Event Log re-Lease request's

Hi,
Just been looking at my HH3 event log and at the number of lease request's that appear there. It request's a lease and 1 is renewed and it say's the duration is 1440 min's which is 24 hrs and then 4/5 hour's later it request's again and 1 is issued again for 24 hour's and the 4/5 hour's later the process start's again and again.
Any body now the reason why this is happening please?????????
iechyd da
sky twitter account a customer ask why sky go streams are worst then sd and yet bt and eurosports apps stream in hd. Reply from mod, oh thats easy the files for hd are some huge that sky go can't play them and no app can stream hd due to this and so when they say they are they're really sd streams, if there was any way around this we would have done it now.

Well those addresses have been the same since I've had Infinity installed, the only other thing I checked the other day was I got myself a new TV and it has internet on it and so I tried it et all for a few hours messing around and looking but I removed it from the device's page it was 192.168.1.66 but as I've said it's not there any more. HH3 wireless not enabled and no wireless connections on my laptop.
I do sometimes connect other devices, my sons laptop when he needs to D/L big files et al as he has a very slow speed and a limit so he comes down and use my internet but I may do what you said just to see if it makes any differance. This renewing is not a problem as nothing happens to my speed, just a pain to see it all the time in my log.
iechyd da
sky twitter account a customer ask why sky go streams are worst then sd and yet bt and eurosports apps stream in hd. Reply from mod, oh thats easy the files for hd are some huge that sky go can't play them and no app can stream hd due to this and so when they say they are they're really sd streams, if there was any way around this we would have done it now.

Similar Messages

Questions about BT Home Hub 4A event log - WIFI c...

Hope someone can help please ?
I had BT inifinity installed 2 weeks ago with the HH 4 (type A) and everything has worked - connection found, no problem.
This week, my ipod touch was unable to join the network but the iphone 5, another ipod and a tablet could connect without a problem. The ipod touch managed to connect to another WIFI used at the property and my work wifi without a problem.
I thought it maybe the ipod touch as it was quite old but that doesn't make sense since it connects fine to other networks. I restored network settings and other options suggested by Apple but to no avail.
I have turned my attention to the Hub. My laptop (older than the ipod touch) gets the connection no problem along with the other devices. I went into the hub management page but I am not smart enough to decifer the event log so would like some help so I can fix this because I thought BT infinity was the better more reliable option?
The ipod touch Wifi IP address is 00:25:00:b7:35:f6.
On the event log, it shows STA before the address - but it shows STA before all the device IP addresses. Should I change this to DCHP ? or is this (Static ? alright)
The Lease on all the devices on the event log is set to 1440 min. (1 day) is that alright too, what does it mean ?
Do I have to keep renewing the lease ? How do I do that ? I read it can be set to 21 days ?
Going back to the IP address on the ipod it shows the Hostname as 00:25:00:B7:35:f6-2 this is different to the IP address with the -2. Could that be a cause of the unable to join network or is it because I attempted to recreate the network on the ipod so its the second version of that host name ?
Is there any setting I can change to fix this because I am concerned the same this will happen to the other devices and then the laptop....
What do I need to do to be able to get my ipod touch to connect to the BT network setting ?
I think its the hub 4A causing the 'block' on the ipod touch not the device and I think its maybe a matter of changing a setting - but then why was it all fine before when Infinity was first installed ?
Lastly my laptop (7 Years old) seems to be attached to the 5GHZ Wireless channel - is that alright ? The other more recent devices are on the 2.4ghz channel (except the ipod touch which isn't on any !!)
Is it alright to turn the hub on / off ? -I am resisting that because I don't want to make the situation worse.
Sorry but what does client disassociated mean and all the BLOCKS - do they relate to firewall ?
Please can you review the event log and my questions ?
Many thanks
angie 2601
The time frame is 3.55am 8/8/2013 - 7.16 am 8/8/2013
(Latest (7.16am) at the top
Message
07:16:39, 08AUG
(1224785.050000) Admin login successful by 192.168.1.64 on HTTP (1224766.610000) Admin login FAILED by 192.168.1.64 on HTTP (1224648.050000) New GUIsession from IP 192.168.1.64
(1224466.770000) Device disconnected: Hostname: Unknown-d8:dl:cb:ec:a6:fe
IP: 192.168.1.65 MAC: d8:d1:cb:ec:a6:fe
wlan1: STA d8:d1:cb:ec:a6:fe IEEE 802.11: Client disassociated
(1224362.750000) lease for IP 192.168.1.65 renewed by host Unknown d8:d1:cb:ec:a6:fe (MAC d8:d1:cb:ec:a6:fe).lease duration:1440 min (1224362.750000) Device connected: Hostname:Unknown-d8:d1:cb:ec:a6:feiP:
192.168.1.65 MAC:d8:dl:cb:ec:a6:fe lease time: 1440 min. link rate:90.0 Mbps
(1224362.690000) Lease requested
wlan1: STA d8:d1:cb:ec:a6:fe IEEE 802.11:Client associated
(1224241.150000) lease for IP 192.168.1.64 renewed by host FAMILY (MAC
00:13:02:de:6d:e6). Lease duration:1440 min
(1224241.150000) Device connected: Hostname: FAMii.Y IP:192.168.1.64 MAC:
00:13:02:de:6d:e6 Lease time: 1440 min. link rate: 54.0 Mbps
(1224241.090Cl00) Lease requested
wlan1TA 00:13:02:de:6d:e6 IEEE 802.11:Client associated
OUT: BLOCK [9] Packet invalid in connection (TCP
192.168.1.66:34905->31.13.72.38:443 on ppp1)
(1223644.770000) Device disconnected: Hostname: Unknown-d8:dl:cb:ec:a6:fe
IP: 192.168.1.65 MAC: d8:d1:cb:ec:a6:fe
wlanl: STA d8:d1:cb:ec:a6:-fe IEEE 802.11:CHent diSassociated
(1223489.390000) Lease for IP 192.168.1.65 renewed by host Unknown d8:d1:cb:ec:a6:fe (MAC d8:d1:cb:ec:a6:fe).lease duration:1440 min (1223489.380000) Device connected:Hostname:Unknown-d8:dl:cb:ec:a6:fe IP:
192.168.1.65 MAC: d kd1:cb ec:-a6-:fe Lease time: 1440 min. Link rare: 90.0 Mbps
(1223489.330000) Lease requested
wlan1: STA d8:d1:cb:ec:a6:fe IEEE 802.11: Client associated wlan1TA d8:d1:cb:ec:a6:fe IEEE 802.11: Client disasSociated
wlan1TA d8:d1:cb:ec:a6:fe IEEE 802.11:Client associated
OUT;BLOCK [9] Packet i valid in connection (TCP
192.168.1.66:34375->31.13.72.38:443 on pppl)
l'N':BLOCK [16-} Remote administration {ICMP type 8 code 0
117.1.42.94->86.182.228.205 on ppp1)
IN: BLOCK [9] Packet invalid in connection (TCP
31.13.72.33:443->86.182.228.205:44156 on ppp1) IN: BLOCK [9] Packet invalid in connection (TCP
31.13.72.33:443->86.182.228.205:36615 on ppp1)
OUT: BLOCK [9] Packet invalid in connection (TCP
192.1-68.1.68:49476->173.252.103.16:443 OR ppp1)
BLOCKED 5 more packets (because of Packet invalid in connection) OUT: BLOCK [9] Packet invalid in connection (TCP
192.168.1.68:49443->95.100.195.205:443 on ppp1)
OUT:BLOCK {9] PaCket invalid in connection (TCP
192.168.1.68:49438->95.100.194.217:443 on ppp1)
IN:BLOCK [9] Packet invalid in connection (TCP
95.100.194.217:443->86.182.228.205:49444 on ppp1)
(1222111.810000) Lease for IP 192.168.1.68 renewed by host Unknown-
70:56:81:46:bf:d9 (MAC 70:56:81:46:bf:d9).Lease duration:1440 min
(1222111.810000) Device connected:Hostname:Unknown-70:56:81:46:bf:d9 IP:,
192.168.1.68 MAC:70:56:8:t:46:bf:d9lease time:1440 min. Link rate:52.0 Mbps
(1222111.750000) Lease requested .-
wlanO: STA 70:56:81:46:bf:d9 IEEE 802.11: Client associated • (1222093.690000) Device dlsconn: Hostname:Unknown-
00:25:00:b7:35:f6-2 IP: 192.168. MAC: 00:25:00:b7:35:f6 wlanoTA 00:25:00:b7:35:f6 IEEE 802.11:Client disassociated
OUT:BLOCK [9] Packet invalid in connection (TCP
192.168.1.66-:43272->31.13.72.33:443 on ppp1)
221969.130000) lease for IP 192.168.1.67 renewed by host Unknown-
00:25:00:b7:35:f6-2 (MAC 00:25:00:b7:35:f6). lease duration:1440 min
(1221969.130000} Devicconnected: Hostname·:Unknowwoo·:25:00:b7 35:f6-2
IP: 192.168.1.67 MAC: 00:25:00:b7:35:f6 Lease time: 1440 min. Unk rate: 54.0
Mbps
(1221969.070000) Lease requested
wlanO: STA 00:25:00:b7:35:f6 IEEE 802.11:Client associated
(1220365.290000) Device disconnected: Hostname:Unknown-
00:25:00:b7:35:f6-2 IP: 192.168.1.67 MAC: 00:25:00:b7:35:f6 wlanOTA 00:25:00:b7:35:f6 IEEE 802.11:Client disassociated
(1220348.230000) Lease for IP 192.168.1.67 renewed by host Unlmown-
00:25:00:b7:35:f6-2 (MAC 00:25:00:b7:35:f6).lease duration: 1440 min
(1220348.230000) Device connected: Hostname:Unknown-00:25:00:b7:35:f6-2
IP: 192.168.1.67 MAC: 00:25:00:b7:35:f6 Lease time: 1440 min. Unk rate: 54.0
Mbps
(1220348.170000) lease requested
wlanOTA 00:25:00:b7:35:f6 IEEE 802.11:Client associated
IN: BLOCK f16] Remote administration (TCP
123.151.42.61:12233->86.182.228.205:8080 on ppp1) OUT: BLOCK [9] Packet invalid in connection (TCP
:t92.Hi8.1.66:53813->31.13.72.33:443 on ppp1)
OUT:BLOCK [9] Packet invalid in connection (TCP
192.168.1.66:43989->31.13.72.33:443 on ppp1)
IN: BLOCK [16] Remote administration (ICMP type 8 rode 0
2.7.251.109.227->86.182.228.205 on pppl)
(1216770.650000) Device disconnected:Hostname:Unknown-
00:25:00:b7:35:f6-2 IP: 192.168.1.67 MAC: 00:25:00:b7:35:f6
OUT:BLOCK [9j Packet invalid in connection (TCF
192.168.1.67:49180->74.125.136.109:993 on ppp1)
wlanOTA 00:25:00:b7:35:f6 IEEE 802.11:Client disassociated
(1216753.280000) Lease for IP 192.168.1.67 renewed by host Unknown-
00:25:00:b7:35:f6-2 (MAC 00:25:00:b7:35:f6). lease duration:1440 min
(1216753.270000) Device connected: Hostname: Unknown-00:25:00:b7:35:f6-2
IP: 192.168.1.67 MAC: 00:25.:00-:.b7.:35:f6 Lease time: 1440 min. Unk rate: 54.0
Mbps
(1216753.220000) lease requested
wlanO: STA 00:25:00:b7:35:f6 IEEE 802.11:Client assodat
OUT: BLOCK [9] Packet invalid in connection (TCP
192.168.1.66:55944->23.21.78.229:443 on ppp1)
OUT: BLOCK [9J Packet invafid in connection (TCP
192.168.1.66:34794->31.13.72.33:443 on ppp1)
OUT:BLOCK [9] Packet invalid in connection (TCP
192.168.1.66:41441->31.13.72.33:443 on ppp1)
{1213176.020000) Device disconnected:.Hostname:Unknown-
00:25:00:b7:35:f6-2 IP: 192.168.1.67 MAC:00:25:00:b7:35:f6 wlanO: STA 00:25:00:b7:35:f6 IEEE 802.11: Client disassociated
(1213158.410000) Lease for IP 192.168.1.67 renewed by host Unknown-
00:25:00:b7:35:f6-2 (MAC 00:25:00:b7:35:f6). lease duration:1440 min _./:\ (1213158.400000) Device connected:Hostname:Unknown-00:25:00:b7:35:ftt.Y IP: 192.168.1.67 MAC: 00:25:00:b7:35:f6 Lease time: 1440 min.Unk rate: 54.0
Mbps
(1213158.340000) Lease requested
wlanO: STA 00:25:00:b7:35:f6 IEEE 802.11: Client associated
OUT:BLOCK (9] Packet invalid in connection (TCP
192.168.1.66:59767->176.34.180.243:443 on ppp1) OUT;BLOCK [9] P.acket invalid in connection {TCP
192.168.1.66:56075->31.13.72.33:443 on ppp1) OUT: BLOCK [9] Packet invalid in connection (TCP
192.168.1.66 581:1:0->31.13.72.33:443 on ppp1)
BL.OCKED 2 more packets (because of Packet invalid in connection) OUT:BLOCK [9] Packet invalid in connection (TCP
192.168.1.66:56251->31.13.72.33:443 on ppp1)
OUT:BLOCK [9] Packet invalid in connection (TCP
192.168.1.66:36959->31.13.72.33:443 on ppp1)
BlOCKED 1more packets (because of Packet invalid in connection)

It could be that the Ipod touch is having problems with both the 2.4GHz and 5GHz frequencies being named the same. If you give them separate SSids it may help. ie add a 5 to the 5GHz SSid.
If you do this you will need to re-connect all your devices that can see both frequencies to both SSids so that they will swap between the frequencies seamlessly when ever they need to
See link how to change SSid.
http://bt.custhelp.com/app/answers/detail/a_id/44504/related/1/session/L2F2LzEvdGltZS8xMzc1OTY2ODIxL...
Once you have changed the SSid I would delete the network connection on the Ipod touch and start again.

How to write to windows event logs from determinations-server under IIS

This is just an FYI technical bit of information I wish someone had shared with me before I started trying to write OPA errors to the windows event log... Most problems writing to the windows event log from log4net occur because of permissions. Some problems are because determinations-server does not have permissions to create some registry entries. Some problems cannot be resolved unless specific registry entry permissions are actually changed. We had very little consistency with the needed changes across our servers, but some combination of the following would always get the logging to the windows event log working.
To see log4net errors as log4net attempts to utilize the windows event log, temporarily add the following to the web.config:
<appSettings>

<add key="log4net.Internal.Debug" value="true"/>
</appSettings>
<system.diagnostics>
<trace autoflush="true">
<listeners>
<add
name="textWriterTraceListener"
type="System.Diagnostics.TextWriterTraceListener"
initializeData="logs/InfoDSLog.txt" />
</listeners>
</trace>
</system.diagnostics>
To add an appender for the windows event viewer, try the following in the log4net.xml:
<appender name="EventLogAppender" type="log4net.Appender.EventLogAppender" >
<param name="ApplicationName" value="OPA" />
<param name="LogName" value="OPA" />
<param name="Threshold" value="all" />
<layout type="log4net.Layout.PatternLayout">
<conversionPattern value="%date [%thread] %-5level %logger [%property{NDC}] - %message%newline" />
</layout>
<filter type="log4net.Filter.LevelRangeFilter">
<levelMin value="WARN" />
<levelMax value="FATAL" />
</filter>
</appender>
<root>
<level value="warn"/>
<appender-ref ref="EventLogAppender"/>
</root>
To put the OPA logs under the Application Event Log group, try this:
Create an event source under the Application event log in Registry Editor. To do this, follow these steps:
1.     Click Start, and then click Run.
2.     In the Open text box, type regedit.
3.     Locate the following registry subkey:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application
4.     Right-click the Application subkey, point to New, and then click Key.
5.     Type OPA for the key name.
6.     Close Registry Editor.
To put the OPA logs under a custom OPA Event Log group (as in the demo appender above), try this:
Create an event log in Registry Editor. To do this, follow these steps:
1.     Click Start, and then click Run.
2.     In the Open text box, type regedit.
3.     Locate the following registry subkey:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog
4.     Right-click the eventlog subkey, point to New, and then click Key.
5.     Type OPA for the key name.
6.     Right-click the new OPA key and add a new DWORD called "MaxSize" and set it to "1400000" which is about 20 Meg in order to keep the log file from getting too large.
7.     The next steps either help or sometimes cause an error, but you can try these next few steps... If you get an error about a source already existing, then you can delete the key.
8.     Right-click the OPA subkey, point to New, and then click Key.
9.     Type OPA for the key name.
10.     Close Registry Editor.
You might need to change permissions so OPA can write to the event log in Registry Editor. If you get permission errors, try following these steps:
1.     Click Start, and then click Run.
2.     In the Open text box, type regedit.
3.     Locate the following registry subkey:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog
4.     Right-click the EventLog key, select Permissions.
5.     In the dialog that pops up, click Add...
6.     Click Advanced...
7.     Click Locations... and select the current machine by name.
8.     Click Find Now
9.     Select both the Network user and IIS_IUSERS user and click OK and OK again. (We never did figure out which of those two users was the one that fixed our permission problem.)
10.     Change the Network user to have Full Control
11.     Click Apply and OK
To verify OPA Logging to the windows event logs from Determinations-Server:
Go to the IIS determinations-server application within Server Manager.
Under Manage Application -> Browse Application click the http link to pull up the local "Available Services" web page that show the wsdl endpoints.
Select the /determinations-server/server/soap.asmx?wsdl link
Go to the URL and remove the "?wsdl" from the end of the url and refresh. This will throw the following error into the logs:
ERROR Oracle.Determinations.Server.DSServlet [(null)] - Invalid get request: /determinations-server/server/soap.asmx
That error should show up in the windows event log, OR you can get a message explaining why security stopped you in "logs/InfoDSLog.txt" if you used the web.config settings from above.
http://msdn.microsoft.com/en-us/library/windows/desktop/aa363648(v=vs.85).aspx
Edited by: Paul Fowler on Feb 21, 2013 9:45 AM

Thanks for sharing this information Paul.

How To Block logging of 405's to Event Log?

I've got a webserver accessible to the outside world that comes under constant vulnerability scans, many of which involve accessing .exe filetypes.
When any of these scans are made, not a 404, but a 405 error message is generated.
Each 405 is stored in the event log, clogging up the eventlog and making it difficult to search for useful information.
Is there any way to block 405 error messages from being put into the event log or perhaps a way to force a 404 error message in such cases?
I do use some CGIs so altering .exe in mime.types won't do. I'm running win2k adv. server.
-R

The customary way to force the server to return a 404 for an arbitrary resource is to use the deny-existence SAF. However, deny-existence will itself log a message each time a "denied" resource is requested, so this probably isn't what you want.
Fortunately, there are numerous ways to address the issue. One possibility is redirecting accesses to these resources elsewhere, e.g. to your web site's front page. The following 3 lines could be added to the end of obj.conf to redirect requests for URIs that end in "/system32/cmd.exe":
<Object ppath="*/system32/cmd.exe">
NameTrans fn="redirect" from="/" url="/"
</Object>

Seemingly successful install of Exchange 2013 SP1 turns into many errors in event logs after upgrade to CU7

I have a new Exchange 2013 server with plans to migrate from my current Exchange 2007 Server.
I installed Exchange 2013 SP1 and the only errors I saw in the event log seemed to be long standing known issues that did not indicate an actual problem (based on what I read online).
I updated to CU7 and now lots of errors have appeared (although the old ones seem to have been fixed so I have that going for me).
Currently the Exchange 2013 server is not in use and clients are still hitting the 2007 server.
Issue 1)
After each reboot I get a Kernel-EventTracing 2 error. I cannot find anything on this on the internet so I have no idea what it is.
Session "FastDocTracingSession" failed to start with the following error: 0xC0000035
I did read other accounts of this error with a different name in the quotes but still can’t tell what this is or where it is coming from.
Issue 2)
I am still getting 5 MSExchange Common 106 errors even after reregistering all of the perf counters per this page:
https://support.microsoft.com/kb/2870416?wa=wsignin1.0
One of the perf counters fails to register using the script from the link above.
66 C:\Program Files\Microsoft\Exchange Server\V15\Setup\Perf\InfoWorkerMultiMailboxSearchPerformanceCounters.xml
New-PerfCounters : The performance counter definition file is invalid.
At C:\Users\administrator.<my domain>\Downloads\script\ReloadPerfCounters.ps1:19 char:4
+    New-PerfCounters -DefinitionFileName $f
+    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo
: InvalidData: (:) [New-PerfCounters], TaskException
    + FullyQualifiedErrorId : [Server=VALIS,RequestId=71b6bcde-d73e-4c14-9a32-03f06e3b2607,TimeStamp=12/18/2014 10:09:
   12 PM] [FailureCategory=Cmdlet-TaskException] 33EBD286,Microsoft.Exchange.Management.Tasks.NewPerfCounters
But that one seems unrelated to the ones that still throw errors.
Three of the remaining five errors are (the forum is removing my spacing between the error text so it looks like a wall of text - sorry):
Performance counter updating error. Counter name is Count Matched LowFidelity FingerPrint, but missed HighFidelity FingerPrint, category name is MSExchange Anti-Malware Datacenter Perfcounters. Optional code: 3. Exception: The
exception thrown is : System.InvalidOperationException: The requested Performance Counter is not a custom counter, it has to be initialized as ReadOnly.
   at System.Diagnostics.PerformanceCounter.InitializeImpl()
   at System.Diagnostics.PerformanceCounter.set_RawValue(Int64 value)
   at Microsoft.Exchange.Diagnostics.ExPerformanceCounter.set_RawValue(Int64 value)
Last worker process info : System.ArgumentException: Process with an Id of 7384 is not running.
   at System.Diagnostics.Process.GetProcessById(Int32 processId)
   at Microsoft.Exchange.Diagnostics.ExPerformanceCounter.GetLastWorkerProcessInfo()
Performance counter updating error. Counter name is Number of items, item is matched with finger printing cache, category name is MSExchange Anti-Malware Datacenter Perfcounters. Optional code: 3. Exception: The exception thrown
is : System.InvalidOperationException: The requested Performance Counter is not a custom counter, it has to be initialized as ReadOnly.
   at System.Diagnostics.PerformanceCounter.InitializeImpl()
   at System.Diagnostics.PerformanceCounter.set_RawValue(Int64 value)
   at Microsoft.Exchange.Diagnostics.ExPerformanceCounter.set_RawValue(Int64 value)
Last worker process info : System.ArgumentException: Process with an Id of 7384 is not running.
   at System.Diagnostics.Process.GetProcessById(Int32 processId)
   at Microsoft.Exchange.Diagnostics.ExPerformanceCounter.GetLastWorkerProcessInfo()
Performance counter updating error. Counter name is Number of items in Malware Fingerprint cache, category name is MSExchange Anti-Malware Datacenter Perfcounters. Optional code: 3. Exception: The exception thrown is : System.InvalidOperationException:
The requested Performance Counter is not a custom counter, it has to be initialized as ReadOnly.
   at System.Diagnostics.PerformanceCounter.InitializeImpl()
   at System.Diagnostics.PerformanceCounter.set_RawValue(Int64 value)
   at Microsoft.Exchange.Diagnostics.ExPerformanceCounter.set_RawValue(Int64 value)
Last worker process info : System.ArgumentException: Process with an Id of 7384 is not running.
   at System.Diagnostics.Process.GetProcessById(Int32 processId)
   at Microsoft.Exchange.Diagnostics.ExPerformanceCounter.GetLastWorkerProcessInfo()
Issue 3)
I appear to have some issues related to the healthmailboxes.
I get MSExchangeTransport 1025 errors for multiple healthmailboxes.
SMTP rejected a (P1) mail from 'HealthMailbox23b10b91745648819139ee691dc97eb6@<my domain>.local' with 'Client Proxy <my server>' connector and the user authenticated as 'HealthMailbox23b10b91745648819139ee691dc97eb6'. The Active Directory
lookup for the sender address returned validation errors. Microsoft.Exchange.Data.ProviderError
I reran setup /prepareAD to try and remedy this but I am still getting some.
Issue 4)
I am getting an MSExchange RBAC 74 error.
(Process w3wp.exe, PID 984) Connection leak detected for key <my domain>.local/Admins/Administrator in Microsoft.Exchange.Configuration.Authorization.WSManBudgetManager class. Leaked Value 1.
Issue 5)
I am getting MSExchange Assistants 9042 warnings on both databases.
Service MSExchangeMailboxAssistants. Probe Time Based Assistant for database Database02 (c83dbd91-7cc4-4412-912e-1b87ca6eb0ab) is exiting a work cycle. No mailboxes were successfully processed. 2 mailboxes were skipped due to errors. 0 mailboxes were
skipped due to failure to open a store session. 0 mailboxes were retried. There are 0 mailboxes in this database remaining to be processed.
Some research suggested this may be related to deleted mailboxes however I have never had any actual user mailboxes on this server.
If they are healthmailboxes or arbitration mailboxes that might make sense but I am unsure of what to do on this.
Issue 6)
At boot I am getting an MSExchange ActiveSync warning 1033
The setting SupportedIPMTypes in the Web.Config file was missing.
Using default value of System.Collections.Generic.List`1[System.String].
I don't know why but this forum is removing some of my spacing that would make parts of this easier to read.

Hi Eric
Yes I have uninstalled and reinstalled Exchange 2013 CU7 for the 3<sup>rd</sup> time.
I realize you said one issue per forum thread but since I already started this thread with many issues I will at least post what I have discovered on them in case someone finds their way here from a web search.
I have an existing Exchange 2007 server in the environment so I am unable to create email address policies that are defined by “recipient container”.
If I try and do so I get “You can't specify the recipient container because legacy servers are detected.”
So I cannot create a normal email address policy and restrict it to an OU without resorting to some fancy filtering.
Instead what I have done is use PS to modify extensionAttribute1 (otherwise known as Custom Attribute 1 to exchange) for all of my users.
I then applied an address policy to them and gave it the highest priority.
Then I set a default email address policy for the entire organization.
After reinstalling Exchange all of my system mailboxes were created with the internal domain name.
So issue number 3 above has not come up.
For issue number one above I have created a new thread:
https://social.technet.microsoft.com/Forums/office/en-US/7eb12b89-ae9b-46b2-bd34-e50cd52a4c15/microsoftwindowskerneleventtracing-error-2-happens-twice-at-boot-ex2013cu7?forum=exchangesvrdeploy
For issue number four I have posted to this existing thread where there is so far no resolution:
https://social.technet.microsoft.com/Forums/exchange/en-US/2343730c-7303-4067-ae1a-b106cffc3583/exchange-error-id-74-connection-leak-detected-for-key?forum=exchangesvradmin
Issue number Five I have managed to recreate and get rid of in more than one way.
If I create a new database in ECP and set the database and log paths where I want, then this error will appear.
If I create the database in the default location and then use EMS to move it and set the log path, then the error will not appear.
The error will also appear (along with other errors) if I delete the health mailboxes and let them get recreated by restarting the server or the Health Manager service.
If I then go and set the retention period for deleted mailboxes to 0 days and wait a little while, these will all go away.
So my off hand guess is that these are caused by orphaned system mailboxes.
For issue number six I have posted to this existing thread where there is so far no resolution:
https://social.technet.microsoft.com/Forums/exchange/en-US/dff62411-fad8-4d0c-9bdb-037374644845/event-1033-msexchangeactivesync-warning?forum=exchangesvrmobility
So for the remainder of this thread we can try and tackle issue number two which is the perf counters.
The exact same 5 perf counter were coming up and this had been true each time I have uninstalled and reinstalled Exchange 2013CU7.
Actually to be more accurate a LOT of perf counter errors come up after the initial install, but reloading the perf counters using the script I posted above reduces it to the same five.
Using all of your suggestions so far has not removed these 5 remaining errors either. Since there is no discernible impact other than these errors at boot I am not seriously bothered by them but as will all event log errors, I would prefer
to make them go away if possible.

New Event Log Errors L355-S7902

These two are recurring daily and showing up in Event Viewer>Windows>Diagnostic Performance>Operational. I have noticed that shutdown is too long so I have copied the errors.
Log Name:      Microsoft-Windows-Diagnostics-Performance/Operational
Source:        Microsoft-Windows-Diagnostics-Performance
Date:          8/11/2010 7:01:45 AM
Event ID:      203
Task Category: Shutdown Performance Monitoring
Level:         Error
Keywords:      Event Log
User:          LOCAL SERVICE
Computer:      Laptop
Description:
This service caused a delay in the system shutdown process:
     File Name       :   RasMan
     Friendly Name       :   Remote Access Connection Manager
     Version       :   6.0.6000.16386 (vista_rtm.061101-2205)
     Total Time       :   16925ms
     Degradation Time   :   16570ms
     Incident Time (UTC)   :   8/10/2010 7:44:55 PM
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
    <Provider Name="Microsoft-Windows-Diagnostics-Performance" Guid="{cfc18ec0-96b1-4eba-961b-622caee05b0a}" />
    <EventID>203</EventID>
    <Version>1</Version>
    <Level>2</Level>
    <Task>4007</Task>
    <Opcode>41</Opcode>
    <Keywords>0x8000000000010000</Keywords>
    <TimeCreated SystemTime="2010-08-11T12:01:45.242Z" />
    <EventRecordID>3327</EventRecordID>
    <Correlation ActivityID="{00000000-9B8C-0001-2EDB-D6AD4C39CB01}" />
    <Execution ProcessID="2008" ThreadID="2144" />
    <Channel>Microsoft-Windows-Diagnostics-Performance/Operational</Channel>
    <Computer>Laptop</Computer>
    <Security UserID="S-1-5-19" />
</System>
<EventData>
    <Data Name="StartTime">2010-08-10T19:44:55.195Z</Data>
    <Data Name="NameLength">7</Data>
    <Data Name="Name">RasMan</Data>
    <Data Name="FriendlyNameLength">33</Data>
    <Data Name="FriendlyName">Remote Access Connection Manager</Data>
    <Data Name="VersionLength">39</Data>
    <Data Name="Version">6.0.6000.16386 (vista_rtm.061101-2205)</Data>
    <Data Name="TotalTime">16925</Data>
    <Data Name="DegradationTime">16570</Data>
    <Data Name="PathLength">32</Data>
    <Data Name="Path">C:\Windows\System32\rasmans.dll</Data>
    <Data Name="ProductNameLength">37</Data>
    <Data Name="ProductName">Microsoft® Windows® Operating System</Data>
    <Data Name="CompanyNameLength">22</Data>
    <Data Name="CompanyName">Microsoft Corporation</Data>
</EventData>
</Event>
Log Name:      Microsoft-Windows-Diagnostics-Performance/Operational
Source:        Microsoft-Windows-Diagnostics-Performance
Date:          8/9/2010 5:06:37 PM
Event ID:      351
Task Category: Standby Performance Monitoring
Level:         Error
Keywords:      Event Log
User:          LOCAL SERVICE
Computer:      Laptop
Description:
This driver responded slower than expected to the resume request while servicing this device:
     Driver File Name       :   \Driver\usbehci
     Driver Friendly Name       :   EHCI eUSB Miniport Driver
     Driver Version           :   6.0.6001.18000 (longhorn_rtm.080118-1840)
     Driver Total Time       :   271ms
     Driver Degradation Time   :   95ms
     Incident Time (UTC)       :   8/9/2010 10:11:50 PM
     Device Name           :   PCI\VEN_8086&DEV_293C&SUBSYS_FF661179&REV_03\3&21436425&0&D7
     Device Friendly Name       :   Intel(R) ICH9 Family USB2 Enhanced Host Controller - 293C
     Device Total Time       :   281ms
     Device Degradation Time   :   95ms
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
    <Provider Name="Microsoft-Windows-Diagnostics-Performance" Guid="{cfc18ec0-96b1-4eba-961b-622caee05b0a}" />
    <EventID>351</EventID>
    <Version>1</Version>
    <Level>2</Level>
    <Task>4003</Task>
    <Opcode>35</Opcode>
    <Keywords>0x8000000000010000</Keywords>
    <TimeCreated SystemTime="2010-08-09T22:06:37.507Z" />
    <EventRecordID>3311</EventRecordID>
    <Correlation ActivityID="{00000000-06C8-0000-2E38-015FCA37CB01}" />
    <Execution ProcessID="236" ThreadID="996" />
    <Channel>Microsoft-Windows-Diagnostics-Performance/Operational</Channel>
    <Computer>Laptop</Computer>
    <Security UserID="S-1-5-19" />
</System>
<EventData>
    <Data Name="StartTime">2010-08-09T22:11:50.769Z</Data>
    <Data Name="NameLength">16</Data>
    <Data Name="Name">\Driver\usbehci</Data>
    <Data Name="FriendlyNameLength">26</Data>
    <Data Name="FriendlyName">EHCI eUSB Miniport Driver</Data>
    <Data Name="VersionLength">42</Data>
    <Data Name="Version">6.0.6001.18000 (longhorn_rtm.080118-1840)</Data>
    <Data Name="TotalTime">271</Data>
    <Data Name="DegradationTime">95</Data>
    <Data Name="PathLength">40</Data>
    <Data Name="Path">C:\Windows\system32\DRIVERS\usbehci.sys</Data>
    <Data Name="ProductNameLength">37</Data>
    <Data Name="ProductName">Microsoft® Windows® Operating System</Data>
    <Data Name="CompanyNameLength">22</Data>
    <Data Name="CompanyName">Microsoft Corporation</Data>
    <Data Name="DeviceNameLength">61</Data>
    <Data Name="DeviceName">PCI\VEN_8086&DEV_293C&SUBSYS_FF661179&REV_03\3&21436425&0&D7</Data>
    <Data Name="DeviceFriendlyNameLength">58</Data>
    <Data Name="DeviceFriendlyName">Intel(R) ICH9 Family USB2 Enhanced Host Controller - 293C</Data>
    <Data Name="DeviceTotalTime">281</Data>
    <Data Name="DeviceDegradationTime">95</Data>
</EventData>
</Event>
Hope I sent the right info this time.
Donna in AR

Satellite L355-S7902
Donna, I wouldn't worry that Rasman (the Remote Access Connection Manager service) takes 17 seconds to shut down. And certainly the 0.095 seconds taken by the Usbehci.sys driver is inconsequential.
My Event Viewer is filled with stuff like this. Most users don't know to look here. Best to ignore it.
Pay more attention to what's in the Application and System logs under Windows Logs.
Hope I sent the right info this time.
In the future, leave out the stuff beginning with the line..
   Event Xml:
-Jerry

KB fix for print document name in event logs on Server 2012 and Server 2012R2

It appears as though the requested corrections to the documentation where never honored
Note After you apply the hotfix or update, you can show the printed document name in the event by enabling a specific Group Policy.
The policy name:
Computer Configuration \ Administrative Templates \ Printers
Allow job name in event logs
The Windows 8 / Server 2012 fix is:
Event ID 307 does not show the printed document name in Windows
http://support.microsoft.com/kb/2938013/en-us
2012R2 is in the April Roll up.
Windows RT 8.1, Windows 8.1, and Windows Server 2012 R2 Update: April 2014
http://support.microsoft.com/kb/2919355/en-us
Alan Morris Windows Printing Team

In my simple test, I see that the Group-Policy does exist on 2012R2 but not for 2012.
I isolated the registry changes so I can update a 2012 only system... that text is below.
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows NT\Printers]
"ShowJobTitleInEventLogs"=dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Printers]
"ShowJobTitleInEventLogs"=dword:00000001
I hope this helps others out since it took sometime to narrow this down. Thank you.

The event log file is full

Hi All
In Message monitoring(RWB) in adapter engine i am getting the following error
SOAP: response message contains an error XIAdapter/PARSING/ADAPTER.SOAP_EXCEPTION - soap fault: Server was unable to process request. ---> The event log file is full
Can any one suggest me what might be the problem
Thanks
Jayaraman
Edited by: Jayaraman P on May 20, 2010 4:27 PM
Edited by: Jayaraman P on May 20, 2010 4:28 PM

>
Jayaraman P wrote:
> SOAP: response message contains an error XIAdapter/PARSING/ADAPTER.SOAP_EXCEPTION - soap fault: Server was unable to process request. ---> The event log file is full
this is because of a problem at the WS server (it might mostly be a windows server).
You can request the WS team to have a look into this issue. it is not a PI problem.

WMIPRVSE.EXE (WMI) warning alerts in Event Logs

Hi To all. I have one major problem one of my supported Window Server 2008 R2 SP2. I see that in event logs randomly appears warning message :"Windows Management Instrumentation has stopped WMIPRVSE.EXE because a quota reached a warning
value. Quota: HandleCount Value: 4099 Maximum value: 4096 WMIPRVSE PID: 4268"
Looked for this topics and KB :
http://support.microsoft.com/default.aspx?scid=kb;EN-US;958124
http://support.microsoft.com/default.aspx?scid=kb;EN-US;954563
With no result. Any ideas about how to resolve this issue.
Thanks!

Hi Olegmg,
When a quota has been exceeded, there is no specific action required other than reducing the scope or number of operations requested of the provider hosted in the WMIPRVSE process. Event ID 5612 lists the PID of the WMIPRVSE
process that hosted the provider that exceeded the quota.
http://technet.microsoft.com/en-us/library/dd363619(v=ws.10).aspx
Regards.
Vivian Wang

Date format in log/error messages with Server Event Log

Hi :)
I have some question.
Current Date is printed at tterrors/ttmesg log files to add with "-showdate" option at $TIMESTEN_HOME/info/ttendaemon.options file.
But date when the TimesTen Server Event Log output is not displayed.
How to solve these case?
====
ttmesg.log
====
2010-05-17 09:40:00.11 Info: : 7409: maind: done with request #433.1657
09:40:00.13 Info: SRV: 31875: EventID=16| Connect succeeded from client: ttwell01 (ttwell01); IP address: 218.234.33.27; Client PID: 31870; DSN: ntsdb; UID: timesten
2010-05-17 09:40:27.84 Info: : 7409: maind got #434.1658, hello: pid=32076 type=utility payload=%00%00%00%00 protocolID=TimesTen 7.0.5.9.0.tt7059 ident=%00%00%00%00
====
====
ttendaemon.options
====
# Commented values are default values
#-supportlog /home/TimesTen/tt7059/info/ttmesg.log
#-maxsupportlogfiles 10
#-maxsupportlogsize 0x100000
#-userlog /home/TimesTen/tt7059/info/tterrors.log
#-maxuserlogfiles 10
#-maxuserlogsize 0x100000
-showdate
-verbose
-oracle_home /home/oracle11g
# Start the TimesTen OracleConnect GUI
-webserver
-server 17593
====
OS
====
Red Hat Enterprise Linux AS release 4 (Nahant Update 5)
Thanks
GooGyum

This is an issue that was discussed internally very recently. BUG 9719650 - -SHOWDATE OPTION NOT ENABLED FOR SRV MESSAGES has been logged to track the issue.

VSS snapshot of 1.1TB is ending after few hours with timeout. No errors in event log

Hello,
does someone have experienced issue where starting making snapshot (forum GUI or command line) is taking a lot of time and then it just ends with timeout?
I have scenario on virtualised Windows Web Server 2008 R2 where backup is being made by Idera Backup Software but since it relies on VSS Snapshots then we can just skip this point because making snapshots from directly Windows command line or drive preferences/GUI
is ending with timeout for this single drive after few hours. Affected system has 3 drives: C - 95GB, D-1.06TB and E-120GB. C and E can be backuped correctly and only drive D has problems. System is updated with latest drivers vssadmin for writers returns
list without any errors and snapshot for drive D which ends with timeout is not generating any error in event log. I wanted to configure VSS trace like it is being instructed on this site:
http://publib.boulder.ibm.com/infocenter/tsminfo/v6/index.jsp?topic=%2Fcom.ibm.itsm.tshoot.doc%2Ft_pdg_traceprfrm.html
but I don't see any trace.txt file on given location. If I remove drive D from backup process it ends without errors. System was restarted many times. Only thing which is visible in windows Event log (application part) is that "The VSS service is shutting
down due to idle timeout." about 4 hours after snapshot making proces is starting.
I've contacted Idera backup about this but they can't help too much if Windows snapshot process is failing. They suggested that something can be wrong with this drive but since this is virtualised machine and all of my VM are being stored on RAID10 disk
array connected to my server using fiber connections then I don't think that this is hardware issue (especially when other two drives are located on the same LUN on disk array).
Any suggestions?
Regards

Hi,
Do you create VMs on Hyper-V or VMWare? Based on research, possible causes could be:
1. Files changes in the volume is very huge. So the shadow size may be big and the current shadow storage my not able to hold it. And that’s cause the shadow copy creation failure.
2. The I/O in D drive is heavy and make the shadow copy I/O failed.
3. Server is too busy to handle the request.
4. The disk is heavily defragment.
Please refer to the articles to troubleshoot the issue:
Time-out errors occur in Volume Shadow Copy service writers, and shadow copies are lost during backup and during times when there are high levels of input/output
http://support.microsoft.com/kb/826936/en-us
VSS timeouts during backup? What could contribute to that?
https://blogs.technet.com/b/askpfeplat/archive/2012/09/12/vss-timeouts-during-backup-check-fragmentation.aspx
Regards,
Mandy
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

TREX 7.0 error in event log

A worker process with process id of '4316' serving application pool
'AppPool_SAP_TREX_02' has requested a recycle because it reached its
allowed request limit.
Hi I'm getting the above error in the system event log on my server. Has anyone seen this before?

- update TREX and KMC versions and patch levels
- see SAP note 845974 for recommendations

Version 6.84 produces many Event Logs

I have just updated from 6.83 to 6.84 and, although the software appears to be working fine, I am getting several events logged in the Application Event Log when my 6131 synchronises.
Event 1004
User NT AUTHORITY\NETWORK SERVICE
Detection of product '{A982E6CC-9F0D-4948-9B18-BDFD55DE4A72}', feature 'PCSuite', component '{9B373FD2-8E0A-4A76-80C7-63B6521FD237}' failed. The resource 'HKEY_CURRENT_USER\Software\Nokia\' does not exist.
Event 1001
User NT AUTHORITY\NETWORK SERVICE
Detection of product '{A982E6CC-9F0D-4948-9B18-BDFD55DE4A72}', feature 'Platform' failed during request for component '{7BA39C00-ED40-417C-8C5C-3804B2DDD646}'
Event 1004
User JSSOLUTIONS\John Smith
Detection of product '{A982E6CC-9F0D-4948-9B18-BDFD55DE4A72}', feature 'PCSuite', component '{9B373FD2-8E0A-4A76-80C7-63B6521FD237}' failed. The resource 'HKEY_CURRENT_USER\Software\Nokia\' does not exist.
Event 1001
User JSSOLUTIONS\John Smith
Detection of product '{A982E6CC-9F0D-4948-9B18-BDFD55DE4A72}', feature 'Platform' failed during request for component '{7BA39C00-ED40-417C-8C5C-3804B2DDD646}'
These 4 Event Log entries are repeated 3 more times.
I have tried uninstalling and reinstalling but to no avail.
I have checked the Registry and HKEY_CURRENT_USER\Software\Nokia\ does exist.
I have tried adding premissions to this key for NETWORK SERVICE (John Smith already has full premissions) again to no avail.
I am running version 6.84.10.3 of PC Suite and Windows XP Professional SP2.
Whilst this is not a big issue as the software appears to be working fine, I do like to keep clear Event Logs so would appreciate any help in getting rid of these annoying entries.
Many thanks.

Hi,
I tried to follow the post of miksu and patched with 6.84.10.4 but still the same problems...
/discussions/board/message?board.id=pcsuite&message.id=19801
So, like Jssolutions I reinstalled a previous version of Nokia PC Suite (v6.83.14.1). It works fine now... no more Event Logs
This former version can be downloaded on http://nds1.nokia.com/files/support/global/phones/software/Nokia_PC_Suite_683_rel_14_1_eng_web.exeMessage Edited by rabbyn on 23-Sep-200706:44 PM

Active Sync Error in Event Logs - Generated by Health Monitor Mailbox.

Receiving the event log entry below on an Exchange 2013 Mailbox Server (Server 2012 OS). No policies have been configured yet. Seems odd that by default the health mailbox would be blocked when default policy is allow. Anybody else seeing this?
Log Name:      Application
Source:        MSExchange ActiveSync
Date:          10/1/2013 11:59:16 AM
Event ID:      1021
Task Category: Requests
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      MYSERVER.mydomain.com
Description:
A non-compliant phone is trying to connect with Exchange ActiveSync. However, the Exchange ActiveSync mailbox policy for user [MYDOMAIN\HEALTLMAILBOXACCOUNT] and device ID [EASProbeDeviceId141] requires phones to be compliant before they synchronize with Exchange
ActiveSync.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
    <Provider Name="MSExchange ActiveSync" />
    <EventID Qualifiers="32772">1021</EventID>
    <Level>3</Level>
    <Task>1</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2013-10-01T17:59:16.000000000Z" />
    <EventRecordID>136375</EventRecordID>
    <Channel>Application</Channel>
    <Computer>MYSERVER.mydomain.com</Computer>
    <Security />
</System>
<EventData>
    <Data>MYDOMAIN\HEALTLMAILBOXACCOUNT</Data>
    <Data>EASProbeDeviceId141</Data>
</EventData>
</Event>

Did you find a solution for it?
I see the same error on our 4 Exchange 2013 Servers.
I have not. I just chalked it up to another broken item with Exchange 2013. Maybe it will be fixed by next year.

Crystal Reports XI Crashes When Reporting on Event Log

I have successfully connected to the event log on my local Windows 7 pc, as well as two different Windows 2003 server event logs. The report runs fine unless I include the field "DESCRIPTION" on the report. If I include that field, CR crashes with the following error in my event log:
Faulting application name: crw32.exe, version: 11.0.0.1282, time stamp: 0x422d5c77
Faulting module name: crheapalloc.dll, version: 9.2.0.4, time stamp: 0x422d5ade
Exception code: 0xc0000005
Fault offset: 0x00002454
Faulting process id: 0x17e0
Faulting application start time: 0x01ca58e2b9115606
Faulting application path: C:\Program Files (x86)\Business Objects\Crystal Reports 11\crw32.exe
Faulting module path: C:\Program Files (x86)\Common Files\Business Objects\3.0\bin\crheapalloc.dll
Report Id: fe7f7599-c4d5-11de-a50a-001e4fe037ce
I've found a few sites online that others have had the same problem, but I've not found a solution. Any suggestions from anyone here??

Hi Carla, I moved this post to the database connectivity forum.
It may be due to the size or of the text included int he description or MS is reporting the wrong size of the field.
Other issue is XI is not supported on Windows 7 due to the age of CR and newness of Windows 7. CR XI is no longer patchable nor will any new OS platforms be added.
What you can do though is download CR XI R2 for free and use your XI keycode to install it, then go to the Keycode Request site and get one for R2:
Go to this link: http://www.sdn.sap.com/irj/boc and download the trial version of CR XI R2 and use your XI keycode, then apply the patches which you can get to by clicking on the BusinessObjects tab above, then Downloads.
Test again and if it still fails you may have to wait for Service Pack 6 to come out, I believe we are adding Windows 7 to the supported OS's.
Thank you
Don

Event Log re-Lease request's

Similar Messages

Maybe you are looking for