Strange things happen all the time but sometimes nobody can explain them why they happen. A relatively new SCOM 2012 installation was functioning well until a certain moment. I would like to blog about this behavior it might help somebody to get the same or similar problem solved.
As I mentioned before this new and perfectly setup SCOM 2012 infrastructure started to log an event id 31557 saying that the management server action account does not have permission to access the Data Warehouse.
MVP Marcel Zehner (http://blog.scsmfaq.ch) provided me with this delicate case, thanks Marcel!
In the event log it looked like this:
1) The first check was to verify that all permissions for the management server action account are set correctly. A check of the SQL Server logs did not show any wrong login attempts at all either.
2) Next we will check the data writer account configured in the Data Warehouse. To find this information you could run the following query against the OperationsManagerDW database:
Select * from ManagementGroup
As we can see another account is configured for the data writer account, which is correct. If another account is being used as configured in the WriterLoginName in the query result above, the management server will block the transaction first before sending the request to the SQL Server database.
3) If we look more closely at the error in the event it says svc-scom-action account is used to access the Data Warehouse which is the management server action account.
Therefore, we are going to check the management server and its Run As accounts.
4) Go to Administration/Run As Configuration/Accounts and click each of the two accounts Data Warehouse Action Account and Data Warehouse Report Deployment Account.
By checking these accounts Data Warehouse Action Account and Data Warehouse Report Deployment Account both seem configured properly, as you can see here…
5) Next we are going to check the Run As profiles. Go to Administration/Run As Configuration/Profiles and again we are looking at the Data Warehouse Account and Data Warehouse Report Deployment Account profiles.
By checking these two profiles we found the problem.
Data Warehouse Account profile list was empty…
…and also the Data Warehouse Report Deployment Account profile list was empty…
This means no Run As account was associated anymore with each of its corresponding Run As profile. Therefore, the default action account had been used and this was in my case svc-scom-action.
Lessons learned – never ever assume anything. Check always your settings twice!