Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 1101 Source: SNMP

The SNMP Service is ignoring extension agent key SOFTWARE\Microsoft\<software>\CurrentVersion because it is missing or misconfigured.
From a newsgroup post: "Whenever I've received this type error on my NT Servers, re-installing the product that installed the SNMP sub-agent fixed it. I can sometimes just fix the Registry entries to point to the correct .DLL's (looking at another for comparison)".

Software: MSSQLServer. SNMP can only be used to monitor the default instance of SQL Server. Therefore, if you do not install a default SQL Server 2000 instance (you only install a named instance), the installer does not create the proper registry settings for the SQL Server SNMP component. See ME279870 for more details. This article can be used to look into similar issues for other software.
I had this error on a Windows 2003 server: The SNMP Service is ignoring extension agent key SOFTWARE\ComputerAssociates\BrightStor ARCserve Backup\Base\SNMP because it is missing or misconfigured.

We had upgraded Brightstor to Version 12. The upgrade changed the pathname in the SOFTWARE key. Deleting the invalid entries in the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SNMP\Parameters\ExtensionAgents got rid of the warnings.
The Simple Network Management Protocol (SNMP) service cannot load an extension agent because the extension agent is no longer installed on the computer or is incorrectly configured in the registry key. See MSW2KDB for additional information about this event.
See ME888798 for details on this event. This article also describes how to troubleshoot SNMP service startup issues.
For Compaq management software, the error related to SNMP is "The SNMP Service is ignoring extension agent key System\CurrentControlSet\Services\CqMgServ\CPQSNMP". Go to “HKLM\System\CCS\Services\SNMP\Parameters\Extension Agents”, and delete those mentioned in the warnings. There is no need to renumber anything, since these extension agents do not have a number to begin with. Do not delete those that point to “CpqNicMgmt”, since that will result in NIC Agents event 258. Now restart SNMP (which automatically restarts the Compaq NIC Agents service). This will solve NIC Agents event 271 too. You should get informational events 277 and 1001 now, to confirm everything works as it should.

I got that warning after I had removed QoS services (ACS). Apparently removing QoS didn't remove the value in SNMP agents list under “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SNMP\Parameters\ExtensionAgents”. All I did was to delete the numbered value for “SOFTWARE\Microsoft\ACS\CurrentVersion” in the list above and renumber all subsequent ones.
Software: compaqCommonClusterAgent or CompaqClusterNTExtensionAgent - This occurs because the Common Cluster sub-agents, installed by the Compaq Foundation Agents, are only partially installed. These Event Viewer messages will appear each time Simple Network Management Protocol (SNMP) is started.

Do not install the Foundation Agents during the Compaq Support Paq for Windows 2000 installation. Install Microsoft Cluster Services first, then the Foundation Agents. If the Foundation Agents have already been installed, install Microsoft Cluster Services then re-install the Foundation Agents. This will ensure that the Foundation Agents are installed correctly and the Common Cluster sub-agents complete the installation process. See Compaq customer advisory link below.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.