HH3a Open WiFi entries in event log query - conne...

Here are the entries since 25 Sept. I know that these are probably persons unknown accessing the BTWiFi/FON signal ( I haven't used it) I am surprised at the sudden jump in frequency but am concerned at the length the connections can be open as some clearly exceed the 2 hours cut off limit eg the latest entry exceeds the 2 hrs , on 20 Nov up @ 7.57 and down @11.56 and on the 19th up @12.18 and down @21.26 plus the up @ 05.24 but not down.
I appreciate that these have no impact on my usage - unlimited anyway- but it just seems wrong to have the connections open for the length of time that they can be.
Can anyone shed any light on why at all?

CWMP is BTs remote configuration system which is used to change certain settings within the home hub, for some reason it forced a restart.
It may be worth resetting the home hub to factory default, as the configuration may be corrupted.
There are some useful help pages here, for BT Broadband customers only, on my personal website.
BT Broadband customers - help with broadband, WiFi, networking, e-mail and phones.

Similar Messages

Event Log Query

A while ago I noticed these entries in the Hub Event Log.
At the time there were no active PC's powered on. What does the entry "[CWMP] Connection Request NOT ALLOWED." indicate? It appears that a warm reset was trigered.
Who was Lua user in "SYSTEM reboot by Lua user"?
00:00:29   1 Jan WIRELESS interface turned on.
00:00:27   1 Jan usbmgr: start 0.4.8
00:00:19   1 Jan KERNEL Warm restart
04:16:34   7 Dec KERNEL Controlled restart
04:16:34   7 Dec SYSTEM timed reboot triggered by timeout
04:16:24   7 Dec FIREWALL event (1 of 37): created rules
04:16:24   7 Dec PPP link down (Internet) [86.130.16.75]
04:16:18   7 Dec FIREWALL replay check (1 of 1): Protocol: ICMP Src ip: 86.130.16.75 Dst ip: 62.239.169.176 Type: Destination Unreachable Code: Port Unreacheable
04:16:18   7 Dec VOIP: [2.0A] [***********] [FXS DECT1 DECT2 DECT3 DECT4 DECT5] REGISTER - SIP message sent
04:16:17   7 Dec DHCS server went down
04:16:17   7 Dec FIREWALL event (1 of 7): deleted rules
04:16:15   7 Dec SYSTEM reboot by Lua user
04:16:15   7 Dec CONFIGURATION saved by TR69
04:15:44   7 Dec [CWMP] Connection Request NOT ALLOWED.
Peter

CWMP is BTs remote configuration system which is used to change certain settings within the home hub, for some reason it forced a restart.
It may be worth resetting the home hub to factory default, as the configuration may be corrupted.
There are some useful help pages here, for BT Broadband customers only, on my personal website.
BT Broadband customers - help with broadband, WiFi, networking, e-mail and phones.

Event Viewer cannot open the event Log or Custom view. Verify that the Event log service is running or query is too long. The instance name passed was not recognized as valid by a WMI data provider(4201).

"Event Viewer cannot open the event Log or Custom view. Verify that the Event log service is running or query is too long. The instance name passed was not recognized as valid by a WMI data provider(4201)"
This error keeps cropping up now and again on most of our domain controllers (OS-2008 AND 2008R2)...Usually a restart fixes the issue however the issue repeats and security logs don't generate.
Any advice on how to fix this issue permanently would be greatly appreciated.

Please see this: https://social.technet.microsoft.com/Forums/windows/en-US/95987ca3-a1b2-4da6-95b7-d825d06cdac7/error-code-4201-the-instance-name-passed-was-not-recognized-as-valid-by-a-wmi-data-provider?forum=w7itprosecurity
You can also try rebuilding the WMI repository: http://blogs.technet.com/b/askperf/archive/2009/04/13/wmi-rebuilding-the-wmi-repository.aspx
This posting is provided AS IS with no warranties or guarantees , and confers no rights.
Ahmed MALEK
My Website Link
My Linkedin Profile
My MVP Profile

Large number of event Log entries: connection open...

Hi,
I am seeing a large number of entries in the event log of the type:
21:49:17, 11 Mar.
IN: ACCEPT [57] Connection closed (Port Forwarding: TCP 192.168.1.78:14312 <-->86.128.58.172:14312 [81.154.101.160:51163] CLOSED/TIME_WAIT ppp0 NAPT)
21:49:15, 11 Mar.
IN: ACCEPT [54] Connection opened (Port Forwarding: UDP 192.168.1.78:14312 <-->86.128.58.172:14312 [81.154.101.160:41820] ppp0 NAPT)
Are these anything I should be concerned about? I have tried a couple of forum and Google searches, but I don't quite know where to start beyond pasting the first bit of the message. I haven't found anything obvious from those searches.
DHCP table lists 192.168.1.78 as the desktop PC on which I'm writing this.
Please could you point me in the direction of any resources that will help me to work out if I should be worried about this?
A slightly longer extract is shown below:
21:49:17, 11 Mar.
IN: ACCEPT [57] Connection closed (Port Forwarding: TCP 192.168.1.78:14312 <-->86.128.58.172:14312 [81.154.101.160:51163] CLOSED/TIME_WAIT ppp0 NAPT)
21:49:15, 11 Mar.
IN: ACCEPT [54] Connection opened (Port Forwarding: UDP 192.168.1.78:14312 <-->86.128.58.172:14312 [81.154.101.160:41820] ppp0 NAPT)
21:49:15, 11 Mar.
IN: ACCEPT [54] Connection opened (Port Forwarding: TCP 192.168.1.78:14312 <-->86.128.58.172:14312 [81.154.101.160:51163] CLOSED/SYN_SENT ppp0 NAPT)
21:49:11, 11 Mar.
IN: ACCEPT [57] Connection closed (Port Forwarding: TCP 192.168.1.78:14312 <-->86.128.58.172:14312 [213.205.231.156:51027] TIME_WAIT/CLOSED ppp0 NAPT)
21:49:03, 11 Mar.
IN: ACCEPT [54] Connection opened (Port Forwarding: TCP 192.168.1.78:14312 <-->86.128.58.172:14312 [178.190.63.75:55535] CLOSED/SYN_SENT ppp0 NAPT)
21:49:00, 11 Mar.
IN: ACCEPT [57] Connection closed (Port Forwarding: TCP 192.168.1.78:14312 <-->86.128.58.172:14312 [2.96.4.85:23939] TIME_WAIT/CLOSED ppp0 NAPT)
21:48:59, 11 Mar.
IN: ACCEPT [57] Connection closed (Port Forwarding: TCP 192.168.1.78:14312 <-->86.128.58.172:14312 [78.144.143.222:21617] CLOSED/TIME_WAIT ppp0 NAPT)
21:48:58, 11 Mar.
IN: ACCEPT [54] Connection opened (Port Forwarding: UDP 192.168.1.78:14312 <-->86.128.58.172:14312 [41.218.222.34:28188] ppp0 NAPT)
21:48:57, 11 Mar.
IN: ACCEPT [54] Connection opened (Port Forwarding: TCP 192.168.1.78:14312 <-->86.128.58.172:14312 [41.218.222.34:28288] CLOSED/SYN_SENT ppp0 NAPT)
21:48:57, 11 Mar.
IN: ACCEPT [54] Connection opened (Port Forwarding: UDP 192.168.1.78:14312 <-->86.128.58.172:14312 [86.132.123.255:18048] ppp0 NAPT)
21:48:57, 11 Mar.
IN: ACCEPT [54] Connection opened (Port Forwarding: TCP 192.168.1.78:14312 <-->86.128.58.172:14312 [86.132.123.255:54199] CLOSED/SYN_SENT ppp0 NAPT)
21:48:55, 11 Mar.
IN: ACCEPT [57] Connection closed (Port Forwarding: UDP 192.168.1.78:14312 <-->86.128.58.172:14312 [86.144.91.49:60704] ppp0 NAPT)
21:48:55, 11 Mar.
IN: ACCEPT [57] Connection closed (Port Forwarding: TCP 192.168.1.78:14312 <-->86.128.58.172:14312 [80.3.100.12:50875] TIME_WAIT/CLOSED ppp0 NAPT)
21:48:45, 11 Mar.
IN: ACCEPT [57] Connection closed (Port Forwarding: UDP 192.168.1.78:14312 <-->86.128.58.172:14312 [78.150.251.216:57656] ppp0 NAPT)
21:48:39, 11 Mar.
IN: ACCEPT [54] Connection opened (Port Forwarding: TCP 192.168.1.78:14312 <-->86.128.58.172:14312 [78.150.251.216:56975] CLOSED/SYN_SENT ppp0 NAPT)
21:48:29, 11 Mar.
IN: ACCEPT [54] Connection opened (Port Forwarding: TCP 192.168.1.78:14312 <-->86.128.58.172:14312 [79.99.145.46:8368] CLOSED/SYN_SENT ppp0 NAPT)
21:48:27, 11 Mar.
IN: ACCEPT [54] Connection opened (Port Forwarding: UDP 192.168.1.78:14312 <-->86.128.58.172:14312 [90.192.249.173:45250] ppp0 NAPT)
21:48:16, 11 Mar.
IN: ACCEPT [57] Connection closed (Port Forwarding: UDP 192.168.1.78:14312 <-->86.128.58.172:14312 [212.17.96.246:62447] ppp0 NAPT)
21:48:10, 11 Mar.
IN: ACCEPT [57] Connection closed (Port Forwarding: TCP 192.168.1.78:14312 <-->86.128.58.172:14312 [82.16.198.117:49942] TIME_WAIT/CLOSED ppp0 NAPT)
21:48:08, 11 Mar.
IN: ACCEPT [54] Connection opened (Port Forwarding: TCP 192.168.1.78:14312 <-->86.128.58.172:14312 [213.205.231.156:51027] CLOSED/SYN_SENT ppp0 NAPT)
21:48:04, 11 Mar.
IN: ACCEPT [57] Connection closed (Port Forwarding: TCP 192.168.1.78:14312 <-->86.128.58.172:14312 [89.153.251.9:53729] TIME_WAIT/CLOSED ppp0 NAPT)
21:47:54, 11 Mar.
IN: ACCEPT [54] Connection opened (Port Forwarding: UDP 192.168.1.78:14312 <-->86.128.58.172:14312 [80.3.100.12:37150] ppp0 NAPT)

Hi,
Thank you for the response. I think, but can't remember for sure, that UPnP was already switched off when I captured that log. Anyway, even if it wasn't, it is now. So I will see what gets captured in my logs.
I've just had to restart my Home Hub because of other connection issues and I notice that the first few entries are also odd:
19:35:16, 12 Mar.
OUT: BLOCK [65] First packet is Invalid (TCP 192.168.1.78:49250->173.194.78.125:5222 on ppp0)
19:34:45, 12 Mar.
OUT: BLOCK [15] Default policy (First packet in connection is not a SYN packet: TCP 192.168.1.78:49266->173.194.34.101:443 on ppp0)
19:34:31, 12 Mar.
OUT: BLOCK [65] First packet is Invalid (TCP 192.168.1.78:49250->173.194.78.125:5222 on ppp0)
19:34:31, 12 Mar.
OUT: BLOCK [65] First packet is Invalid (TCP 192.168.1.78:49266->173.194.34.101:443 on ppp0)
19:34:04, 12 Mar.
OUT: BLOCK [15] Default policy (First packet in connection is not a SYN packet: TCP 192.168.1.78:49462->199.59.149.232:443 on ppp0)
19:33:46, 12 Mar.
OUT: BLOCK [65] First packet is Invalid (TCP 192.168.1.78:49250->173.194.78.125:5222 on ppp0)
19:33:46, 12 Mar.
IN: BLOCK [12] Spoofing protection (IGMP 86.164.178.188->224.0.0.22 on ppp0)
19:33:45, 12 Mar.
OUT: BLOCK [65] First packet is Invalid (TCP 192.168.1.78:49266->173.194.34.101:443 on ppp0)
19:33:39, 12 Mar.
OUT: BLOCK [65] First packet is Invalid (TCP 192.168.1.78:49462->199.59.149.232:443 on ppp0)
19:33:33, 12 Mar.
OUT: BLOCK [15] Default policy (First packet in connection is not a SYN packet: TCP 192.168.1.78:49463->199.59.149.232:443 on ppp0)
19:33:29, 12 Mar.
IN: BLOCK [15] Default policy (UDP 111.252.36.217:26328->86.164.178.188:12708 on ppp0)
19:33:16, 12 Mar.
IN: BLOCK [15] Default policy (TCP 193.113.4.153:80->86.164.178.188:49572 on ppp0)
19:33:14, 12 Mar.
OUT: BLOCK [65] First packet is Invalid (TCP 192.168.1.78:49266->173.194.34.101:443 on ppp0)
19:33:14, 12 Mar.
IN: BLOCK [15] Default policy (TCP 66.193.112.93:443->86.164.178.188:44266 on ppp0)
19:33:14, 12 Mar.
( 164.240000) CWMP: session completed successfully
19:33:13, 12 Mar.
( 163.700000) CWMP: HTTP authentication success from https://pbthdm.bt.mo
19:33:05, 12 Mar.
BLOCKED 106 more packets (because of Default policy)
19:33:05, 12 Mar.
OUT: BLOCK [65] First packet is Invalid (TCP 192.168.1.78:49462->199.59.149.232:443 on ppp0)
19:33:05, 12 Mar.
IN: BLOCK [15] Default policy (TCP 213.1.72.209:80->86.164.178.188:49547 on ppp0)
19:33:05, 12 Mar.
BLOCKED 94 more packets (because of Default policy)
19:33:05, 12 Mar.
OUT: BLOCK [15] Default policy (First packet in connection is not a SYN packet: TCP 192.168.1.78:49330->173.194.67.94:443 on ppp0)
19:33:05, 12 Mar.
IN: BLOCK [15] Default policy (TCP 199.59.148.87:443->86.164.178.188:49531 on ppp0)
19:33:05, 12 Mar.
OUT: BLOCK [65] First packet is Invalid (TCP 192.168.1.78:49250->173.194.78.125:5222 on ppp0)
19:33:04, 12 Mar.
OUT: BLOCK [65] First packet is Invalid (TCP 192.168.1.78:49266->173.194.34.101:443 on ppp0)
19:33:04, 12 Mar.
( 155.110000) CWMP: Server URL: https://pbthdm.bt.mo; Connecting as user: ACS username
19:33:04, 12 Mar.
( 155.090000) CWMP: Session start now. Event code(s): '1 BOOT,4 VALUE CHANGE'
19:32:59, 12 Mar.
OUT: BLOCK [65] First packet is Invalid (TCP 192.168.1.78:49266->173.194.34.101:443 on ppp0)
19:32:54, 12 Mar.
OUT: BLOCK [65] First packet is Invalid (TCP 192.168.1.78:49462->199.59.149.232:443 on ppp0)
19:32:53, 12 Mar.
OUT: BLOCK [65] First packet is Invalid (TCP 192.168.1.78:49330->173.194.67.94:443 on ppp0)
19:32:52, 12 Mar.
OUT: BLOCK [65] First packet is Invalid (TCP 192.168.1.78:49463->199.59.149.232:443 on ppp0)
19:32:51, 12 Mar.
OUT: BLOCK [65] First packet is Invalid (TCP 192.168.1.78:49266->173.194.34.101:443 on ppp0)
19:32:48, 12 Mar.
OUT: BLOCK [65] First packet is Invalid (TCP 192.168.1.78:49330->173.194.67.94:443 on ppp0)
19:32:47, 12 Mar.
OUT: BLOCK [65] First packet is Invalid (TCP 192.168.1.78:49266->173.194.34.101:443 on ppp0)
19:32:46, 12 Mar.
OUT: BLOCK [65] First packet is Invalid (TCP 192.168.1.78:49330->173.194.67.94:443 on ppp0)
19:32:46, 12 Mar.
BLOCKED 4 more packets (because of First packet is Invalid)
19:32:45, 12 Mar.
OUT: BLOCK [15] Default policy (First packet in connection is not a SYN packet: TCP 192.168.1.78:49461->199.59.149.232:443 on ppp0)
19:32:44, 12 Mar.
OUT: BLOCK [65] First packet is Invalid (TCP 192.168.1.78:49330->173.194.67.94:443 on ppp0)
19:32:44, 12 Mar.
BLOCKED 1 more packets (because of First packet is Invalid)
19:32:43, 12 Mar.
OUT: BLOCK [15] Default policy (First packet in connection is not a SYN packet: TCP 192.168.1.78:49398->193.113.4.153:80 on ppp0)
19:32:42, 12 Mar.
OUT: BLOCK [65] First packet is Invalid (TCP 192.168.1.78:49330->173.194.67.94:443 on ppp0)
19:32:42, 12 Mar.
BLOCKED 3 more packets (because of First packet is Invalid)
19:32:42, 12 Mar.
OUT: BLOCK [15] Default policy (First packet in connection is not a SYN packet: TCP 192.168.1.78:49277->119.254.30.32:443 on ppp0)
19:32:41, 12 Mar.
OUT: BLOCK [65] First packet is Invalid (TCP 192.168.1.78:49330->173.194.67.94:443 on ppp0)
19:32:41, 12 Mar.
BLOCKED 1 more packets (because of First packet is Invalid)
19:32:41, 12 Mar.
OUT: BLOCK [65] First packet is Invalid (TCP 192.168.1.78:49330->173.194.67.94:443 on ppp0)
19:32:38, 12 Mar.
OUT: BLOCK [15] Default policy (First packet in connection is not a SYN packet: TCP 192.168.1.78:49280->119.254.30.32:443 on ppp0)
19:32:36, 12 Mar.
OUT: BLOCK [65] First packet is Invalid (TCP 192.168.1.78:49330->173.194.67.94:443 on ppp0)
19:32:34, 12 Mar.
OUT: BLOCK [65] First packet is Invalid (TCP 192.168.1.78:49463->199.59.149.232:443 on ppp0)
19:32:30, 12 Mar.
IN: BLOCK [15] Default policy (TCP 66.193.112.93:443->86.164.178.188:47022 on ppp0)
19:32:30, 12 Mar.
( 120.790000) CWMP: session closed due to error: WGET TLS error
19:32:30, 12 Mar.
( 120.140000) NTP synchronization success!
19:32:30, 12 Mar.
BLOCKED 1 more packets (because of Default policy)
19:32:29, 12 Mar.
OUT: BLOCK [15] Default policy (First packet in connection is not a SYN packet: TCP 192.168.1.78:49458->217.41.223.234:80 on ppp0)
19:32:28, 12 Mar.
OUT: BLOCK [65] First packet is Invalid (TCP 192.168.1.78:49280->119.254.30.32:443 on ppp0)
19:32:26, 12 Mar.
( 116.030000) NTP synchronization start
19:32:25, 12 Mar.
OUT: BLOCK [15] Default policy (First packet in connection is not a SYN packet: TCP 192.168.1.78:49442->74.125.141.91:443 on ppp0)
19:32:25, 12 Mar.
OUT: BLOCK [15] Default policy (TCP 192.168.1.78:49310->204.154.94.81:443 on ppp0)
19:32:25, 12 Mar.
IN: BLOCK [15] Default policy (TCP 88.221.94.116:80->86.164.178.188:49863 on ppp0)

'Open Wifi' Event Log in HH4

Can someone confirm for me that I have understood 'Open WiFi correctly please?
Just looked at the event log in HH4 for 'Open Wi-Fi' - I assume this is the wi-fi that other users can access via my setup?
One log (for 30th Sept) shows 'Connection is up' at 13:09:03 and down at 13:24:23 so basically someone else was accessing the net through my setup then during this time?
Just opted out!

I wasn't quite correct when I said the broadband dropped, what happens is our devices won't connect, the light is blue. I took my ipad right up to the home hub and it still wouldn't connect, my husband's phone wouldn't either. When I googled it, all I could find was that too many devices may be using it, 2? It's happened several times this month always about 11pm, then I discover we've used over 70gb more than usual. There definitely seems to be some mystery heavy usage download occurring, could it be the home hub updating it's software? I noticed it said last updated 25/4 and that was the last time it showed multiple open wifi ups and downs at the same time we couldn't use it. I'm going to monitor it more closely to see if there's some pattern to this.

HH3A event log entries - firewall

I have recently received a replacement hub and in the event log am getting loads of the following entries - is this usual (IP address is my laptop)
23:59:57, 15 May.
(458348.960000) Port forwarding rule added via UPnP. protocol: UDP, external ports: any->49744, internal ports: 49744, internal client: 192.168.1.64
23:59:16, 15 May.
(458308.430000) Port forwarding rule added via UPnP. protocol: UDP, external ports: any->49744, internal ports: 49744, internal client: 192.168.1.64
Also when I do a tracert I get the following as the first line
1     3 ms     2 ms     1 ms api.home [192.168.1.254]
I am only confused because on the old hub the firewall entries were
20:50:11, 30 Apr.
BLOCKED 1 more packets (because of Spoofing protection)
20:50:09, 30 Apr.
IN: BLOCK [12] Spoofing protection (IGMP 86.157.215.96->224.0.0.22 on ppp0)
and the tracert was
1     1 ms    <1 ms    <1 ms BThomehub.home [192.168.1.254]
I presume that nothing is amiss
Solved!
Go to Solution.

conrad wrote:
Many thanks DS - have turned UPnP off.
Why is this comment displayed "It is recommended to keep the Extended UPnP security enabled to ensure the security of your home network." Presumably not having it enabled is ok.
The spoofing stuff was obviously caused by me switching between wired/wireless as part of my line problems but thanks for the info as no doubt it will occur again.
No problem
The extended UPnP is a new item that BT have added to the latest firmware on the hub3. TBH I've not looked in to what this actually means as I've always turned UPnP off, even from when I was using the HH2.
The spoofing events will return if you flick between each method of connecting, unless you delete the method not in use
-+-No longer a forum member-+-

Questions about BT Home Hub 4A event log - WIFI c...

Hope someone can help please ?
I had BT inifinity installed 2 weeks ago with the HH 4 (type A) and everything has worked - connection found, no problem.
This week, my ipod touch was unable to join the network but the iphone 5, another ipod and a tablet could connect without a problem. The ipod touch managed to connect to another WIFI used at the property and my work wifi without a problem.
I thought it maybe the ipod touch as it was quite old but that doesn't make sense since it connects fine to other networks. I restored network settings and other options suggested by Apple but to no avail.
I have turned my attention to the Hub. My laptop (older than the ipod touch) gets the connection no problem along with the other devices. I went into the hub management page but I am not smart enough to decifer the event log so would like some help so I can fix this because I thought BT infinity was the better more reliable option?
The ipod touch Wifi IP address is 00:25:00:b7:35:f6.
On the event log, it shows STA before the address - but it shows STA before all the device IP addresses. Should I change this to DCHP ? or is this (Static ? alright)
The Lease on all the devices on the event log is set to 1440 min. (1 day) is that alright too, what does it mean ?
Do I have to keep renewing the lease ? How do I do that ? I read it can be set to 21 days ?
Going back to the IP address on the ipod it shows the Hostname as 00:25:00:B7:35:f6-2 this is different to the IP address with the -2. Could that be a cause of the unable to join network or is it because I attempted to recreate the network on the ipod so its the second version of that host name ?
Is there any setting I can change to fix this because I am concerned the same this will happen to the other devices and then the laptop....
What do I need to do to be able to get my ipod touch to connect to the BT network setting ?
I think its the hub 4A causing the 'block' on the ipod touch not the device and I think its maybe a matter of changing a setting - but then why was it all fine before when Infinity was first installed ?
Lastly my laptop (7 Years old) seems to be attached to the 5GHZ Wireless channel - is that alright ? The other more recent devices are on the 2.4ghz channel (except the ipod touch which isn't on any !!)
Is it alright to turn the hub on / off ? -I am resisting that because I don't want to make the situation worse.
Sorry but what does client disassociated mean and all the BLOCKS - do they relate to firewall ?
Please can you review the event log and my questions ?
Many thanks
angie 2601
The time frame is 3.55am 8/8/2013 - 7.16 am 8/8/2013
(Latest (7.16am) at the top
Message
07:16:39, 08AUG
(1224785.050000) Admin login successful by 192.168.1.64 on HTTP (1224766.610000) Admin login FAILED by 192.168.1.64 on HTTP (1224648.050000) New GUIsession from IP 192.168.1.64
(1224466.770000) Device disconnected: Hostname: Unknown-d8:dl:cb:ec:a6:fe
IP: 192.168.1.65 MAC: d8:d1:cb:ec:a6:fe
wlan1: STA d8:d1:cb:ec:a6:fe IEEE 802.11: Client disassociated
(1224362.750000) lease for IP 192.168.1.65 renewed by host Unknown d8:d1:cb:ec:a6:fe (MAC d8:d1:cb:ec:a6:fe).lease duration:1440 min (1224362.750000) Device connected: Hostname:Unknown-d8:d1:cb:ec:a6:feiP:
192.168.1.65 MAC:d8:dl:cb:ec:a6:fe lease time: 1440 min. link rate:90.0 Mbps
(1224362.690000) Lease requested
wlan1: STA d8:d1:cb:ec:a6:fe IEEE 802.11:Client associated
(1224241.150000) lease for IP 192.168.1.64 renewed by host FAMILY (MAC
00:13:02:de:6d:e6). Lease duration:1440 min
(1224241.150000) Device connected: Hostname: FAMii.Y IP:192.168.1.64 MAC:
00:13:02:de:6d:e6 Lease time: 1440 min. link rate: 54.0 Mbps
(1224241.090Cl00) Lease requested
wlan1TA 00:13:02:de:6d:e6 IEEE 802.11:Client associated
OUT: BLOCK [9] Packet invalid in connection (TCP
192.168.1.66:34905->31.13.72.38:443 on ppp1)
(1223644.770000) Device disconnected: Hostname: Unknown-d8:dl:cb:ec:a6:fe
IP: 192.168.1.65 MAC: d8:d1:cb:ec:a6:fe
wlanl: STA d8:d1:cb:ec:a6:-fe IEEE 802.11:CHent diSassociated
(1223489.390000) Lease for IP 192.168.1.65 renewed by host Unknown d8:d1:cb:ec:a6:fe (MAC d8:d1:cb:ec:a6:fe).lease duration:1440 min (1223489.380000) Device connected:Hostname:Unknown-d8:dl:cb:ec:a6:fe IP:
192.168.1.65 MAC: d kd1:cb ec:-a6-:fe Lease time: 1440 min. Link rare: 90.0 Mbps
(1223489.330000) Lease requested
wlan1: STA d8:d1:cb:ec:a6:fe IEEE 802.11: Client associated wlan1TA d8:d1:cb:ec:a6:fe IEEE 802.11: Client disasSociated
wlan1TA d8:d1:cb:ec:a6:fe IEEE 802.11:Client associated
OUT;BLOCK [9] Packet i valid in connection (TCP
192.168.1.66:34375->31.13.72.38:443 on pppl)
l'N':BLOCK [16-} Remote administration {ICMP type 8 code 0
117.1.42.94->86.182.228.205 on ppp1)
IN: BLOCK [9] Packet invalid in connection (TCP
31.13.72.33:443->86.182.228.205:44156 on ppp1) IN: BLOCK [9] Packet invalid in connection (TCP
31.13.72.33:443->86.182.228.205:36615 on ppp1)
OUT: BLOCK [9] Packet invalid in connection (TCP
192.1-68.1.68:49476->173.252.103.16:443 OR ppp1)
BLOCKED 5 more packets (because of Packet invalid in connection) OUT: BLOCK [9] Packet invalid in connection (TCP
192.168.1.68:49443->95.100.195.205:443 on ppp1)
OUT:BLOCK {9] PaCket invalid in connection (TCP
192.168.1.68:49438->95.100.194.217:443 on ppp1)
IN:BLOCK [9] Packet invalid in connection (TCP
95.100.194.217:443->86.182.228.205:49444 on ppp1)
(1222111.810000) Lease for IP 192.168.1.68 renewed by host Unknown-
70:56:81:46:bf:d9 (MAC 70:56:81:46:bf:d9).Lease duration:1440 min
(1222111.810000) Device connected:Hostname:Unknown-70:56:81:46:bf:d9 IP:,
192.168.1.68 MAC:70:56:8:t:46:bf:d9lease time:1440 min. Link rate:52.0 Mbps
(1222111.750000) Lease requested .-
wlanO: STA 70:56:81:46:bf:d9 IEEE 802.11: Client associated • (1222093.690000) Device dlsconn: Hostname:Unknown-
00:25:00:b7:35:f6-2 IP: 192.168. MAC: 00:25:00:b7:35:f6 wlanoTA 00:25:00:b7:35:f6 IEEE 802.11:Client disassociated
OUT:BLOCK [9] Packet invalid in connection (TCP
192.168.1.66-:43272->31.13.72.33:443 on ppp1)
221969.130000) lease for IP 192.168.1.67 renewed by host Unknown-
00:25:00:b7:35:f6-2 (MAC 00:25:00:b7:35:f6). lease duration:1440 min
(1221969.130000} Devicconnected: Hostname·:Unknowwoo·:25:00:b7 35:f6-2
IP: 192.168.1.67 MAC: 00:25:00:b7:35:f6 Lease time: 1440 min. Unk rate: 54.0
Mbps
(1221969.070000) Lease requested
wlanO: STA 00:25:00:b7:35:f6 IEEE 802.11:Client associated
(1220365.290000) Device disconnected: Hostname:Unknown-
00:25:00:b7:35:f6-2 IP: 192.168.1.67 MAC: 00:25:00:b7:35:f6 wlanOTA 00:25:00:b7:35:f6 IEEE 802.11:Client disassociated
(1220348.230000) Lease for IP 192.168.1.67 renewed by host Unlmown-
00:25:00:b7:35:f6-2 (MAC 00:25:00:b7:35:f6).lease duration: 1440 min
(1220348.230000) Device connected: Hostname:Unknown-00:25:00:b7:35:f6-2
IP: 192.168.1.67 MAC: 00:25:00:b7:35:f6 Lease time: 1440 min. Unk rate: 54.0
Mbps
(1220348.170000) lease requested
wlanOTA 00:25:00:b7:35:f6 IEEE 802.11:Client associated
IN: BLOCK f16] Remote administration (TCP
123.151.42.61:12233->86.182.228.205:8080 on ppp1) OUT: BLOCK [9] Packet invalid in connection (TCP
:t92.Hi8.1.66:53813->31.13.72.33:443 on ppp1)
OUT:BLOCK [9] Packet invalid in connection (TCP
192.168.1.66:43989->31.13.72.33:443 on ppp1)
IN: BLOCK [16] Remote administration (ICMP type 8 rode 0
2.7.251.109.227->86.182.228.205 on pppl)
(1216770.650000) Device disconnected:Hostname:Unknown-
00:25:00:b7:35:f6-2 IP: 192.168.1.67 MAC: 00:25:00:b7:35:f6
OUT:BLOCK [9j Packet invalid in connection (TCF
192.168.1.67:49180->74.125.136.109:993 on ppp1)
wlanOTA 00:25:00:b7:35:f6 IEEE 802.11:Client disassociated
(1216753.280000) Lease for IP 192.168.1.67 renewed by host Unknown-
00:25:00:b7:35:f6-2 (MAC 00:25:00:b7:35:f6). lease duration:1440 min
(1216753.270000) Device connected: Hostname: Unknown-00:25:00:b7:35:f6-2
IP: 192.168.1.67 MAC: 00:25.:00-:.b7.:35:f6 Lease time: 1440 min. Unk rate: 54.0
Mbps
(1216753.220000) lease requested
wlanO: STA 00:25:00:b7:35:f6 IEEE 802.11:Client assodat
OUT: BLOCK [9] Packet invalid in connection (TCP
192.168.1.66:55944->23.21.78.229:443 on ppp1)
OUT: BLOCK [9J Packet invafid in connection (TCP
192.168.1.66:34794->31.13.72.33:443 on ppp1)
OUT:BLOCK [9] Packet invalid in connection (TCP
192.168.1.66:41441->31.13.72.33:443 on ppp1)
{1213176.020000) Device disconnected:.Hostname:Unknown-
00:25:00:b7:35:f6-2 IP: 192.168.1.67 MAC:00:25:00:b7:35:f6 wlanO: STA 00:25:00:b7:35:f6 IEEE 802.11: Client disassociated
(1213158.410000) Lease for IP 192.168.1.67 renewed by host Unknown-
00:25:00:b7:35:f6-2 (MAC 00:25:00:b7:35:f6). lease duration:1440 min _./:\ (1213158.400000) Device connected:Hostname:Unknown-00:25:00:b7:35:ftt.Y IP: 192.168.1.67 MAC: 00:25:00:b7:35:f6 Lease time: 1440 min.Unk rate: 54.0
Mbps
(1213158.340000) Lease requested
wlanO: STA 00:25:00:b7:35:f6 IEEE 802.11: Client associated
OUT:BLOCK (9] Packet invalid in connection (TCP
192.168.1.66:59767->176.34.180.243:443 on ppp1) OUT;BLOCK [9] P.acket invalid in connection {TCP
192.168.1.66:56075->31.13.72.33:443 on ppp1) OUT: BLOCK [9] Packet invalid in connection (TCP
192.168.1.66 581:1:0->31.13.72.33:443 on ppp1)
BL.OCKED 2 more packets (because of Packet invalid in connection) OUT:BLOCK [9] Packet invalid in connection (TCP
192.168.1.66:56251->31.13.72.33:443 on ppp1)
OUT:BLOCK [9] Packet invalid in connection (TCP
192.168.1.66:36959->31.13.72.33:443 on ppp1)
BlOCKED 1more packets (because of Packet invalid in connection)

It could be that the Ipod touch is having problems with both the 2.4GHz and 5GHz frequencies being named the same. If you give them separate SSids it may help. ie add a 5 to the 5GHz SSid.
If you do this you will need to re-connect all your devices that can see both frequencies to both SSids so that they will swap between the frequencies seamlessly when ever they need to
See link how to change SSid.
http://bt.custhelp.com/app/answers/detail/a_id/44504/related/1/session/L2F2LzEvdGltZS8xMzc1OTY2ODIxL...
Once you have changed the SSid I would delete the network connection on the Ipod touch and start again.

Mysterious repeat log entries in System events log

I tried unsuccessfully to share internet connection with 2 iMacs without router(That doesn't matter). But after this, my iMac (24" 2.8 GHz) not networked or on internet now shows this repeated log entries every minute:
com.apple.launchd[1] (com.apple.InternetSharing): Throttling respawn: Will start in 10 seconds
This message gets repeated every minute on System events log. Daily, Monthly maintenance was not done automatically earlier today on this iMac (usually it did without any problem) which was on all-night.
I checked with Disk Utility, repaired permissions. Although no problems in working, this continuous log writings disturbs me.
Thanks for any help & Happy New Year!
Best.

Thanks, V.K. Did that (was asked password). System log showed after restart:
com.apple.launchd[1] (com.apple.InternetSharing[152]): Exited with exit code: 1
com.apple.launchd[1] (com.apple.InternetSharing): Throttling respawn: Will start in 10 seconds
com.apple.launchd[1] (com.apple.InternetSharing153): Exited with exit code: 1
com.apple.launchd[1] (com.apple.InternetSharing): Throttling respawn: Will start in 10 seconds
Then it started again the same way as above - with each aditional line each time as shown above. Thanks for sticking with me on this. Hope you will offer other suggestions.
Best.

Cannot open eventlog service on computer '.'. (Windows Event Log service doesn't exist)

This problem used to be solved after moving a computer object into the appropriate OU and restarting, and if that didn't work, it used to be solved when uninstalling and reinstalling Microsoft FEP (restarts in-between). Now, the only way to access
event logs is by logging in as a domain admin, or by accessing event logs through remote manage.
If a machine object is added to the domain, dropped into the computers container, and restarted, we get this error when going into Computer Management:
"Cannot open eventlog service on computer '.'."
The original problem was noticed on our VMs, but I also tried it with a Lenovo Windows 7 build out of the box, added it to our domain, and the problem occurred. When our desktops are built, SCCM's task manager drops it into the appropriate OU immediately,
so desktops don't have issues. With VMs, they are dropped into the computers container and restarted, so once this problem occurs, it almost never leaves. SOMETIMES, removing it from the domain solves the problem, but not always.
I've tried all of the suggestions I've seen online and none of them have worked, such as cleaning up the policies (through registry, and the appropriate system folders), adding the proper NTFS permissions on the RtBackup folder and %SystemRoot%\System32\winevt\logs, netsh
winsock reset, cleanboot, etc.
I did notice that I'm unable to find the NT Service\EventLog user group. I wanted to add it to %systemroot%\system32\winevt\logs, but the group cannot be found on the local computer. Even if that's the problem, why is it missing?
It doesn't seem like anyone else on the internet gets this exact error.

Hi Kate!
Yes, the Windows Event Log service is missing. I had already tried your method (#3), and I did try it again. This is the error I get:
"The specified service already exists."
If you check services.msc, it's still not there. If you try to start the Event Viewer, the same error comes up:
Cannot open eventlog service on computer '.'.
Hi,
Please check for the existence of this key. If not found, create a *.reg file from another machine and import.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog
Then, check the issue again.
If this doesn't work, let's run System file checker tool to repair system:
Run SFC command in elevated command prompt
SFC /scannow
Any error message, please post here to let me know.
Keep post.
Kate Li
TechNet Community Support

Event log entries missing in PoSh but visible in Eventvwr

Hi,
I've noticed the following issue on about 10 out of 2500 computers which run a script on our domain, so its minor, but I'd like to understand why its happening.
When I query the event log using the eventvwr GUI I can filter on event ID 7001 and all the events list fine. However when I run 'get-eventlog -logname system -instanceid 7001' it shows all the events except the last 3 or so most recent ones (which are visible
in the GUI).
I've cross referenced this with an event visible in the GUI that had an EventRecordID of 32029. But when querying this via PowerShell 'get-eventlog -logname system -index 32029' it returns 'no matches found'.
Its a weird problem, because if I was to query to logs in a few hours time after a few more people have logged on/off the computer then the event would show in PowerShell, but the new most recent ones wouldn't.
Is there a caching mechanism at work, and if so how could I disable it? Its interesting that these machines are all built from the same WDS image with the same GPO's applied but only a very small percentage exhibit this issue, all other machines show recent
event logs in PowerShell instantly.
I should also mention that these are all Windows 7 x64 computers.
Any help appreciated.
Thanks,
Phil

Hi,
Based on my understanding, only some of your computers have this issue. And when use WMI, we could query all of the events, but when use powershell command, some logs are missing.
I would like to know that when we use 'get-eventlog -logname system -instanceid 7001| out-file c:\result.txt', how many logs are there?
What I think it may caused by there are so many logs information, and could not be dispalyed out. We may try some other logs also.
Regards,
Yan Li
TechNet Subscriber Support
If you are
TechNet Subscription
user and have any feedback on our support quality, please send your feedback
here.
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

Since applying Feb 2013 Sharepoint 2010 CUs - Critical event log entries for Blob cache and missing images

Hi,
Since applying the February 2013 SharePoint 2010 updates, we are getting lots of entries in our event logs along the following:
Content Management Publishing Cache
5538 Critical
An error occurred in the blob cache. The exception message was 'The system cannot find the file specified. (Exception from HRESULT: 0x80070002)’
In pretty much all of these cases the image/ file in question that is reported in the ULS logs as missing is not actually in the collaboration site, master page / html etc so the fix needs to go back to the site owner to make the correction to avoid
the 404 (if they make it!). This has only started happening, I believe since feb 2013 sp2010 cumulative updates updates
I didn’t see this mentioned as a change / in the Fix list of the February updates. i.e. it flags up a critical error in our event logs. So with a lot of sites and a lot of missing images your event log can quickly fill up.
Obviously you can suppress them in the monitoring -> web content management ->publishing cache = none & none which is not ideal.
So my question is... are others seeing this and was a change made by Microsoft to flag a 404 missing image / file up a critical error in event log when blob cache is enabled?
If i log this with MS they will just say, you need to fix it up the missing files in the site but would be nice to know this had changed prior! I also deleted and recreated the blob cache and this made no diffference
thanks
Brad

I'm facing the same error on our SharePoint 2013 farm. We are on Aug 2013 CU and if the Dec CU (which is supposed to be the latest) doesn't solve it then what else could be done.
Some users started getting the message "Server is busy now try again later" with a corelation id. I looked up ULS with that corelation id and found these two errors in addition to hundreds of "Micro Trace Tags (none)" and "forced
due to logging gap":
"GetFileFromUrl: FileNotFoundException when attempting get file Url /favicon.ico The system cannot find the file specified. (Exception from HRESULT: 0x80070002)"
"Error in blob cache. System.IO.FileNotFoundException: The system cannot find the file specified. (Exception from HRESULT: 0x80070002)"
"Unable to cache URL /FAVICON.ICO. File was not found"
Looks like this is a bug and MS hasn't fixed it in Dec CU..
"The opinions expressed here represent my own and not those of anybody else"

S7 event log Protocol Error: Handheld File could not be opened (4004)

Every time I do a hotsync now, I get an error message indicating that two files were not successfully back up: "S7 Event Log" and "EX_New Stories". Both inidcate "Protocol Error: Handheld File could not be opened (4004)." Does anybody know how to fix this?
Post relates to: Centro (Sprint)

No need to complicate the Forum with duplicate posts...
Using the Search function here on the Forum, you'll find many posts that offer solutions to your problem. I searched for "4004", and found many matches.
One like this one may help.
WyreNut
I am a Volunteer here, not employed by HP.
You too can become an HP Expert! Details HERE!
If my post has helped you, click the Kudos Thumbs up!
If it solved your issue, Click the "Accept as Solution" button so others can benefit from the question you asked!

[UNSOLVED] Event Log Custom XML Query Filtering Help

I've looked at a few different posts but I must be missing something because what I'm constructing isn't working.
Here's the XML code of an example event:
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="ERAS WCF" />
<EventID Qualifiers="0">0</EventID>
<Level>4</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2014-07-09T20:32:51.000000000Z" />
<EventRecordID>899070</EventRecordID>
<Channel>Application</Channel>
<Computer>server.f.q.d.n</Computer>
<Security />
</System>
- <EventData>
<Data>User [email protected] has submitted 'Get BIOS Information' operation from servername to computername.f.q.d.n.</Data>
</EventData>
</Event>
This is my query:
<QueryList>
<Query Id="0">
<Select Path="Application">*[EventData[Data and (Data='computername' or Data='ip.add.re.ss')]]</Select>
</Query>
</QueryList>
I always get 0 results, even if I take stabs in the dark:
*[System[(Level=1 or Level=2 or Level=3 or Level=4 or Level=0 or Level=5)]]
*[EventData[Data and (Data='*computername*')]]
*[EventData[Data and (Data='%computername%')]]
I used this post as my guide for filtering based on content: http://blogs.technet.com/b/askds/archive/2011/09/26/advanced-xml-filtering-in-the-windows-event-viewer.aspx
Also:
I hope this is the right place for this question. This said to post in the server
forums, but in
the server forums, it said to post here.
I happen to be doing this on a server, but it could just as easily be a desktop.

Hello,
Thanks for posting question to this forum. Since this forum is related with XPath, what I can do is to help you validate your XPath query. With your query, I tested them with my computer, however, all of them could load event record correctly:
Query:*[EventData[Data and (Data='Office12AssertTimer' or Data='6.3.9600.17031')]]
Result:
Query:*[System[(Level=1 or Level=2 or Level=3 or Level=4 or Level=0 or Level=5)]]
Result:
So your XPath query is ok. Do you have a try to use the same query to filter the event log to check if there are records with another computer? I am wondering if there is something wrong with your current computer.
And since the XPath is ok, I would like suggest you posting it to the server forum to see if there are others looking into it.
Regards.
We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time. Thanks for helping make community forums a great place.
Click
HERE to participate the survey.

Hub3 Event Log - erroneous entries need explainati...

My first post so please be gentle.
My BB went off today and when it came back it was very slow and I couldn't connect to any web page (which is not like my service which is usually top notch).
I looked in the Event Log and there were a couple of entries around the time of the disconnection which made me very suspicious.
19:42:15, 20 Nov. (5875284.760000) Server URL: https://pbthdm.bt.motive.com; Connecting as user: ACS username
19:42:13, 20 Nov. (5875282.470000) Initializing transaction for event code 2 PERIODIC
I started a Chat with someone & needless to say (unfortunately) they were about as much use as a chocolate fire guard. Disconnect this, check that - oh no not the 'take the face plate off & use the test socket' lark - can you not explain what's happened? NO
Ever since then my service is extremely slow and connection is intermittent. Can anyone explain what these message mean? Even if they have nothing to do with my current situation it would still be nice to know what they mean.
Thanks

"https://pbthdm.bt.motive.com;" that is the link BT use for provisioning servers incase your Hub is going to be upgraded, the Hub will check sometimes to see if there is a newer version.
As for your slow speed problems would you mind doing the following?
Can you please post your ADSL stats by following this direct link; http://192.168.1.254/ and go to A-Z (top right) and then ADSL Settings and post everything including Line Attenuation, Noise Margin, Connection Speed, Errors etc...
Also we need a speedtest just to have a look and make sure everything's okay? Use this link http://bit.ly/uViAXN and post all the required info Throughput, IP Profile etc..). If that one doesn't work then try this work around link http://bit.ly/uV4DdK .
Run a line test to determine if or not it is an external problem: http://goo.gl/J25w8
Can you also confirm if you're connected at the master socket or an extension? And what your type your master socket is according to this picture
Lastly for now, call 17070 and Press Option 2 for the Quiet Line test and where possible use a corded phone as DECT handsets can pick up electrical interference?
Regards Edd
Check your Line
BT Speedtester

Query Event Log

I would like to use a PowerShell script to check compliance on several systems. What I would like is a script that would: query the events in a specific event log for the last 24 hours, look for a specific event and report back compliant.
Can anyone show me how this could be possible?

You can use the Get-EventLog cmdlet as it has a -ComputerName parameter, or you can use Invoke-Command and it's -ComputerName and -ScriptBlock parameter along with Get-EventLog. Invoke-Command is likely faster but will require that you have WinRM/PSRemoting
in place. Here's an example of both, but I also would recommend you look in the gallery, as jrv suggested, since gathering event logs is a topic that comes up often. You should also take a look at the parameters on Get-EventLog so you can determine how you
intend to look for specific events.
http://technet.microsoft.com/en-us/library/hh849834.aspx
$LogName = 'System'
$Computers = 'Computer01','Computer02','Computer03'
$Date = (Get-Date).AddHours(-24)
Get-EventLog -LogName $LogName -ComputerName $Computers -After $Date
$LogName = 'System'
$Computers = 'Computer01','Computer02','Computer03'
$Date = (Get-Date).AddHours(-24)
Invoke-Command -ComputerName $Computers {
Get-EventLog -LogName $args[0] -ComputerName $args[1] -After $args[2]
} -ArgumentList $LogName,$Computers,$Date

HH3a Open WiFi entries in event log query - conne...

Similar Messages

Maybe you are looking for