory, try receiving the messages from the queues or increasing the rate of message processing.

Message Queuing will not be able to accept messages temporarily because system paged pool is low: Common system resources are almost fully consumed. Message Queuing will not operate properly until system resources are freed up.

Message Queuing will not be able to accept messages temporarily because system commit is high: Common system resources are almost fully consumed. Message Queuing will not operate properly until system resources are freed up.

Storage quota exceeded for MSMQ queue: A Message Queuing queue quota has been reached. To resolve this issue:

  • Process existing messages in the queue to reduce the outstanding message count below the queue quota threshold. Confirm that messages are being processed at a higher rate than they are being queued. This may require additional hardware or changes to solution architecture.
  • You may also increase the specific queue quota.

To avoid this problem in the future, the sending application should request NACK from the computer to which it is sending messages. If a NACK is returned to the sending application and it indicates that the quota for the destination queue or computer has been reached, the sending application can either stop sending messages or offload the messages to another destination. Nacks and Acks are requested programmatically by the sender.

Service Initializing

This monitor returns the following events:

  • The Message Queuing service cannot start. The local RPC interface cannot be initialized;
  • The Message Queuing service cannot start because a queue is in an inconsistent state;
  • The service cannot start due to its failure to connect to its device driver;
  • A multicast listener initialization failed. The file may be corrupted;
  • The Message Queuing service stopped.

Event ID: 2061, 2084, 2148, 2154, 2163.

The local RPC interface cannot be initialized: The RPC endpoint could not be initialized. Ensure that no other processes are using the RPC endpoint with the name "Qmsvc."

The Message Queuing service cannot start because a queue is in an inconsistent state: Verify that the MSMQ Service is installed and running.

The service cannot start due to its failure to connect to its device driver: There is a problem with the Mqac.sys file. This file is located in the System32 folder under the Windows directory (usually C:\Windows). Make sure that the Mqac.sys file is present in the System32 folder. If the file is there, try restarting the MSMQ Service by performing the following procedures.

A multicast listener initialization failed: Mulitcast listener failed on one or more files. This may indicate that the store is corrupt. Try deleting the queues (through the file system or the directory service) for which such errors are generated, and then restart Message Queuing. Before you delete a queue, make sure that the queue is empty and that Message Queuing is offline.

The Message Queuing service stopped: The MSMQ Service may have stopped for several reasons. Check your event logs for any earlier failures during service startup. Fix those issues, and then restart the MSMQ Service.

Message Events

This monitor returns the following events:

  • Message Queuing could not authenticate a message sent to queue. The message was rejected because the queue only accepts authenticated messages;
  • Message Queuing failed to verify digital signature of a message sent to queue. The message was rejected;
  • The message could not be moved to deadletter queue. The message was moved to the system transactional deadletter queue;
  • The message could not be moved to deadletter queue. The deadletter queue is authenticated and the authenticity of the message could not be verified;
  • The message could not be moved to deadletter queue. Deadletter queues should not require privacy of messages;
  • The message could not be moved to deadletter queue. The deadletter queue needs to be transactional.

Event ID: 2195, 2196, 2253, 2254, 2255, 2256.

Message Queuing could not authenticate a message sent to queue: Because the queue accepts only authenticated messages, messages that are sent to the queue must be authenticated and signed with a certificate, which is registered in ADDS.

Message Queuing failed to verify digital signature of a message sent to queue: Confirm that the Message Queuing application is using a strong hash function and that it has a valid user certificate.

The message could not be moved to deadletter queue. The message was moved to the system transactional dead letter queue: A deadletter queue must exist. It also needs appropriate permissions.

The deadletter queue is authenticated and the authenticity of the message could not be verified: The deadletter queue that is mentioned in the error is authenticated, but the MSMQ Service could not confirm the authenticity of the message in the deadletter queue. To resolve this issue, do one of the following:

  • Confirm that the computer that sent the message is properly signing its authenticated messages.
  • Allow the deadletter queue to receive nonauthenticated messages.

Deadletter queues should not require privacy of messages: To allow messages to enter a deadletter queue, set the privacy level of the specified deadletter queue to None or Optional, or ensure that the messages that are being sent to the queue are encrypted.

The deadletter queue needs to be transactional: The deadletter queue that is specified in the event is nontransactional, but there are transactional messages trying to go there. To allow messages to go to the deadletter queue, recreate the deadletter queue as a transactional queue, or if you have control over the messages that are being sent to the queue, ensure that the messages are nontransactional. To recreate the deadletter queue as a transactional queue, create a new transactional queue with all the same properties as the original deadletter queue, but make the new queue transactional.

Queue Events

This monitor returns the following events:

  • The Message Queuing service deleted the message. The message cannot be restored because the queue does not exist;
  • The Message Queuing registry values cannot be read. The registry may be corrupt;
  • The properties of the queue cannot be set. Copying the queue file to the temporary file returned an error;
  • The properties of the queue cannot be set. Replacing the queue file with the temporary file returned an error.

Event ID: 2043, 2097, 2141, 2142.

The Message Queuing service deleted message. The message cannot be restored because the queue does not exist: The event indicates that the message refers to a queue that no longer exists. This might be due to the message pointing to the wrong queue or the absence of the specified queue.

The Message Queuing registry values cannot be read: The MSMQ Service cannot read configuration information from the registry. This may indicate either that the registry is corrupted or that Message Queuing was not installed properly. Delete Message Queuing registry values and reinstall Message Queuing.

Copying the queue file to the temporary file returned error: Internally, the MSMQ Service tries to make a temporary copy of the queue file before changing the queue properties, or it tries to copy the new queue permissions file over the old permissions file. If creation of the temporary file fails, this might indicate insufficient disk space, permission problems, or file system errors. Make sure that the disk is not full and that the MSMQ Service can access the Message Queuing storage directory.

Replacing the queue file with the temporary file returned error: Internally, the MSMQ Service tries to make a temporary copy of the queue file before changing the queue properties, or it tries to copy the new queue permissions file over the old permissions file. If creation of the temporary file fails, this might indicate insufficient disk space, permission problems, or file system errors. Make sure that the disk is not full and that the MSMQ Service can access the Message Queuing storage directory.

Authorization Events

This monitor returns the following events:

  • The Message Queuing service rejects incoming messages when it is unable to check whether the sender is allowed access to the queue for sending messages;
  • Message Queuing could not complete SSL negotiation with the remote computer;
  • Message Queuing could not validate server certificate in HTTPS scenario because the certificate was found in disallowed store;
  • Message Queuing could not establish SSL connection with the recipient computer because a trust chain from the server certificate to a trusted Certificate Authority certificate could not be established;
  • Message Queuing could not establish SSL connection with the recipient computer because the computer name specified in the HTTP queue format name does not match the name of the recipient server certificate.

Event ID: 2177, 2190, 2191, 2192, 2193.

The Message Queuing service rejects incoming messages when it is unable to check whether the sender is allowed access to the queue for sending messages: Add only the computer accounts that need access to the Windows Authorization Access Group.

Message Queuing could not complete SSL negotiation with the remote computer: This issue may have one of the following causes:

  • The server certificate may not be installed properly.
  • The remote computer may not be listening with HTTPS on port 443 (SSL). You can use the procedure "Determine if the computer is listening on port 443" to determine if this is the issue.
  • The Windows Firewall may be blocking communication over port 443. You can use the procedure "Ensure that Windows Firewall is allowing communication over port 443" to determine if this is the issue.

Message Queuing could not validate server certificate in HTTPS scenario because the certificate was found in disallowed store: The certificate may have been revoked or otherwise disallowed. Therefore, it could not be trusted.

Message Queuing could not establish SSL connection with the recipient computer because a trust chain from the server certificate to a trusted Certificate Authority certificate could not be established: Reestablish the trust chain.

Message Queuing could not establish SSL connection with the recipient computer because the computer name specified in the HTTP queue format name does not match the name of the recipient server certificate: Although the certificate chain from the server was verified, the computer name that is specified in the queue format is different from the name of the recipient in the server certificate. Make sure that the computer name in the server certificate is correct.