SMS_STATE_SYSTEM Critical, loads of errors :(

[CraigSCCM]

Morning guys, I've recently upgraded SCCM from R2 to R2 SP1

 

Very smooth upgrade actually (first time it's gone well with no draw backs) except.....

 

After a couple of days, I noticed the Component Status for SMS_STATE_SYSTEM was just on a critical state, with hundreds and hundreds of the below errors

 

The State System message file processing processed one or more files that contained errors or invalid data. Review the statesys.log file for further details.

The State System message file processing could not process file 'N_hn1meweb.SMX' and moved it to the corrupt directory. Review the statesys.log file for further details.

The State System message file processing could not process file 'N_bh01fr1u.SMX' and moved it to the corrupt directory. Review the statesys.log file for further details.

The State System message file processing processed one or more files that contained errors or invalid data. Review the statesys.log file for further details.

The State System message file processing could not process file 'N_yuz1deaw.SMX' and moved it to the corrupt directory. Review the statesys.log file for further details.

The State System message file processing could not process file 'N_f5o4kgn1.SMX' and moved it to the corrupt directory. Review the statesys.log file for further details.

The State System message file processing processed one or more files that contained errors or invalid data. Review the statesys.log file for further details.

The State System message file processing could not process file 'N_wuiyugtq.SMX' and moved it to the corrupt directory. Review the statesys.log file for further details.

The State System message file processing could not process file 'N_svg0wvy0.SMX' and moved it to the corrupt directory. Review the statesys.log file for further details.

I've attached the StateSyslog as I'm completely at a dead end with this, I can't find anything on Google that relates to this either

I'm on Windows Server 2012 R2, The Server hasn't been patched recently and it was fine before the upgrade, I saw a few posts regarding dot.net removing the KB updates

1. KB2835393, KB2804576 or KB2840628 for Windows 2012. These are .NET Framework 4.0 patches and Windows 2012 comes with .NET Framework 4.5.
   
   KB2833958 and KB2840632

None of those patches are on my server

Any help would be greatly appreciated

StateSysLog.txt

[Bumbi85]

I can report that we have the same errors, it startade November 3rd 02:59, before that no problems what so ever.

We have SCCM 2012 R2 SP1 CU1, we installed CU1 September 25 so we have had that installed for some time. And installed hotfix KB3081699 on Oktober 12 to fix a issue with IOS 9 Compliance.

 

So my guess is that your update isnt the problem.

If you check the .smx files is it your mobile devices that are sending the file? Or normal computers also?

[CraigSCCM]

How would I know if the .smx files are mobile or computer related?

[Bumbi85]

If you open the .smx file in notepad. Or make a copy of it and add xml at the end you can read it more easily in internet explorer.

There is a section were the hostname is presented.

 

Go to Microsoft Configuration Manager folder then inboxes\auth\statesys.box\corrupt

You will see that it puts the files there.

 

Take the latest message and copy it to another location and add xml then open it in IE or any other browser, otherwise you can open the .smx in notepad directly.

[CraigSCCM]

Yep, your right mate, it's the users Windows Phones

 

 

WindowsPhone_11/2/2015_9:20 AM</NetBIOSName><CodePage>437</CodePage><SystemDefaultLCID>1033</SystemDefaultLCID><Priority>5</Priority></Machine></Identification><ReportDetails><ReportContent>State Message Data</ReportContent><ReportType>Full</ReportType><Date>20151105113737.513000+000</Date><Version>1.0</Version><Format>1.0</Format></ReportDetails></ReportHeader><ReportBody><StateMessage MessageTime="20151105113737.513000+000" SerialNumber="1"><Topic ID="0" Type="8001" IDType="0" User="SYSTEM" /><State ID="0" Criticality="0" /><UserParameters Flags="0" Count="0" /></StateMessage></ReportBody></Report>

 

 

 

How do I fix this issue

[Bumbi85]

Sadly i have no idea at the moment as i cant find any viable solution other then contacting microsoft and registering a case.

They will most likely classify this as a bugg and then we dont have to pay for their time.

 

The active phones we have on the server right now are android phones, and iphones. So it seem to affect all mobile devices.

Do you use intune integration as well? We use Intune for mobile devices.

[CraigSCCM]

Yeah we have the intune connector set up too, so we don't use the portal, everything is managed through CM12

 

Logging a call with Microsoft is the only way I can see this getting fixed, unless CM release a CU in the next few days? lol

 

I don't understand though, everyone else seems to upgrade from R2 to SP1 fine... Unless they are experiencing the same issue and haven't noticed...if not ...why us?

[Bumbi85]

From what i heard i a new CU will be released soon.

 

I will most likely register a case with Microsoft to get this fixed.

 

My personal opinion is that this isnt a problem with the upgrade to r2 sp1, but rather a problem with the intune service.

As the phones all of a sudden are sending messages to the MP with a type that isnt recognised.

 

We installed the server in june with r2 sp1, and in sepember applied CU1. So we have had the server running for a while(didnt add mobile devices until mid october), and the hotfix we installed after that was installed about 1 month ago.

So i have a hard time seeing that there was a problem with any update, but more a problem with the Intune service sending a new type that the sccm doesnt know about

 

 

Correct me if i am wrong in any way

[CraigSCCM]

I fully agree with you, my clients SCCM server was always green with no Component or Site issue's, since the Upgrade to SP1 that's when it's started happening - Im not 100% how In-tune gets updated? Does it auto update it'self?

 

I've just seen this on the server .... not sure if it;s related

 

 

Waiting for update

 

just found this... https://support.microsoft.com/en-us/kb/3106034

[Bumbi85]

Im thinking more in the line that the mobile units report via intune app to intune cloud services, which then relays the information to the SCCM:en. So if they made a update to the intune client or cloud service.

 

On our server we have the iOS 9 Extension which we have enabled (you could require at hotfix for this if you enable it as we hade problem with Configuration Items after we enabled that, and we have the Conditional Access Extensions(which we dont use). The reason we dont have Windows Phone is that the customer doesnt use them so we havent enabled enrollment for that type of phone

 

Conditional Access Extension has to do with exchange online (http://blogs.technet.com/b/configmgrteam/archive/2015/03/12/conditional-access-for-exchange-online.aspx) and it only adds 2 new features as the others are already implemented in r2 sp1:

• Minimum OS compliance rule

• Maximim OS compliance rule