I have been debugging this issue for quite a while:

    MP chuggs along, no problems.   Then for an unknown reason,  ccmexec starts crashing, and crashing, MP reinstalls and crashing.  After a while the MP settles down and runs w/o errors for a while.  Then the cycle will start again.  Sometimes 10 minutes... other times a couple hours.  The last time the MP was quiet for a week.

SMSExec continues without problems.

The Eventlog shows:

Log Name:      Application
Source:        Application Error
Date:          5/17/2013 10:31:54 AM
Event ID:      1000
Task Category: (100)
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      MP Description:
Faulting application name: CcmExec.exe, version: 4.0.6487.2000, time stamp: 0x4ab33e4d
Faulting module name: KERNELBASE.dll, version: 6.1.7601.18015, time stamp: 0x50b83c8a
Exception code: 0xe06d7363
Fault offset: 0x0000c41f
Faulting process id: 0x89c
Faulting application start time: 0x01ce530aa23fe12f
Faulting application path: G:\SMS_CCM\CcmExec.exe
Faulting module path: C:\Windows\syswow64\KERNELBASE.dll
Report Id: 84b72066-befe-11e2-83e3-0022190a0ffb
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Application Error" />
    <EventID Qualifiers="0">1000</EventID>
    <Level>2</Level>
    <Task>100</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2013-05-17T14:31:54.000000000Z" />
    <EventRecordID>110708</EventRecordID>
    <Channel>Application</Channel>
    <Computer>MP</Computer>
    <Security />
  </System>
  <EventData>
    <Data>CcmExec.exe</Data>
    <Data>4.0.6487.2000</Data>
    <Data>4ab33e4d</Data>
    <Data>KERNELBASE.dll</Data>
    <Data>6.1.7601.18015</Data>
    <Data>50b83c8a</Data>
    <Data>e06d7363</Data>
    <Data>0000c41f</Data>
    <Data>89c</Data>
    <Data>01ce530aa23fe12f</Data>
    <Data>G:\SMS_CCM\CcmExec.exe</Data>
    <Data>C:\Windows\syswow64\KERNELBASE.dll</Data>
    <Data>84b72066-befe-11e2-83e3-0022190a0ffb</Data>
  </EventData>
</Event>

the MP_Framework.log fills up with error:

MPDB ERROR - CONNECTION PARAMETERS
SQL Server Name     : SQL
SQL Database Name   : SMS_

Integrated Auth     : True

MPDB ERROR - EXTENDED INFORMATION
MPDB Method         : GetNextRow()
MPDB Method HRESULT : 0x80004005
Error Description   : null
OLEDB IID           : null
ProgID              : null

MPDB ERROR - INFORMATION FROM DRIVER
null 5/17/2013 1:41:26 PM 2608 (0x0A30)

  The symptoms are very similar to the perf counters & ntdll.dll issue (http://support.microsoft.com/kb/2724939) except the faulting dll is KERNELBASE.DLL.  I applied the patch, but no joy.  I have uninstalled/re-installed the MP, moved the MP to different boxes, even tried a 2008 OS.  Still no luck.

Also, I excluded ccmexec & kernelbase.dll from antivirus, no change.

  The Servers are running x64 Windows Server R2 SP1, SCCM 2007 R3.

   Has anyone seen this before?

   Any help would be greatly appreciated.

  Thanks,

      Bob

I'd recommend that you call Microsoft CSS directly.

If you are running McAfee or any other AV software, make sure that you have followed the McAfee kb and excluded ccmexec.exe from being scanned.

Check the most recent Kernel patches and see if you need to remove them, given the time frame from when the problem started and when the patch was installed.

      I excluded ccmexec.exe as well as KERNELBASE.DLL on Friday. There is no client installed (MP only) so that should eliminate Sinv or Metering triggering any intrusion detection. Ccmexec started crashing Monday again.

The most frustrating thing is the randomness of the issue. It may go 10 minutes between crashes or a day or two. I am starting to think that there may be a client or multiple clients sending malformed data to the MP which causes the crash.

I have enabled debug logging to hopefully find some clues.

  I am looking into this now.

   I have a 32bit Server 2008 unpatched server standing by to eliminate any 64bit and R2.

  The issue may be solved with the following patch:

http://support.microsoft.com/kb/2823071

      

    So far so good.

   Thanks,

      Bob