Why is syspolicy_purge_history failing?
If you are running SQL Server 2008 you might know this job. It’s created when you install SQL Server and maintains some of the policy subsystem. Some if you might have experienced errors with this job. Especially when you are running on a cluster. Some information on this error can be found in the following KB article: http://support.microsoft.com/kb/955726.
Recently I came across a failing syspolicy job on a cluster. Immediately I thought the KB article applied here, especially when the client mentioned the job had never succeeded. But this was not the case. The error was different and over time the error changed as well. Step 3, the PowerShell command, was failing with an “cannot create process because file is in use.”.
So, that’s all, no mentioning what file whatsoever. I took the statement from the jobstep and ran it in a SQLPS sessions. That worked. So, nothing wrong with PowerShell (how could it be?).
Next step was to identify what file was in use. For this I used Process Monitor from SysInternals, available on TechNet. I started Process Monitor and started the job waiting for it to fail. I then took the output from Process Monitor and filtered it on the SQLAGENT process, searching for clues. And I found this:
10:29:39.4536352 AM SQLAGENT.EXE 5620 QueryOpen C:\Program SUCCESS CreationTime: 5/21/2011 5:12:59 PM, LastAccessTime: 5/21/2011 5:12:59 PM, LastWriteTime: 5/21/2011 5:12:59 PM, ChangeTime: 5/29/2011 8:10:54 AM, AllocationSize: 0, EndOfFile: 0, FileAttributes: A 10:29:39.4539617 AM SQLAGENT.EXE 5620 QueryOpen C:\Program SUCCESS CreationTime: 5/21/2011 5:12:59 PM, LastAccessTime: 5/21/2011 5:12:59 PM, LastWriteTime: 5/21/2011 5:12:59 PM, ChangeTime: 5/29/2011 8:10:54 AM, AllocationSize: 0, EndOfFile: 0, FileAttributes: A 10:29:39.4541972 AM SQLAGENT.EXE 5620 CreateFile C:\Program SHARING VIOLATION Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a 10:29:39.4544379 AM SQLAGENT.EXE 5620 CreateFile C:\Program SHARING VIOLATION Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a 10:29:39.4548114 AM SQLAGENT.EXE 5620 WriteFile F:\MSSQL10_50.KCCSQL\MSSQL\Log\SQLAGENT.OUT SUCCESS Offset: 10,784, Length: 464
So, the Agent was trying to get a handle on a file named C:\Program but couldn’t. I checked the file system and there was indeed a file Program in C:. Actually, Windows already warned about this file when I logged onto the machine. The file was 0KB in size and created some time ago. Next step was to identify the process that was creating this file. Since the file was in use according to the Agent it should be easy to get the process using another SysInterals tool, Process Explorer. I opened Process Explorer and searched for C:\Program. It returned the guilty program for me.
Next step was to find out why this program created this file. In this case it turned out someone forgot to put double quotes around a value in a configuration file. After I corrected this and restarted the service I was able to delete the file Program. I went back to the Agent and started the syspolicy job. This time with success.
Again, the SysInterals tools prove to be of great value when searching for problems beyond the obvious. Although it’s questionable why a program would create a file named Program in this folder but it shouldn’t fail the job.




