Event Log: Interface Dot11Radio0, parent lost: Had to lower data rate

Hi,
AIR-AP1242
Firmware: 12.3(8)JEB
AP -> WGB mobil station
The event log from WGB have often this warning:
%DOT!!-4-UPLINK_DOWN: Interface Dot11Radio0, parent lost: Had to lower data rate
Way?...
It is the first installation with this description.

Is the client able to associate to the AP and transfer data. This error message genrally indicate a weak signal strength or a bad link. Move the client to a different location and check if that works.

Similar Messages

Interface Dot11Radio0, cannot associate: No matching SSID

Hi all, I have a problem with a P2P Bridge with a couple of Aironet 1242AG.
Sometimes this Bridge goes down, and if I change Channel, it goes up.
When Bridge is down I can see this log in NoRoot:
*Apr 23 04:12:20.002: %DOT11-4-UPLINK_ESTABLISHED: Interface Dot11Radio0, Associated To AP XXXX-Root 0014.1b60.9230 [None WPA PSK]
*Apr 23 04:12:20.003: %LINK-3-UPDOWN: Interface Dot11Radio0, changed state to up
*Apr 23 04:12:20.008: %DOT11-4-UPLINK_DOWN: Interface Dot11Radio0, parent lost: authenticate response status (12) denied
*Apr 23 04:12:20.069: %DOT11-4-UPLINK_ESTABLISHED: Interface Dot11Radio0, Associated To AP XXXX-Root 0014.1b60.9230 [None WPA PSK]
*Apr 23 04:12:20.079: %DOT11-4-UPLINK_DOWN: Interface Dot11Radio0, parent lost: Received deauthenticate (2) not valid
*Apr 23 04:12:20.081: %LINK-3-UPDOWN: Interface Dot11Radio0, changed state to down
*Apr 23 04:12:31.049: %DOT11-4-CANT_ASSOC: Interface Dot11Radio0, cannot associate: No matching SSID
*Apr 23 04:13:32.392: %DOT11-4-CANT_ASSOC: Interface Dot11Radio0, cannot associate: Rcvd response from 0014.1b60.9230 channel 6 3669
*Apr 23 04:18:46.404: %DOT11-4-CANT_ASSOC: Interface Dot11Radio0, cannot associate: Authenticating
*Apr 23 04:30:18.666: %DOT11-4-UPLINK_ESTABLISHED: Interface Dot11Radio0, Associated To AP XXXX-Root 0014.1b60.9230 [None WPA PSK]
*Apr 23 04:30:18.666: %LINK-3-UPDOWN: Interface Dot11Radio0, changed state to up
I can see this log in Root:
7w4d: %DOT11-7-AUTH_FAILED: Station 001c.f663.1110 Authentication failed
7w4d: %DOT11-4-MAXRETRIES: Packet to client 001c.f663.1110 reached max retries, removing the client
7w4d: Client 001c.f663.1110 failed: reached maximum retries
7w4d: %DOT11-7-AUTH_FAILED: Station 001c.f663.1110 Authentication failed
I don't understand "No matching SSID" and authentication error, the Wpa-psk and Ssid are the same.
Do you have idea? I suppose a RF problem.
Regards

Hi,
The "no matching SSID" appears when your non-root bridge tries to associate to a given SSID and does not detect any parent offering that SSID...
This seems to indicate (IMHO) a RF problem... you may want to try to monitor the link quality between your root and non root. If the signal is lots, then you would typically get this no matching SSID message while the non-root tries to reconnect without success.
Which code are you running on these APs?
Jerome

Event 26330 "Database connectivity is lost"

Hi there,
at our customer we're using SCOM to monitor the productive SCSM Environments for alerts.
We had now couple of times the alert with ID 26330 and Source OpsMgr SDK Service. Here are some more details of the Event from the OperationsManager Log
The System Center Data Access service lost database connectivity.
Database name: ServiceManager
Server instance name: S000243\SCSMINSTANCE
Exception message: Transaction (Process ID 55) was deadlocked on lock resources with another process and has been chosen as the deadlock victim. Rerun the transaction.
In most cases the Connection was re-established again within seconds. So my colleague and I started wondering why this alert is then still active. In the monitor details he checked what the healthy state conditions are so that this kind of alert gets auto-resolved
in SCOM. The monitor is apparently looking for another Event with ID 26331 to become healthy again. The weird thing though is that we never had such an Event logged yet, even if we forcely restart the Data Access Service and we can ensure that the Connection
is fine again this Event ID is not logged.
So after some research in the Internet we stumble upon this blog post:
http://blopon.blogspot.ch/2007/10/sdk-service-event-id-26330-is-raised.html
That's exactly what we're experiencing as well. He's saying this was a bug in SCOM 2007 and is most likely fixed by now. But we all know that SCSM is built upon the (old?) SCOM Framework. So is it possible that this bug has been fixed in SCOM 2007 but never
in SCSM?
We're running currently SCSM 2012 SP1 CU2 (about to updated to CU6 soon).
Had someone of you ever experienced the same Events and knows how to fix it properly? Just closing the alert and the Incident is just stalling the Event from happening again :)
Thanks
Alex

It is very possible. the Service Manager 2012 SDK is based on the 2010 SDK, which was itself based on the Ops Manager 2007 SDK. I can't find any documentation to this effect right now, but i would be more then willing to believe it was based on the RTM,
rather then a later Service Pack or CU.
This seems like an ideal time to test the new product team's suggestions on
recent LyncUp calls that https://connect.microsoft.com/WindowsServer/Feedback is a vital and open point of contact for issues and concerns. I'm personally skeptical of this claim,
given that (at the time of this post) there are three issues, one has been summarily dismissed, and the other two have no comment, but i haven't had anything to submit since I've been working with other system center components recently. If their claims hold
up, then this would be the perfect case for them to prove their new commitment beyond doubt, since this is an easily reproducible, seemingly easily diagnose-able, and possibly easily repairable fault.
I encourage you to throw this up there, with as much documentation as you can. i will watch with baited breath, to abuse an idiom, to see the response.

Event log WAN section

Since being on Infinity my event log (WAN section) shows occasional "PPP LCP Send Termination Request [User request]", followed by a reconnect sequence, that lasts about 20s when it is back up running normally. The Home Hub 5 light remains blue but the DSL uptime reset itself.
The other items that shows up, in this sequence, is " PPPoE is down after 8693 minutes uptime [Waiting for Underlying Connection (WAN Ethernet 2 - Down)]"
Is this some short term break of service on the fibre network and nothing to do with the handshake between the router and the DSLAM in the cabinet?

Same with the event log here. I've had a few wireless issues lately, and wanted to run the router a bit longer before rebooting.
EDIT: Restarted the HH3 tonight, and noticed from the event log that when booting it showed the correct time, but when it did a time sync check, it set the clock back one hour...
I also tried a couple of other time servers without success.

Interface Dot11Radio0, failed - cmd busy -Traceback.....

hi everyone,
please help me,
i have a problem with cisco autonomous:
Product/Model Number: AIR-AP1131AG-E-K9 System Software Filename: c1130-k9w7-tar.124-10b.JA System Software Version: 12.4(10b)JA Bootloader Version: 12.3(8)JEA
the problem is that my autonomous cisco AP sometimes crash and the only way to overcome this is to reset the AP...
i found the log --> "Interface Dot11Radio0, failed - cmd busy -Traceback= 0x5DBF8 0x4EDE70 0x4EDDD4 0x797684 0x7978E4 0x79BD64 0x4ECEC8 0x4ED2D0 0x4ED684 0x198850"
any comment on this problem....
please advice....
thanks

In enable mode, can you do a "dir flash:" and post the contents?
Do a "show ip interface brief" and make sure your radios are still up/up.

Data Access Service is unable to log audit events to the security event log

Hi,
Scenario: SCOM 2012 R2 UR4. (Windows 2012 R2)
Today SCOM have generated 4 alerts Data Access Service is unable to log audit events to the security event log.
The service account for "System Center Data Access Service" service is "Local System".
The users at "Generate security audits" are: LOCAL SERVICE and NETWORK SERVICE.
The question is:
how to resolve this alert? (Where look for to obtain more information to resolve this problem)
Thanks in advance!

Local system account is differet to local service account. Fo detail description of these accounts, pls. refer
LocalService Account
http://msdn.microsoft.com/en-us/library/windows/desktop/ms684188(v=vs.85).aspx
LocalSystem Account
http://msdn.microsoft.com/en-us/library/windows/desktop/ms684190(v=vs.85).aspx
Generate security audits which is under Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment of Group policy, determines which accounts can be used by a process to add entries to the security log. This user right
is defined in the Default Domain Controller Group Policy object (GPO) and in the local security policy of workstations and servers. By default, only the LocalSystem account has the privilege to be used by processes to generate security audits.
For identified the SDK account
1) open services.msc
2) From the system Center Data Access Service, you can see the SDK logon on as account
Roger

Event logging in Parent-Child packages

Hello,
I have a set of Parent-Child SSIS packages. A Parent package invokes a bunch of child packages via "Execute Package Tasks".
I have set up custom event logging (to a SQL table) inside both Parent and Child Packages' Event Handlers (OnPreExecute, OnPostExecute, OnError).
I noticed that when a Child Package raises an event, both the Child Package's event handler and the Parent Package's event handler get fired, thereby creating duplicate event logging entries.
So, as a quick work around, I disabled event handlers in Child packages hoping that the Parent Package's event handlers will catch and log all events nicely. However, when the Parent Package's event handler writes event details to the table, it uses the
Parent Package's System::PackageId, System::PackageGUID and System::PackageName rather than that of the Child Package that originally raised the event!. So, my event log table records all events as if they were raised by the Parent Package!
Is it possible to disbale event bubbling up from Child Packages to the Parent package?
What options do I have to fix this problem?
Thanks

I came across this same issue and found a pretty nice workaround.
In brief, I used a Stored Procedure to write the OnError to a Logging table. So when this stored procedure was called I checked if the error was already in the logging table, and if it was then no record would be inserted.
I was already using the logging method 2 detailed here with a few changes.
To the PackageLog table I added a ParemtExecutionID value, which was passed into the child package through a Parent Variable Configuration. So for the OnPreExecute handler, the Parent Package passed NULL for the ParemtExecutionID, but the Child Package passed
in the Variable.
In the ErrorLog table I added a SourceID column, which is the GUID of the task that generated the error. In the Parent/Child Package configuration, the SourceID is the same in both OnError handlers.
So then when the Parent OnError handler calls the stored procedure, it checks if an ErrorLog record exists for the ParentExecutionID and SourceID combination.
Below is the OnError Stored Procedure I used. (Note: In my example only the Child Package has a Queue ID value.)
Create Procedure [dbo].[usp_Integration_Log_Error] (
@Execution_Id UNIQUEIDENTIFIER,
@Queue_Id INTEGER = NULL,
@Source_Name VARCHAR(255),
@Source_Id UNIQUEIDENTIFIER,
@Err_Code INTEGER,
@Err_Message NVARCHAR(MAX)
AS
BEGIN
DECLARE @ErrorCount INTEGER
IF @Queue_Id IS NULL
SELECT
@ErrorCount = Count(*)
FROM
INTEGRATION_ERROR IE
INNER JOIN
INTEGRATION_LOG IL ON IE.EXECUTION_ID = IL.EXECUTION_ID
WHERE
IL.PARENT_EXECUTION_ID = @Execution_Id AND
IE.SOURCE_ID = @Source_Id
IF ISNULL(@ErrorCount,0) = 0
INSERT INTO
INTEGRATION_ERROR (
EXECUTION_ID,
QUEUE_ID,
SOURCE_NAME,
SOURCE_ID,
ERR_CODE,
ERR_MESSAGE
VALUES (
@Execution_Id,
@Queue_Id,
@Source_Name,
@Source_Id,
@Err_Code,
@Err_Message
END

Lost connection windows event log

I have found in the System Configuration a list of errors that I can have write to the windows event log, but it does not include the Lost Connection to agent/adapter error. I am now looking at looking at taking that system "Event" and attaching an action to it to write to the windows event log. Is this the best/most elegant way to go about it? Is there a way to include the machine location (as opposed to the agent name) in the event?
What I am attempting to do, and this is coming from a thread in the CPO section, is create a windows application event when a connection is lost. CPO would then be monitoring the TES server windows event log for such an event and perform some diagnostic and attempt to recover the agent.
Thanks for any help!

That is also an option that we have talked about, using snmp traps. Another option we've talked about it triggering a job which would then use the CPO web services to run a process.
But I like the idea better to have CPO also monitoring the connections and doing something about it. Using the Windows Event Log would allow us to do that.
In any case, there is also still the problem of grabbing the machine location.

Event log

I see that many people are having rebooting problems with the HH5.
I thought I had had only one, on the second day after installation, but apparently I had another in the second night.
Other than those mine has been fine so far.
On viewing my event log under the boot tab I see the following, which is a little odd as I only got the router on the 9th April and installed it on the 11th
Boots on 1st January??

Mike_D:
My HH5 had a couple of undated entries (1st Jan) on delivery - I assume it was turned on twice on the production line for QA purposes without being connected to a MSAN where it could bet NTP. The hubs are remotely managed by, or on behalf of BT. They appear to try to contact a control server periodically, after booting and at various points thereafter. Additionally, or as an integral part of these management events, the hub may be rebooted on command of BT or their suppliers/contractors This is normaly to aqpply new settings, update the firmware, or perform similar changes that require the hub software to bve rebooted.
As part of the boot process, the HH 5 will contact an NTP server to set it's time. If this is a warm boot (the power not having been disconnected) then the hub will record these events with the correct timestamp in the logs. If the reboot has been caused by a power faulire (especially ane extended power-off) or power-button press, then it's probable that the hub will lose it's concept of real time and record the boot event at or near 1st Jan, probably in the year 1970.
Infinite:
I'd be very careful mentioning " LC* T*rm. R*quests " - I've spent the whole night, through the night, reading these forums. Others and customers mentioning those phrases tend to get threads locked or banned by the mods.
I can only assume that untrained customers have been "interpreting" entries in the logs. 99% of the entries are normal, only when viewed in context do they mean anything. It seems that BT know they have a problem of some sort on the HH5 (repeated reboots, not affecting all customers), but the forums are full of people jumpingon the bandwagon saying "me too".
In response to mention of the dreaded phrase, the mods are even pointing people posting router logs that DON'T contain the phrase assuming they are troublemakers (!?) - I was pointed to a completely irrelevant locked thread last night myself :/
This was rather offensive as I was only providing the type of information that could help diagnose my problem and had nothing whatsoever to do with the other thread at all - it did not even contaion the phrase that gets threads locked.
I'm just waiting for the ban, with a very bad experience with the callcentre the last time I tried, my only hope is these forums.
If they wont work with me on it there's no hope - I run a fleet of 8 CWMP (TR069) servers myself
My symptoms summary - (seeing my post may have caused quite a few people to look at their logs):
Starting on the 15th around 0600-0700hrs, is a constant reboot every 31-34 minutes of a HH5.
In my case (not necessarily in other cases) before that entry was an openRG command that appeared to trigger the reboot cycles. My HH5 is, and has been from before the fault occured, in a default state other then the WiFi ESSIDs, on a perfect line with excellent SNR and sync rates.
I'm hoping to be contacted soon, before the relevant events in the log are overwritten by other rubbish caused by the reboots. Having read the locked threads and contacted other affected customers elsewhere, I don't have much hope I'm afraid. :/
I've used the "contact the mod" method as I was told and am awaiting futher contact after giving them my account number, contact number and email. Hopefully this will happen before the pertinent events are lost from my logs due to being overwritten - this is already happening on the TR069 syslog

%LINK-3-UPDOWN: Interface Dot11Radio0, changed state to down

Hello,
On a 4402 wireless controller (7.0.220.0) with LAP1242AG-E-K9 and LAP1252AG-E-K9 access points I receive lots of messages like this:
Dec 9 12:55:16 ap-a1 1466: AP:001a.2f58.d4d6: *Dec 9 11:55:16.174: %LINK-3-UPDOWN: Interface Dot11Radio0, changed state to down
Dec 9 12:55:17 ap-a1 1467: AP:001a.2f58.d4d6: *Dec 9 11:55:16.211: %LINK-3-UPDOWN: Interface Dot11Radio0, changed state to up
what is a little bit annoying, in particular for voice communications.
Is there a way to get more information from any logs or is there a similar problem discussion anywhere on this forum?
Thanks.

Hi Konstantin,
Unfortunately I do not think we have the radio status codes published, but I'll comment on them here:
Status 51: Reset on transmit completion. I'm not 100%, but I think this means the radio was supposed to reset (due to another reason) but had data to transmit, so it completed TX and then reset.
Status 52: Reset on completion of multicast packets. Similar to above, just with multicast traffic being queued up.
Status 37: Generic interface reset (up/down), often seen during bootup or on configuration changes.
Status 54: Radio interface was shutdown -- either configured by the user or perhaps part of the boot process.
Status 67: Reset after changing hostname on the AP. This also would occur on bootup once the config is loaded.
Status 71: Reset to update radio status on WLC. Also usually done upon AP joining the WLC after bootup.
-Pat

PC reboots at random, Kernel errors in event log

Hello my PC has been acting funny and rebooting ever since I got Windows 8.1
Here is the errors.
1 Critical Kernel-power event ID 41 2:01PM
2. Warning. Kernel-PnP event ID 219 2:01PM
The driver \Driver\WudfRd failed to load for the device SWD\WPDBUSENUM\_??_USBSTOR#Disk&Ven_Kingston&Prod_DataTraveler_2.0&Rev_1.00#0019E06B58C2SK870A0410D5&0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}.
Error. Schannel event ID 36888 11:28 AM
A fatal alert was generated and sent to the remote endpoint. This may result in termination of the connection. The TLS protocol defined fatal error code is 43. The Windows SChannel error state is 252.
I am quite sure the PSU is still good, never had an issue until I get windows 8.1 installed directly over windows 7.

I just froze on the desktop at 2:55 and windows was not responding box was open but I was unable to click or do any thing.
Here is that error in the event log.
Session "Pku2uLog" stopped due to the following error: 0xC0000188
Also the time stamp is incorrect, The time on the PC is 3:22 not 2:55, this error was just a few minutes ago.
Heres another one.
The maximum file size for session "Pku2uLog" has been reached. As a result, events might be lost (not logged) to file "C:\WINDOWS\Logs\Homegroup\pku2u.etl". The maximum files size is currently set to 5242880 bytes.

How to write to windows event logs from determinations-server under IIS

This is just an FYI technical bit of information I wish someone had shared with me before I started trying to write OPA errors to the windows event log... Most problems writing to the windows event log from log4net occur because of permissions. Some problems are because determinations-server does not have permissions to create some registry entries. Some problems cannot be resolved unless specific registry entry permissions are actually changed. We had very little consistency with the needed changes across our servers, but some combination of the following would always get the logging to the windows event log working.
To see log4net errors as log4net attempts to utilize the windows event log, temporarily add the following to the web.config:
<appSettings>

<add key="log4net.Internal.Debug" value="true"/>
</appSettings>
<system.diagnostics>
<trace autoflush="true">
<listeners>
<add
name="textWriterTraceListener"
type="System.Diagnostics.TextWriterTraceListener"
initializeData="logs/InfoDSLog.txt" />
</listeners>
</trace>
</system.diagnostics>
To add an appender for the windows event viewer, try the following in the log4net.xml:
<appender name="EventLogAppender" type="log4net.Appender.EventLogAppender" >
<param name="ApplicationName" value="OPA" />
<param name="LogName" value="OPA" />
<param name="Threshold" value="all" />
<layout type="log4net.Layout.PatternLayout">
<conversionPattern value="%date [%thread] %-5level %logger [%property{NDC}] - %message%newline" />
</layout>
<filter type="log4net.Filter.LevelRangeFilter">
<levelMin value="WARN" />
<levelMax value="FATAL" />
</filter>
</appender>
<root>
<level value="warn"/>
<appender-ref ref="EventLogAppender"/>
</root>
To put the OPA logs under the Application Event Log group, try this:
Create an event source under the Application event log in Registry Editor. To do this, follow these steps:
1.     Click Start, and then click Run.
2.     In the Open text box, type regedit.
3.     Locate the following registry subkey:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application
4.     Right-click the Application subkey, point to New, and then click Key.
5.     Type OPA for the key name.
6.     Close Registry Editor.
To put the OPA logs under a custom OPA Event Log group (as in the demo appender above), try this:
Create an event log in Registry Editor. To do this, follow these steps:
1.     Click Start, and then click Run.
2.     In the Open text box, type regedit.
3.     Locate the following registry subkey:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog
4.     Right-click the eventlog subkey, point to New, and then click Key.
5.     Type OPA for the key name.
6.     Right-click the new OPA key and add a new DWORD called "MaxSize" and set it to "1400000" which is about 20 Meg in order to keep the log file from getting too large.
7.     The next steps either help or sometimes cause an error, but you can try these next few steps... If you get an error about a source already existing, then you can delete the key.
8.     Right-click the OPA subkey, point to New, and then click Key.
9.     Type OPA for the key name.
10.     Close Registry Editor.
You might need to change permissions so OPA can write to the event log in Registry Editor. If you get permission errors, try following these steps:
1.     Click Start, and then click Run.
2.     In the Open text box, type regedit.
3.     Locate the following registry subkey:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog
4.     Right-click the EventLog key, select Permissions.
5.     In the dialog that pops up, click Add...
6.     Click Advanced...
7.     Click Locations... and select the current machine by name.
8.     Click Find Now
9.     Select both the Network user and IIS_IUSERS user and click OK and OK again. (We never did figure out which of those two users was the one that fixed our permission problem.)
10.     Change the Network user to have Full Control
11.     Click Apply and OK
To verify OPA Logging to the windows event logs from Determinations-Server:
Go to the IIS determinations-server application within Server Manager.
Under Manage Application -> Browse Application click the http link to pull up the local "Available Services" web page that show the wsdl endpoints.
Select the /determinations-server/server/soap.asmx?wsdl link
Go to the URL and remove the "?wsdl" from the end of the url and refresh. This will throw the following error into the logs:
ERROR Oracle.Determinations.Server.DSServlet [(null)] - Invalid get request: /determinations-server/server/soap.asmx
That error should show up in the windows event log, OR you can get a message explaining why security stopped you in "logs/InfoDSLog.txt" if you used the web.config settings from above.
http://msdn.microsoft.com/en-us/library/windows/desktop/aa363648(v=vs.85).aspx
Edited by: Paul Fowler on Feb 21, 2013 9:45 AM

Thanks for sharing this information Paul.

Questions about BT Home Hub 4A event log - WIFI c...

Hope someone can help please ?
I had BT inifinity installed 2 weeks ago with the HH 4 (type A) and everything has worked - connection found, no problem.
This week, my ipod touch was unable to join the network but the iphone 5, another ipod and a tablet could connect without a problem. The ipod touch managed to connect to another WIFI used at the property and my work wifi without a problem.
I thought it maybe the ipod touch as it was quite old but that doesn't make sense since it connects fine to other networks. I restored network settings and other options suggested by Apple but to no avail.
I have turned my attention to the Hub. My laptop (older than the ipod touch) gets the connection no problem along with the other devices. I went into the hub management page but I am not smart enough to decifer the event log so would like some help so I can fix this because I thought BT infinity was the better more reliable option?
The ipod touch Wifi IP address is 00:25:00:b7:35:f6.
On the event log, it shows STA before the address - but it shows STA before all the device IP addresses. Should I change this to DCHP ? or is this (Static ? alright)
The Lease on all the devices on the event log is set to 1440 min. (1 day) is that alright too, what does it mean ?
Do I have to keep renewing the lease ? How do I do that ? I read it can be set to 21 days ?
Going back to the IP address on the ipod it shows the Hostname as 00:25:00:B7:35:f6-2 this is different to the IP address with the -2. Could that be a cause of the unable to join network or is it because I attempted to recreate the network on the ipod so its the second version of that host name ?
Is there any setting I can change to fix this because I am concerned the same this will happen to the other devices and then the laptop....
What do I need to do to be able to get my ipod touch to connect to the BT network setting ?
I think its the hub 4A causing the 'block' on the ipod touch not the device and I think its maybe a matter of changing a setting - but then why was it all fine before when Infinity was first installed ?
Lastly my laptop (7 Years old) seems to be attached to the 5GHZ Wireless channel - is that alright ? The other more recent devices are on the 2.4ghz channel (except the ipod touch which isn't on any !!)
Is it alright to turn the hub on / off ? -I am resisting that because I don't want to make the situation worse.
Sorry but what does client disassociated mean and all the BLOCKS - do they relate to firewall ?
Please can you review the event log and my questions ?
Many thanks
angie 2601
The time frame is 3.55am 8/8/2013 - 7.16 am 8/8/2013
(Latest (7.16am) at the top
Message
07:16:39, 08AUG
(1224785.050000) Admin login successful by 192.168.1.64 on HTTP (1224766.610000) Admin login FAILED by 192.168.1.64 on HTTP (1224648.050000) New GUIsession from IP 192.168.1.64
(1224466.770000) Device disconnected: Hostname: Unknown-d8:dl:cb:ec:a6:fe
IP: 192.168.1.65 MAC: d8:d1:cb:ec:a6:fe
wlan1: STA d8:d1:cb:ec:a6:fe IEEE 802.11: Client disassociated
(1224362.750000) lease for IP 192.168.1.65 renewed by host Unknown d8:d1:cb:ec:a6:fe (MAC d8:d1:cb:ec:a6:fe).lease duration:1440 min (1224362.750000) Device connected: Hostname:Unknown-d8:d1:cb:ec:a6:feiP:
192.168.1.65 MAC:d8:dl:cb:ec:a6:fe lease time: 1440 min. link rate:90.0 Mbps
(1224362.690000) Lease requested
wlan1: STA d8:d1:cb:ec:a6:fe IEEE 802.11:Client associated
(1224241.150000) lease for IP 192.168.1.64 renewed by host FAMILY (MAC
00:13:02:de:6d:e6). Lease duration:1440 min
(1224241.150000) Device connected: Hostname: FAMii.Y IP:192.168.1.64 MAC:
00:13:02:de:6d:e6 Lease time: 1440 min. link rate: 54.0 Mbps
(1224241.090Cl00) Lease requested
wlan1TA 00:13:02:de:6d:e6 IEEE 802.11:Client associated
OUT: BLOCK [9] Packet invalid in connection (TCP
192.168.1.66:34905->31.13.72.38:443 on ppp1)
(1223644.770000) Device disconnected: Hostname: Unknown-d8:dl:cb:ec:a6:fe
IP: 192.168.1.65 MAC: d8:d1:cb:ec:a6:fe
wlanl: STA d8:d1:cb:ec:a6:-fe IEEE 802.11:CHent diSassociated
(1223489.390000) Lease for IP 192.168.1.65 renewed by host Unknown d8:d1:cb:ec:a6:fe (MAC d8:d1:cb:ec:a6:fe).lease duration:1440 min (1223489.380000) Device connected:Hostname:Unknown-d8:dl:cb:ec:a6:fe IP:
192.168.1.65 MAC: d kd1:cb ec:-a6-:fe Lease time: 1440 min. Link rare: 90.0 Mbps
(1223489.330000) Lease requested
wlan1: STA d8:d1:cb:ec:a6:fe IEEE 802.11: Client associated wlan1TA d8:d1:cb:ec:a6:fe IEEE 802.11: Client disasSociated
wlan1TA d8:d1:cb:ec:a6:fe IEEE 802.11:Client associated
OUT;BLOCK [9] Packet i valid in connection (TCP
192.168.1.66:34375->31.13.72.38:443 on pppl)
l'N':BLOCK [16-} Remote administration {ICMP type 8 code 0
117.1.42.94->86.182.228.205 on ppp1)
IN: BLOCK [9] Packet invalid in connection (TCP
31.13.72.33:443->86.182.228.205:44156 on ppp1) IN: BLOCK [9] Packet invalid in connection (TCP
31.13.72.33:443->86.182.228.205:36615 on ppp1)
OUT: BLOCK [9] Packet invalid in connection (TCP
192.1-68.1.68:49476->173.252.103.16:443 OR ppp1)
BLOCKED 5 more packets (because of Packet invalid in connection) OUT: BLOCK [9] Packet invalid in connection (TCP
192.168.1.68:49443->95.100.195.205:443 on ppp1)
OUT:BLOCK {9] PaCket invalid in connection (TCP
192.168.1.68:49438->95.100.194.217:443 on ppp1)
IN:BLOCK [9] Packet invalid in connection (TCP
95.100.194.217:443->86.182.228.205:49444 on ppp1)
(1222111.810000) Lease for IP 192.168.1.68 renewed by host Unknown-
70:56:81:46:bf:d9 (MAC 70:56:81:46:bf:d9).Lease duration:1440 min
(1222111.810000) Device connected:Hostname:Unknown-70:56:81:46:bf:d9 IP:,
192.168.1.68 MAC:70:56:8:t:46:bf:d9lease time:1440 min. Link rate:52.0 Mbps
(1222111.750000) Lease requested .-
wlanO: STA 70:56:81:46:bf:d9 IEEE 802.11: Client associated • (1222093.690000) Device dlsconn: Hostname:Unknown-
00:25:00:b7:35:f6-2 IP: 192.168. MAC: 00:25:00:b7:35:f6 wlanoTA 00:25:00:b7:35:f6 IEEE 802.11:Client disassociated
OUT:BLOCK [9] Packet invalid in connection (TCP
192.168.1.66-:43272->31.13.72.33:443 on ppp1)
221969.130000) lease for IP 192.168.1.67 renewed by host Unknown-
00:25:00:b7:35:f6-2 (MAC 00:25:00:b7:35:f6). lease duration:1440 min
(1221969.130000} Devicconnected: Hostname·:Unknowwoo·:25:00:b7 35:f6-2
IP: 192.168.1.67 MAC: 00:25:00:b7:35:f6 Lease time: 1440 min. Unk rate: 54.0
Mbps
(1221969.070000) Lease requested
wlanO: STA 00:25:00:b7:35:f6 IEEE 802.11:Client associated
(1220365.290000) Device disconnected: Hostname:Unknown-
00:25:00:b7:35:f6-2 IP: 192.168.1.67 MAC: 00:25:00:b7:35:f6 wlanOTA 00:25:00:b7:35:f6 IEEE 802.11:Client disassociated
(1220348.230000) Lease for IP 192.168.1.67 renewed by host Unlmown-
00:25:00:b7:35:f6-2 (MAC 00:25:00:b7:35:f6).lease duration: 1440 min
(1220348.230000) Device connected: Hostname:Unknown-00:25:00:b7:35:f6-2
IP: 192.168.1.67 MAC: 00:25:00:b7:35:f6 Lease time: 1440 min. Unk rate: 54.0
Mbps
(1220348.170000) lease requested
wlanOTA 00:25:00:b7:35:f6 IEEE 802.11:Client associated
IN: BLOCK f16] Remote administration (TCP
123.151.42.61:12233->86.182.228.205:8080 on ppp1) OUT: BLOCK [9] Packet invalid in connection (TCP
:t92.Hi8.1.66:53813->31.13.72.33:443 on ppp1)
OUT:BLOCK [9] Packet invalid in connection (TCP
192.168.1.66:43989->31.13.72.33:443 on ppp1)
IN: BLOCK [16] Remote administration (ICMP type 8 rode 0
2.7.251.109.227->86.182.228.205 on pppl)
(1216770.650000) Device disconnected:Hostname:Unknown-
00:25:00:b7:35:f6-2 IP: 192.168.1.67 MAC: 00:25:00:b7:35:f6
OUT:BLOCK [9j Packet invalid in connection (TCF
192.168.1.67:49180->74.125.136.109:993 on ppp1)
wlanOTA 00:25:00:b7:35:f6 IEEE 802.11:Client disassociated
(1216753.280000) Lease for IP 192.168.1.67 renewed by host Unknown-
00:25:00:b7:35:f6-2 (MAC 00:25:00:b7:35:f6). lease duration:1440 min
(1216753.270000) Device connected: Hostname: Unknown-00:25:00:b7:35:f6-2
IP: 192.168.1.67 MAC: 00:25.:00-:.b7.:35:f6 Lease time: 1440 min. Unk rate: 54.0
Mbps
(1216753.220000) lease requested
wlanO: STA 00:25:00:b7:35:f6 IEEE 802.11:Client assodat
OUT: BLOCK [9] Packet invalid in connection (TCP
192.168.1.66:55944->23.21.78.229:443 on ppp1)
OUT: BLOCK [9J Packet invafid in connection (TCP
192.168.1.66:34794->31.13.72.33:443 on ppp1)
OUT:BLOCK [9] Packet invalid in connection (TCP
192.168.1.66:41441->31.13.72.33:443 on ppp1)
{1213176.020000) Device disconnected:.Hostname:Unknown-
00:25:00:b7:35:f6-2 IP: 192.168.1.67 MAC:00:25:00:b7:35:f6 wlanO: STA 00:25:00:b7:35:f6 IEEE 802.11: Client disassociated
(1213158.410000) Lease for IP 192.168.1.67 renewed by host Unknown-
00:25:00:b7:35:f6-2 (MAC 00:25:00:b7:35:f6). lease duration:1440 min _./:\ (1213158.400000) Device connected:Hostname:Unknown-00:25:00:b7:35:ftt.Y IP: 192.168.1.67 MAC: 00:25:00:b7:35:f6 Lease time: 1440 min.Unk rate: 54.0
Mbps
(1213158.340000) Lease requested
wlanO: STA 00:25:00:b7:35:f6 IEEE 802.11: Client associated
OUT:BLOCK (9] Packet invalid in connection (TCP
192.168.1.66:59767->176.34.180.243:443 on ppp1) OUT;BLOCK [9] P.acket invalid in connection {TCP
192.168.1.66:56075->31.13.72.33:443 on ppp1) OUT: BLOCK [9] Packet invalid in connection (TCP
192.168.1.66 581:1:0->31.13.72.33:443 on ppp1)
BL.OCKED 2 more packets (because of Packet invalid in connection) OUT:BLOCK [9] Packet invalid in connection (TCP
192.168.1.66:56251->31.13.72.33:443 on ppp1)
OUT:BLOCK [9] Packet invalid in connection (TCP
192.168.1.66:36959->31.13.72.33:443 on ppp1)
BlOCKED 1more packets (because of Packet invalid in connection)

It could be that the Ipod touch is having problems with both the 2.4GHz and 5GHz frequencies being named the same. If you give them separate SSids it may help. ie add a 5 to the 5GHz SSid.
If you do this you will need to re-connect all your devices that can see both frequencies to both SSids so that they will swap between the frequencies seamlessly when ever they need to
See link how to change SSid.
http://bt.custhelp.com/app/answers/detail/a_id/44504/related/1/session/L2F2LzEvdGltZS8xMzc1OTY2ODIxL...
Once you have changed the SSid I would delete the network connection on the Ipod touch and start again.

Interface Dot11Radio0 cannot associate: No Response

Having an issue with a non-root bridge communication with the root device getting the error message -
*Mar 1 12:55:34.159: %DOT11-4-CANT_ASSOC: Interface Dot11Radio0, cannot associate: No Response
*Mar 1 12:55:46.159: %DOT11-4-CANT_ASSOC: Interface Dot11Radio0, cannot associate: Rcvd response from 6cfa.8918.12e0 channel 3 3240
*Mar 1 12:57:01.159: %DOT11-4-CANT_ASSOC: Interface Dot11Radio0, cannot associate: Authenticating
*Mar 1 13:02:59.159: %DOT11-4-CANT_ASSOC: Interface Dot11Radio0, cannot associate: Associating
I believe the issue may be down to the SSID but can't see what's wrong with the config any Ideas?
config of the WAP is -
Current configuration : 2074 bytes
version 15.2
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
hostname UKPA
logging rate-limit console 9
enable secret 5 $1$y65O$Duk6tL2w8VxpeSkH9WIWu/
no aaa new-model
no ip cef
dot11 syslog
dot11 ssid BRIDGE
   vlan 182
   authentication open
   authentication key-management wpa
   guest-mode
   wpa-psk ascii 7 c942cc494622b70e126618c19eb768ee6fc8ded892204e7367b42384168f15c1
dot11 guest
username Cisco password 7 047802150C2E
bridge irb
interface Dot11Radio0
no ip address
encryption vlan 182 mode ciphers aes-ccm tkip
ssid BRIDGE
antenna gain 0
packet retries 64 drop-packet
station-role non-root
bridge-group 1
bridge-group 1 spanning-disabled
interface Dot11Radio0.182
encapsulation dot1Q 182
bridge-group 182
bridge-group 182 subscriber-loop-control
bridge-group 182 spanning-disabled
interface Dot11Radio1
no ip address
shutdown
antenna gain 0
peakdetect
no dfs band block
packet retries 64 drop-packet
channel dfs
station-role root
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 spanning-disabled
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
interface GigabitEthernet0
no ip address
duplex auto
speed auto
bridge-group 1
bridge-group 1 spanning-disabled
interface GigabitEthernet0.182
encapsulation dot1Q 182
bridge-group 182
bridge-group 182 spanning-disabled
no bridge-group 182 source-learning
interface GigabitEthernet1
no ip address
duplex auto
speed auto
bridge-group 1
bridge-group 1 spanning-disabled
interface BVI1
ip address 10.182.22.11 255.255.128.0
ipv6 address dhcp
ipv6 address autoconfig
ipv6 enable
ip default-gateway 10.182.1.1
ip forward-protocol nd
ip http server
no ip http secure-server
ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag
bridge 1 route ip
line con 0
line vty 0 4
login local
transport input all
end

Hi Paul,
Info: Point to remember is Non-Root Bridge to be connected to Root Bridge via native vlan SSID in order to carry multiple WLAN(or vlans) through this wireless bridge.
Try this:
interface Dot11Radio0.182
encapsulation dot1Q 182 native
bridge-group 1
interface GigabitEthernet0.182
encapsulation dot1Q 182 native
bridge-group 1
To know more, please check this:
https://rscciew.wordpress.com/2014/10/26/autonomous-ap-as-wireless-bridge/
Regards
Don't forget to rate helpful posts

Seemingly successful install of Exchange 2013 SP1 turns into many errors in event logs after upgrade to CU7

I have a new Exchange 2013 server with plans to migrate from my current Exchange 2007 Server.
I installed Exchange 2013 SP1 and the only errors I saw in the event log seemed to be long standing known issues that did not indicate an actual problem (based on what I read online).
I updated to CU7 and now lots of errors have appeared (although the old ones seem to have been fixed so I have that going for me).
Currently the Exchange 2013 server is not in use and clients are still hitting the 2007 server.
Issue 1)
After each reboot I get a Kernel-EventTracing 2 error. I cannot find anything on this on the internet so I have no idea what it is.
Session "FastDocTracingSession" failed to start with the following error: 0xC0000035
I did read other accounts of this error with a different name in the quotes but still can’t tell what this is or where it is coming from.
Issue 2)
I am still getting 5 MSExchange Common 106 errors even after reregistering all of the perf counters per this page:
https://support.microsoft.com/kb/2870416?wa=wsignin1.0
One of the perf counters fails to register using the script from the link above.
66 C:\Program Files\Microsoft\Exchange Server\V15\Setup\Perf\InfoWorkerMultiMailboxSearchPerformanceCounters.xml
New-PerfCounters : The performance counter definition file is invalid.
At C:\Users\administrator.<my domain>\Downloads\script\ReloadPerfCounters.ps1:19 char:4
+    New-PerfCounters -DefinitionFileName $f
+    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo
: InvalidData: (:) [New-PerfCounters], TaskException
    + FullyQualifiedErrorId : [Server=VALIS,RequestId=71b6bcde-d73e-4c14-9a32-03f06e3b2607,TimeStamp=12/18/2014 10:09:
   12 PM] [FailureCategory=Cmdlet-TaskException] 33EBD286,Microsoft.Exchange.Management.Tasks.NewPerfCounters
But that one seems unrelated to the ones that still throw errors.
Three of the remaining five errors are (the forum is removing my spacing between the error text so it looks like a wall of text - sorry):
Performance counter updating error. Counter name is Count Matched LowFidelity FingerPrint, but missed HighFidelity FingerPrint, category name is MSExchange Anti-Malware Datacenter Perfcounters. Optional code: 3. Exception: The
exception thrown is : System.InvalidOperationException: The requested Performance Counter is not a custom counter, it has to be initialized as ReadOnly.
   at System.Diagnostics.PerformanceCounter.InitializeImpl()
   at System.Diagnostics.PerformanceCounter.set_RawValue(Int64 value)
   at Microsoft.Exchange.Diagnostics.ExPerformanceCounter.set_RawValue(Int64 value)
Last worker process info : System.ArgumentException: Process with an Id of 7384 is not running.
   at System.Diagnostics.Process.GetProcessById(Int32 processId)
   at Microsoft.Exchange.Diagnostics.ExPerformanceCounter.GetLastWorkerProcessInfo()
Performance counter updating error. Counter name is Number of items, item is matched with finger printing cache, category name is MSExchange Anti-Malware Datacenter Perfcounters. Optional code: 3. Exception: The exception thrown
is : System.InvalidOperationException: The requested Performance Counter is not a custom counter, it has to be initialized as ReadOnly.
   at System.Diagnostics.PerformanceCounter.InitializeImpl()
   at System.Diagnostics.PerformanceCounter.set_RawValue(Int64 value)
   at Microsoft.Exchange.Diagnostics.ExPerformanceCounter.set_RawValue(Int64 value)
Last worker process info : System.ArgumentException: Process with an Id of 7384 is not running.
   at System.Diagnostics.Process.GetProcessById(Int32 processId)
   at Microsoft.Exchange.Diagnostics.ExPerformanceCounter.GetLastWorkerProcessInfo()
Performance counter updating error. Counter name is Number of items in Malware Fingerprint cache, category name is MSExchange Anti-Malware Datacenter Perfcounters. Optional code: 3. Exception: The exception thrown is : System.InvalidOperationException:
The requested Performance Counter is not a custom counter, it has to be initialized as ReadOnly.
   at System.Diagnostics.PerformanceCounter.InitializeImpl()
   at System.Diagnostics.PerformanceCounter.set_RawValue(Int64 value)
   at Microsoft.Exchange.Diagnostics.ExPerformanceCounter.set_RawValue(Int64 value)
Last worker process info : System.ArgumentException: Process with an Id of 7384 is not running.
   at System.Diagnostics.Process.GetProcessById(Int32 processId)
   at Microsoft.Exchange.Diagnostics.ExPerformanceCounter.GetLastWorkerProcessInfo()
Issue 3)
I appear to have some issues related to the healthmailboxes.
I get MSExchangeTransport 1025 errors for multiple healthmailboxes.
SMTP rejected a (P1) mail from 'HealthMailbox23b10b91745648819139ee691dc97eb6@<my domain>.local' with 'Client Proxy <my server>' connector and the user authenticated as 'HealthMailbox23b10b91745648819139ee691dc97eb6'. The Active Directory
lookup for the sender address returned validation errors. Microsoft.Exchange.Data.ProviderError
I reran setup /prepareAD to try and remedy this but I am still getting some.
Issue 4)
I am getting an MSExchange RBAC 74 error.
(Process w3wp.exe, PID 984) Connection leak detected for key <my domain>.local/Admins/Administrator in Microsoft.Exchange.Configuration.Authorization.WSManBudgetManager class. Leaked Value 1.
Issue 5)
I am getting MSExchange Assistants 9042 warnings on both databases.
Service MSExchangeMailboxAssistants. Probe Time Based Assistant for database Database02 (c83dbd91-7cc4-4412-912e-1b87ca6eb0ab) is exiting a work cycle. No mailboxes were successfully processed. 2 mailboxes were skipped due to errors. 0 mailboxes were
skipped due to failure to open a store session. 0 mailboxes were retried. There are 0 mailboxes in this database remaining to be processed.
Some research suggested this may be related to deleted mailboxes however I have never had any actual user mailboxes on this server.
If they are healthmailboxes or arbitration mailboxes that might make sense but I am unsure of what to do on this.
Issue 6)
At boot I am getting an MSExchange ActiveSync warning 1033
The setting SupportedIPMTypes in the Web.Config file was missing.
Using default value of System.Collections.Generic.List`1[System.String].
I don't know why but this forum is removing some of my spacing that would make parts of this easier to read.

Hi Eric
Yes I have uninstalled and reinstalled Exchange 2013 CU7 for the 3<sup>rd</sup> time.
I realize you said one issue per forum thread but since I already started this thread with many issues I will at least post what I have discovered on them in case someone finds their way here from a web search.
I have an existing Exchange 2007 server in the environment so I am unable to create email address policies that are defined by “recipient container”.
If I try and do so I get “You can't specify the recipient container because legacy servers are detected.”
So I cannot create a normal email address policy and restrict it to an OU without resorting to some fancy filtering.
Instead what I have done is use PS to modify extensionAttribute1 (otherwise known as Custom Attribute 1 to exchange) for all of my users.
I then applied an address policy to them and gave it the highest priority.
Then I set a default email address policy for the entire organization.
After reinstalling Exchange all of my system mailboxes were created with the internal domain name.
So issue number 3 above has not come up.
For issue number one above I have created a new thread:
https://social.technet.microsoft.com/Forums/office/en-US/7eb12b89-ae9b-46b2-bd34-e50cd52a4c15/microsoftwindowskerneleventtracing-error-2-happens-twice-at-boot-ex2013cu7?forum=exchangesvrdeploy
For issue number four I have posted to this existing thread where there is so far no resolution:
https://social.technet.microsoft.com/Forums/exchange/en-US/2343730c-7303-4067-ae1a-b106cffc3583/exchange-error-id-74-connection-leak-detected-for-key?forum=exchangesvradmin
Issue number Five I have managed to recreate and get rid of in more than one way.
If I create a new database in ECP and set the database and log paths where I want, then this error will appear.
If I create the database in the default location and then use EMS to move it and set the log path, then the error will not appear.
The error will also appear (along with other errors) if I delete the health mailboxes and let them get recreated by restarting the server or the Health Manager service.
If I then go and set the retention period for deleted mailboxes to 0 days and wait a little while, these will all go away.
So my off hand guess is that these are caused by orphaned system mailboxes.
For issue number six I have posted to this existing thread where there is so far no resolution:
https://social.technet.microsoft.com/Forums/exchange/en-US/dff62411-fad8-4d0c-9bdb-037374644845/event-1033-msexchangeactivesync-warning?forum=exchangesvrmobility
So for the remainder of this thread we can try and tackle issue number two which is the perf counters.
The exact same 5 perf counter were coming up and this had been true each time I have uninstalled and reinstalled Exchange 2013CU7.
Actually to be more accurate a LOT of perf counter errors come up after the initial install, but reloading the perf counters using the script I posted above reduces it to the same five.
Using all of your suggestions so far has not removed these 5 remaining errors either. Since there is no discernible impact other than these errors at boot I am not seriously bothered by them but as will all event log errors, I would prefer
to make them go away if possible.

Event Log: Interface Dot11Radio0, parent lost: Had to lower data rate

Similar Messages

Maybe you are looking for