Unable to expand message: SQL Server is unable to collect events due to insufficient permissions
I just noticed a Warning Alert in MOM Operator Console and it says:
DESCRIPTION
Unable to expand message 17055 [-1073724769] 18265 Log backed up: Database: SADAD_AX30_SP3_Live, creation date(time): 2005/02/01(12:50:12), first LSN: 3655:705:1, last LSN: 3655:765:1, number of dump devices: 1, device information: (FILE=1, TYPE=DISK: {'E:\SQL2000\MSSQL\...\....200604301345.TRN'}). Name: SQL Server is unable to collect events due to insufficient permissions
and as the rule says 'SQL Server is unable to collect events due to insufficient permissions' (Microsoft SQL Server\SQL Server 2000\SQL Server 2000 Event Collection).
CAUSE
Then I started to trace the reason for this event and this was due to a change in MOM Service Account. Previously, MOM service was running under NT AUTHORITY\SYSTEM aka LOCAL SYSTEM ACCOUNT context and it has all the required permission to SQL installation (MSSQL directory). When I changed this to MOM ACTION ACCOUNT using 'Update Agent Settings' in the administrator console, it started to run under NT AUTHORITY\NetworkService context with these warning alerts.
WORKAROUND
I found that AUTHORITY\NetworkService is not having enough permission on SQL installation (MSSQL directory). So, to troubleshoot this error, I have added NT AUTHORITY\NetworkService the permission to Read & Execute on SQL installation (MSSQL directory - %programfiles%\Microsoft SQL Server\) directories. Problem solved!