More Event Logs in Production Servers

The description for Event ID 0 from source Microsoft Deployment Agent cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local
computer.
If the event originated on another computer, the display information had to be saved with the event.
The following information was included with the event: 
Timestamp: 3/23/2015 1:00:01 AM
Message: Object reference not set to an instance of an object.: \r\n\r\n   at Microsoft.TeamFoundation.Release.Data.Model.SystemSettings.LoadXml(Int32 id)
   at Microsoft.TeamFoundation.Release.Data.Model.ModelFactory.Load[T](Int32 id)
   at Microsoft.TeamFoundation.Release.DeploymentAgent.Services.Deployer.HeartBeat.SetNewInterval()
   at Microsoft.TeamFoundation.Release.DeploymentAgent.Services.Deployer.HeartBeat.TimerElapsed(Object sender, ElapsedEventArgs e)
Category: General
Priority: -1
EventId: 0
Severity: Error
Title:
Machine: SANDMAN
Application Domain: DeploymentAgent.exe
Process Id: 2148
Process Name: C:\Program Files (x86)\Microsoft Visual Studio 12.0\Release Management\bin\DeploymentAgent.exe
Win32 Thread Id: 56408
Thread Name: 
Extended Properties: 
I get the above error logged in production servers and its affecting the performance of my production servers. There is a problem in establishing a connection between the deployment agent and release management server and that's identified as the reason
for these errors. 
Please advice on how to change the frequency of number of errors logged in production servers.

Hi Amar_Baktha,
For your situation, you can follow the following methods to check if the problem can be fixed:
1. Please let us know the version of Release Management you're using. If you use Update 2 or 3, you can rollback to RTM or install Update 4 to have a try. Check last reply in this
thred for more info.
2. Also let us know if the production server and client machine in different domains. If yes, then you can use shadow account. You can refer to this
blog.
3. Remove IIS and readd it.
4. Check if Windows server update service is installed on your production machine. Install/Uninstall it to have a check if the connection can be established.
Please try the methods I mentioned above. If the problem still exist, it would be better to elaborate more details about your scenario.
Best regards,
We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time. Thanks for helping make community forums a great place.
Click
HERE to participate the survey.

Similar Messages

  • Version 6.84 produces many Event Logs

    I have just updated from 6.83 to 6.84 and, although the software appears to be working fine, I am getting several events logged in the Application Event Log when my 6131 synchronises.
    Event 1004
    User NT AUTHORITY\NETWORK SERVICE
    Detection of product '{A982E6CC-9F0D-4948-9B18-BDFD55DE4A72}', feature 'PCSuite', component '{9B373FD2-8E0A-4A76-80C7-63B6521FD237}' failed. The resource 'HKEY_CURRENT_USER\Software\Nokia\' does not exist.
    Event 1001
    User NT AUTHORITY\NETWORK SERVICE
    Detection of product '{A982E6CC-9F0D-4948-9B18-BDFD55DE4A72}', feature 'Platform' failed during request for component '{7BA39C00-ED40-417C-8C5C-3804B2DDD646}'
    Event 1004
    User JSSOLUTIONS\John Smith
    Detection of product '{A982E6CC-9F0D-4948-9B18-BDFD55DE4A72}', feature 'PCSuite', component '{9B373FD2-8E0A-4A76-80C7-63B6521FD237}' failed. The resource 'HKEY_CURRENT_USER\Software\Nokia\' does not exist.
    Event 1001
    User JSSOLUTIONS\John Smith
    Detection of product '{A982E6CC-9F0D-4948-9B18-BDFD55DE4A72}', feature 'Platform' failed during request for component '{7BA39C00-ED40-417C-8C5C-3804B2DDD646}'
    These 4 Event Log entries are repeated 3 more times.
    I have tried uninstalling and reinstalling but to no avail.
    I have checked the Registry and HKEY_CURRENT_USER\Software\Nokia\ does exist.
    I have tried adding premissions to this key for NETWORK SERVICE (John Smith already has full premissions) again to no avail.
    I am running version 6.84.10.3 of PC Suite and Windows XP Professional SP2.
    Whilst this is not a big issue as the software appears to be working fine, I do like to keep clear Event Logs so would appreciate any help in getting rid of these annoying entries.
    Many thanks.

    Hi,
    I tried to follow the post of miksu and patched with 6.84.10.4 but still the same problems...
    /discussions/board/message?board.id=pcsuite&message.id=19801
    So, like Jssolutions I reinstalled a previous version of Nokia PC Suite (v6.83.14.1). It works fine now... no more Event Logs
    This former version can be downloaded on http://nds1.nokia.com/files/support/global/phones/software/Nokia_PC_Suite_683_rel_14_1_eng_web.exeMessage Edited by rabbyn on 23-Sep-200706:44 PM

  • Event logs repeating event ID 5011 WAS and 6002 ping of mdb

    Hi,
    We're working on a new Exchange 2013 CU2 migration on Windows Server 2012 from Exchange 2007 SP3 on Windows 2008.  We have two Exchange 2013 physical servers running CAS and a single DAG (2 servers 1 DB) with a 2008 R2 witness server.  Everything
    seems to be working fine but we are getting the following events every few minutes in the event logs on both servers.  I've searched high and low and can't seem to find a resolution.  Any suggestions?
    Event ID 5011 from the Source WAS with this info:
    A process serving application pool 'MSExchangeSyncAppPool' suffered a fatal communication error with the Windows Process Activation Service. The process id was '21380'. The data field contains the error number.
    Event ID 6002 from the source MSExchange Mid-Tier Storage
    Ping of mdb '5d3c32ed-5c53-44b7-abe4-34fcdf08f848' timed out after '00:00:00' minutes.  Last successful ping was at '8/8/2013 5:46:37 PM' UTC.
    Event ID 1006 source MSExchangeDiagnostics
    The performance counter '\\SERVER-EX1\LogicalDisk(HarddiskVolume1)\Free Megabytes' sustained a value of '108.00', for the '15' minute(s) interval starting at '8/8/2013 5:34:00 PM'. Additional information: None. Trigger Name:DatabaseDriveSpaceTrigger. Instance:harddiskvolume1
    Event ID 4999 source MSExchange Common
    Watson report about to be sent for process id: 11124, with parameters: E12, c-RTL-AMD64, 15.00.0712.022, unknown, M.E.Data.Directory, M.E.D.D.ConnectionPoolManager.BlockImpersonatedCallers, M.E.Common.FailFastException, e5e6, 15.00.0712.016.
    ErrorReportingEnabled: False

    Thanks for the info rjensen.
    I have 50 mailboxes migrated over and phones lost connectivity today.  It happened just like Brandon described.  I checked the logs and the WAS error stopped 45 minutes before the user reported that their phone couldn't connect.  I did an
    iisreset, the error came back, and everything started working.
    After that, I escalated my ticket with Microsoft Support.  I worked with an engineer for a few hours after it happened.  He checked the app pool and some other configuration settings and didn't find any configuration issues.  He's doing more
    research and will get back to me tomorrow.
    Do you guys think that finishing the migration and removing EX 2007 will stop this issue?  According to KB 2639150, this issue occurs because the Exchange ActiveSync ProxyHandler does not close anonymous connections between the Exchange 2010 Client
    Access server and the Exchange Server 2003 servers.  If it is the same problem, just 2013 and 2007, I have to guess that removing 2007 will remove the open anonymous connections.  Thoughts?

  • Continuation of event logs

    Adding a couple more event logs.
    Attachments:
    kernel.txt ‏2 KB
    oobe.txt ‏2 KB

    Simple answer - No.
    Please read about how Event logs work.  You will see that events are targeted by the application and you can only change that by changing the application.  THe System log is owned by the system.  You cannot change that.
    ¯\_(ツ)_/¯

  • 21406 events getting generated on all our production servers

    Hi,
    We are getting below events on almost all our production servers (Exchange, Lync,etc.). Does anyone have any idea about this event.
    Log Name: Operations Manager
    Source: Health Service Modules
    Date: 2/10/2014 10:36:09 AM
    Event ID: 21406
    Task Category: None
    Level: Warning
    Keywords: Classic
    User: N/A
    Computer: XXXXX
    Description:
    The process started at 10:36:06 AM failed to create System.PropertyBagData. Errors found in output:
    C:\Program Files\System Center Operations Manager\Agent\Health Service State\Monitoring Host Temporary Files 3\655255\CollectLogicalDiskStatistics.vbs(94, 9) (null): Data error (cyclic redundancy check).
    Command executed: "C:\Windows\system32\cscript.exe" /nologo "CollectLogicalDiskStatistics.vbs" false
    Working Directory: C:\Program Files\System Center Operations Manager\Agent\Health Service State\Monitoring Host Temporary Files 3\655255\
    One or more workflows were affected by this.
    Workflow name: Windows.LogicalDrives.CollectMFTPercentInUse.Rule
    Instance name: C:
    Instance ID: {8D70B92A-C3C2-1421-2D3D-64CE73206D61}
    Management group: XXXXX
    Please assist me with any link or topic that already covers this issue.
    Thanks

    This error is Data error (cyclic redundancy check)
    Use the Windows Check Disk utility to check your hard drive for errors.
    Open a command prompt.
    At the command prompt, type chkdsk /f, and then press ENTER.
    Note If you receive a message similar to the following
    The type of the file system is NTFS. Cannot lock current drive.
    Chkdsk cannot run because the volume is in use by another process. Would you like to schedule this volume to be checked the next time the system restarts? (Y/N)
    press Y, press ENTER, and then restart your computer.
    When Chkdsk finishes, close the command prompt.
    Please remember, if you see a post that helped you please click (Vote As Helpful" and if it answered your question, please click (Mark As Answer).

  • SCCM 2012 creates 4732 event logs for 3 of Servers

    Hi,
    My problem is SCCM 2012 R2 which I have installed recently is creating 4732 security logs in 3 of our servers for every 5hrs interval which is an audit exposure. When I investigated which gives me local administrator ID is getting added to the NT Authority
    Group, which I'm not able to explain. Can some one help me in understanding it or Is there anyway I can stop that?
    Regards,
    Vighnesh
    Vighnesh Kumar. S

    Hi,
    Please provide more information as Torsten said.
    Are there Event ID: 4733 messages existed in event log if it creates 4732 logs every 5 hours? Is it the same account being added to the same Group?
    Best Regards,
    Joyce
    We
    are trying to better understand customer views on social support experience, so your participation in this
    interview project would be greatly appreciated if you have time.
    Thanks for helping make community forums a great place.

  • The Data Access service is either not running or not yet initialized. Check the event log for more information

    Hi,
    I have SCSM with remote SQL and the SCSM Management server give below error
    Message: Failed to connect to server ‘Name of Server’
    Microsoft.EnterpriseManagement.Common.ServiceNotRunningException: The Data Access service is either not running or not yet initialized. Check the event log for more information. —> System.ServiceModel.EndpointNotFoundException: Could not connect to net.tcp://ServerName:5724/DispatcherService.
    The connection attempt lasted for a time span of 00:00:04.0070932. TCP error code 10061: No connection could be made because the target machine actively refused it IPAddress:5724.  —> System.Net.Sockets.SocketException: No connection could be made
    because the target machine actively refused it IPAddress:5724
    I had try to restart SQL & MS with same error,
    Also i had try the following
    https://social.technet.microsoft.com/Forums/systemcenter/en-US/c670d54d-3a92-481f-8dc9-55c475ad196f/problems-with-data-access-service-after-rebooting
    https://social.technet.microsoft.com/Forums/systemcenter/en-US/26dc1d5c-fa82-403f-8949-3073f3b82a60/the-data-access-service-is-either-not-running-or-not-yet-initialized
    Not help meRegards

    I had same error before 
    below steps to solve it
    Make sure SQL Server Running & ServiceManager Database not full
    Stop All SCSM Services,
               System Center Management Configuration
       Microsoft System Center Data Access Service.
       Microsoft Monitoring Agent
    Rename Health Service State to Health Service State_old --- @ "C:\Program Files\Microsoft System Center 2012 R2\Service Manager"
    Start SCSM Services
        Microsoft Monitoring Agent
               System Center Management Configuration
       Microsoft System Center Data Access Service.
    Wait 2 min...
    check Event Viewer... 
    hope this help you.
    Regards, Ibrahim Hamdy

  • Windows could not start the Cluster Service on Local computer. For more information, review the System Event Log. If this is a non-Microsoft service, contact the service vendor, and refer to service-specific error code 2.

    Dear Technet,
    Windows could not start the Cluster Service on Local computer. For more information, review the System Event Log. If this is a non-Microsoft service, contact the service vendor, and refer to service-specific error code 2.
    My cluster suddenly went disappear. and tried to restart the cluster service. When trying to restart service this above mention error comes up.
    even i tried to remove the cluster through power-shell still couldn't happen because of cluster service not running.
    Help me please.. thank you.
    Regards
    Shamil

    Hi,
    Could you confirm which account when you start the cluster service? The Cluster service is a service that requires a domain user account.
    The server cluster Setup program changes the local security policy for this account by granting a set of user rights to the account. Additionally, this account is made a member
    of the local Administrators group.
    If one or more of these user rights are missing, the Cluster service may stop immediately during startup or later, depending on when the Cluster service requires the particular
    user right.
    Hope this helps.
    We
    are trying to better understand customer views on social support experience, so your participation in this
    interview project would be greatly appreciated if you have time.
    Thanks for helping make community forums a great place.

  • Errors in event log of Secondary DPM server protecting replicas on Primary

    Hello again
    I have two DPM servers, one situated on-site (primary) and one situated off-site (secondary). Protection jobs seem to be running correctly on both servers in that the jobs complete and I am able to restore data from the backups. I use the primary server
    to make the initial backups of critical systems and data (Exchange MDB's etc) and the secondary server to backup those replicas off-site in case of primary site loss or DPM system loss.
    The primary server is a physical server and the secondary server is a virtual server. Both DPM servers have their DPM databases stored on one physical SQL server that is in the primary site.
    Basically what is happening is that every day our virtual machines are snapshotted (secondary DPM server included) and everyday the snapshot of the secondary DPM server fails. I see the following to entries in the event log of the secondary server.
    Error 1:
    WARNING
    Source: MSDPM
    Event ID: 955
    The description for Event ID 955 from source MSDPM cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.
    If the event originated on another computer, the display information had to be saved with the event.
    The following information was included with the event:
    The consistency check resulted in the following changes to SQL Server Agent schedules: Schedules added: 2 Schedules removed: 2 Schedules updated: 0.  
    Problem Details:
    <ConsistencyCheck><__System><ID>26</ID><Seq>27861</Seq><TimeCreated>22/05/2014 23:01:31</TimeCreated><Source>SchedulerImpl.cs</Source><Line>719</Line><HasError>True</HasError></__System><Tags><JobSchedule
    /></Tags></ConsistencyCheck>
    the message resource is present but the message is not found in the string/message table
    Error 2
    ERROR
    Source: MSDPM
    Event ID: 4212
    The description for Event ID 4212 from source MSDPM cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.
    If the event originated on another computer, the display information had to be saved with the event.
    The following information was included with the event:
    DpmWriter service encountered an error during PrepareBackup as more than one component is selected for backup in the same snapshot set.  Select a single DPM replica for backup and try the operation again.
    Problem Details:
    <DpmWriterEvent><__System><ID>30</ID><Seq>7</Seq><TimeCreated>23/05/2014 00:30:45</TimeCreated><Source>d:\btvsts\21011\private\product\tapebackup\dpswriter\vssfunctionality.cpp</Source><Line>438</Line><HasError>True</HasError></__System><DetailedCode>4212</DetailedCode></DpmWriterEvent>
    the message resource is present but the message is not found in the string/message table
    These two events are followed by another event from VMWare Tools everyday
    Error 3:
    WARNING
    Source: VMWare Tools
    Event ID: 1000
    [ warning] [vmvss:vmvss] CVmSnapshotRequestor::CheckWriterStatus():1536: writer DPM Writer in failed state: res = 0x800423f4, err = 0x1, error =
    Has anyone come across this before? Currently I am not quite sure what is going wrong and whether it is actually related to snapshots failing, but I want to try to fix these errors first and see what happens.
    Regards

    Your ar using VMware for Virtualization?
    Are you trying to do an online Backup of the VM, think that will not work?
    One thing i wonder, your have installed second DPM if Site one fails or goes done, but SQL for DPM2 is in Site one? try to move SQL to external site for DPM 2
    Seidl Michael | http://www.techguy.at |
    twitter.com/techguyat | facebook.com/techguyat

  • Seemingly successful install of Exchange 2013 SP1 turns into many errors in event logs after upgrade to CU7

    I have a new Exchange 2013 server with plans to migrate from my current Exchange 2007 Server. 
    I installed Exchange 2013 SP1 and the only errors I saw in the event log seemed to be long standing known issues that did not indicate an actual problem (based on what I read online). 
    I updated to CU7 and now lots of errors have appeared (although the old ones seem to have been fixed so I have that going for me). 
    Currently the Exchange 2013 server is not in use and clients are still hitting the 2007 server.
    Issue 1)
    After each reboot I get a Kernel-EventTracing 2 error.  I cannot find anything on this on the internet so I have no idea what it is.
    Session "FastDocTracingSession" failed to start with the following error: 0xC0000035
    I did read other accounts of this error with a different name in the quotes but still can’t tell what this is or where it is coming from.
    Issue 2)
    I am still getting 5 MSExchange Common 106 errors even after reregistering all of the perf counters per this page:
    https://support.microsoft.com/kb/2870416?wa=wsignin1.0
    One of the perf counters fails to register using the script from the link above.
    66 C:\Program Files\Microsoft\Exchange Server\V15\Setup\Perf\InfoWorkerMultiMailboxSearchPerformanceCounters.xml
    New-PerfCounters : The performance counter definition file is invalid.
    At C:\Users\administrator.<my domain>\Downloads\script\ReloadPerfCounters.ps1:19 char:4
    +    New-PerfCounters -DefinitionFileName $f
    +    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        + CategoryInfo         
    : InvalidData: (:) [New-PerfCounters], TaskException
        + FullyQualifiedErrorId : [Server=VALIS,RequestId=71b6bcde-d73e-4c14-9a32-03f06e3b2607,TimeStamp=12/18/2014 10:09:
       12 PM] [FailureCategory=Cmdlet-TaskException] 33EBD286,Microsoft.Exchange.Management.Tasks.NewPerfCounters
    But that one seems unrelated to the ones that still throw errors. 
    Three of the remaining five errors are (the forum is removing my spacing between the error text so it looks like a wall of text - sorry):
    Performance counter updating error. Counter name is Count Matched LowFidelity FingerPrint, but missed HighFidelity FingerPrint, category name is MSExchange Anti-Malware Datacenter Perfcounters. Optional code: 3. Exception: The
    exception thrown is : System.InvalidOperationException: The requested Performance Counter is not a custom counter, it has to be initialized as ReadOnly.
       at System.Diagnostics.PerformanceCounter.InitializeImpl()
       at System.Diagnostics.PerformanceCounter.set_RawValue(Int64 value)
       at Microsoft.Exchange.Diagnostics.ExPerformanceCounter.set_RawValue(Int64 value)
    Last worker process info : System.ArgumentException: Process with an Id of 7384 is not running.
       at System.Diagnostics.Process.GetProcessById(Int32 processId)
       at Microsoft.Exchange.Diagnostics.ExPerformanceCounter.GetLastWorkerProcessInfo()
    Performance counter updating error. Counter name is Number of items, item is matched with finger printing cache, category name is MSExchange Anti-Malware Datacenter Perfcounters. Optional code: 3. Exception: The exception thrown
    is : System.InvalidOperationException: The requested Performance Counter is not a custom counter, it has to be initialized as ReadOnly.
       at System.Diagnostics.PerformanceCounter.InitializeImpl()
       at System.Diagnostics.PerformanceCounter.set_RawValue(Int64 value)
       at Microsoft.Exchange.Diagnostics.ExPerformanceCounter.set_RawValue(Int64 value)
    Last worker process info : System.ArgumentException: Process with an Id of 7384 is not running.
       at System.Diagnostics.Process.GetProcessById(Int32 processId)
       at Microsoft.Exchange.Diagnostics.ExPerformanceCounter.GetLastWorkerProcessInfo()
    Performance counter updating error. Counter name is Number of items in Malware Fingerprint cache, category name is MSExchange Anti-Malware Datacenter Perfcounters. Optional code: 3. Exception: The exception thrown is : System.InvalidOperationException:
    The requested Performance Counter is not a custom counter, it has to be initialized as ReadOnly.
       at System.Diagnostics.PerformanceCounter.InitializeImpl()
       at System.Diagnostics.PerformanceCounter.set_RawValue(Int64 value)
       at Microsoft.Exchange.Diagnostics.ExPerformanceCounter.set_RawValue(Int64 value)
    Last worker process info : System.ArgumentException: Process with an Id of 7384 is not running.
       at System.Diagnostics.Process.GetProcessById(Int32 processId)
       at Microsoft.Exchange.Diagnostics.ExPerformanceCounter.GetLastWorkerProcessInfo()
    Issue 3)
    I appear to have some issues related to the healthmailboxes. 
    I get MSExchangeTransport 1025 errors for multiple healthmailboxes.
    SMTP rejected a (P1) mail from 'HealthMailbox23b10b91745648819139ee691dc97eb6@<my domain>.local' with 'Client Proxy <my server>' connector and the user authenticated as 'HealthMailbox23b10b91745648819139ee691dc97eb6'. The Active Directory
    lookup for the sender address returned validation errors. Microsoft.Exchange.Data.ProviderError
    I reran setup /prepareAD to try and remedy this but I am still getting some.
    Issue 4)
    I am getting an MSExchange RBAC 74 error. 
    (Process w3wp.exe, PID 984) Connection leak detected for key <my domain>.local/Admins/Administrator in Microsoft.Exchange.Configuration.Authorization.WSManBudgetManager class. Leaked Value 1.
    Issue 5)
    I am getting MSExchange Assistants 9042 warnings on both databases.
    Service MSExchangeMailboxAssistants. Probe Time Based Assistant for database Database02 (c83dbd91-7cc4-4412-912e-1b87ca6eb0ab) is exiting a work cycle. No mailboxes were successfully processed. 2 mailboxes were skipped due to errors. 0 mailboxes were
    skipped due to failure to open a store session. 0 mailboxes were retried. There are 0 mailboxes in this database remaining to be processed.
    Some research suggested this may be related to deleted mailboxes however I have never had any actual user mailboxes on this server. 
    If they are healthmailboxes or arbitration mailboxes that might make sense but I am unsure of what to do on this.
    Issue 6)
    At boot I am getting an MSExchange ActiveSync warning 1033
    The setting SupportedIPMTypes in the Web.Config file was missing. 
    Using default value of System.Collections.Generic.List`1[System.String].
    I don't know why but this forum is removing some of my spacing that would make parts of this easier to read.

    Hi Eric
    Yes I have uninstalled and reinstalled Exchange 2013 CU7 for the 3<sup>rd</sup> time. 
    I realize you said one issue per forum thread but since I already started this thread with many issues I will at least post what I have discovered on them in case someone finds their way here from a web search.
    I have an existing Exchange 2007 server in the environment so I am unable to create email address policies that are defined by “recipient container”. 
    If I try and do so I get “You can't specify the recipient container because legacy servers are detected.”
     So I cannot create a normal email address policy and restrict it to an OU without resorting to some fancy filtering. 
    Instead what I have done is use PS to modify extensionAttribute1 (otherwise known as Custom Attribute 1 to exchange) for all of my users. 
    I then applied an address policy to them and gave it the highest priority. 
    Then I set a default email address policy for the entire organization. 
    After reinstalling Exchange all of my system mailboxes were created with the internal domain name. 
    So issue number 3 above has not come up. 
    For issue number one above I have created a new thread:
    https://social.technet.microsoft.com/Forums/office/en-US/7eb12b89-ae9b-46b2-bd34-e50cd52a4c15/microsoftwindowskerneleventtracing-error-2-happens-twice-at-boot-ex2013cu7?forum=exchangesvrdeploy
    For issue number four I have posted to this existing thread where there is so far no resolution:
    https://social.technet.microsoft.com/Forums/exchange/en-US/2343730c-7303-4067-ae1a-b106cffc3583/exchange-error-id-74-connection-leak-detected-for-key?forum=exchangesvradmin
    Issue number Five I have managed to recreate and get rid of in more than one way. 
    If I create a new database in ECP and set the database and log paths where I want, then this error will appear. 
    If I create the database in the default location and then use EMS to move it and set the log path, then the error will not appear. 
    The error will also appear (along with other errors) if I delete the health mailboxes and let them get recreated by restarting the server or the Health Manager service. 
    If I then go and set the retention period for deleted mailboxes to 0 days and wait a little while, these will all go away. 
    So my off hand guess is that these are caused by orphaned system mailboxes.
    For issue number six I have posted to this existing thread where there is so far no resolution:
    https://social.technet.microsoft.com/Forums/exchange/en-US/dff62411-fad8-4d0c-9bdb-037374644845/event-1033-msexchangeactivesync-warning?forum=exchangesvrmobility
    So for the remainder of this thread we can try and tackle issue number two which is the perf counters. 
    The exact same 5 perf counter were coming up and this had been true each time I have uninstalled and reinstalled Exchange 2013CU7. 
    Actually to be more accurate a LOT of perf counter errors come up after the initial install, but reloading the perf counters using the script I posted above reduces it to the same five. 
    Using all of your suggestions so far has not removed these 5 remaining errors either.  Since there is no discernible impact other than these errors at boot I am not seriously bothered by them but as will all event log errors, I would prefer
    to make them go away if possible.

  • Allow Non-Administrator accounts to create event sources and write to event logs

    We are setting up BizTalk 2013 in Windows Server 2012 and one of the requirements is to allow the service account to create sources and write in event logs (Application) of the BizTalk servers. We have found what it seems to be a simple solution for this
    without giving service accounts local admin rights.
    Give Full control for the following registry keys to the service accounts or groups to allow creating of event sources and write to event logs:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security
    Note: when changing permissions for EventLog key, the child keys will inherit the permissions by default except Security key which must be done manually.
    Initial tests using a .net test app seems to work as expected. New event sources are being created in the event logs and writing to the event logs after that works perfectly.
    The above method has been deployed in production and this is the most suitable solution for us.

    Hi Keong6806,
    Thanks a lot for posting and sharing here.
    Do you have any other questions regarding this topic? If not I would change the type as 'Discussion' then.
    Best Regards,
    Elaine
    Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected]

  • Reporting Services not automatically starting. System event log 7009, Application event: 18456

    For the past month (since Oct 11,2012)  reporting services (SSRS 2008R2) is not starting after the server is rebooted. The service is set to automatically start and starts manually without a problem.  The system event log contains the following error:
    Event ID 7009: A timeout was reached (30000 milliseconds) while waiting for the SQL Server Reporting Services (MSSQLSERVER) service to connect.
    SQL logs :
    The SQL logs has many "Event 18456 Login Failed, State 38" errors when the database engine starts. I assume clients conections are failing because the databases  aren't online yet. None of these 18456 errors coorespond to the account reporting services
    runs under.
    The SQL logs indication Event 7009 occures before the "ReportingServer" database is online so im assuming there is a dependancy but I don't know how to avoid this.
    This problem is occuring on a number of our servers running SSRS (if not all)
    Any ideas?
    Paul

    Hi A141695,
    For Event ID 7009, you can try to do the steps below to resolve it.
        1. Click Start, click Run, type regedit, and then click OK.
        2. Locate and then click the following registry subkey:
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control
        3. Right-click Control, point to New, and then click DWORD Value.
        4. In the New Value #1 box, type ServicesPipeTimeout, and then press ENTER.
        5. Right-click ServicesPipeTimeout, and then click Modify.
        6. Click Decimal, type the number of milliseconds that you want to wait until the service times out, and then click OK.
    For example, to wait 60 seconds before the service times out, type 60000.
    Quit Registry Editor, and then restart the computer. For more information about it, please see:
    http://www.sqlservercentral.com/Forums/Topic850540-1550-1.aspx#bm851211
    http://myitforum.com/myitforumwp/2012/08/22/configmgr-2012-sms_srs_reporting_point-component-failure/
    If you have any questions, please feel free to ask.
    Regards,
    Charlie Liao
    TechNet Subscriber Support
    If you are TechNet Subscription user and have any feedback on our support quality, please send your feedback
    here.

  • Connection Timeout Expired in Windows Event Logs

    I just recently installed SharePoint 2013 SP1 on a Windows Server 2008 R2 SP1 server and have been receiving this error message in the Windows Event logs:
    Cannot connect to SQL Server.  <database server name> not found.  Additional error information from SQL Server is included below.
    Connection Timeout Expired.  The timeout period elapsed during the post-login phase.  The connection could have timed out while waiting for server to complete the login process and respond; Or it could have timed out while attempting to create
    multiple active connections.  The duration spent while attempting to connect to this server was - [Pre-Login] initialization=12; handshake=6; [Login] initialization=0; authentication=0; [Post-Login] complete=14000;
    I have never seen this error message before in my life on any prior installation of SharePoint that I have ever done.  It is only occurring on this one particular installation of SharePoint.  The environment is corporate built, so I have no idea
    as to how to troubleshoot or determine the root cause of this error message.
    I looked at the value of the database-connection-timeout in stsadm and it gets back a value of 15, however, I am unable to alter the database connection timeout using stsadm since I either get an "Object reference not sent to an instance of an object"
    error message or "This operation can be performed only on a computer that is joined to a server farm by users who have permissions in SQL Server to read from the configuration database.  To connect this server to the server farm, use the SharePoint
    Products Configuration Wizard, located on the Start menu in Microsoft SharePoint 2010 Products."
    Please advise. 

    What is specification of your SQL server? i think its more CPU, RAM, I/O issue with SQL server.
    under which account you are running the stsadm command?
    check this one
    http://stackoverflow.com/questions/21230927/sql-azure-the-timeout-period-elapsed-during-the-post-login-phase
    may be you fall in this bug
    http://connect.microsoft.com/VisualStudio/feedback/details/821803/connection-timeout-expired-the-timeout-period-elapsed-during-the-post-login-phase
    Please remember to mark your question as answered &Vote helpful,if this solves/helps your problem. ****************************************************************************************** Thanks -WS MCITP(SharePoint 2010, 2013) Blog: http://wscheema.com/blog

  • Methods for Remote Event Log Collection (WMI vs RPC vs WinRM)

    Hi,
    I'm currently evaluating several 3rd party tools (SIEMs) to help me with log management in a large (mostly) Windows domain environment. Each tool uses a different approach to collecting the event log from remote systems, and I'd like help understanding the
    pros and cons of each approach. I've dropped this in the scripting forum as the tools are essentially running different scripts and it's this part I would like to understand.
    WMI: An agent installed on a windows server connects to each monitored box and grabs their event logs via WMI. Our legacy SIEM already collects from over 2000 servers using this method.
    RPC: As above, but using RPC. No changes required on the remote machines.
    WinRM: An appliance integrates with AD and collects event logs remotely using WinRM. This is reasonably new to me (i'm a security guy, not a sys admin) but I seem to have to enable an additional remote management tool, and open a new listening port on every
    single machine I want to collect the event log from.
    I read the following blog entry, which seemed to indicate that RPC was the best choice for performance, considering I'm going to be making high frequency connections to over 2000 targets:
    http://blogs.technet.com/b/josebda/archive/2010/04/02/comparing-rpc-wmi-and-winrm-for-remote-server-management-with-powershell-v2.aspx 
    However, everything I have found on the subject of remote event collection seems to suggest that WinRM is the "approved" method for event log collection. The vendor using the WinRM approach is also suggesting that it is the only official MS supported
    way of doing this.
    So I would like to ask, is there a reason that WMI and RPC should not be used for this purpose, since they clearly work and don't require any changes to my environment? Is there some advantage to WinRM that justifies touching my entire estate and opening
    an additional port (increasing my attack surface)?
    Thanks in advance,

    Hi,
    I'm aware of the push method, and may indeed move to it in time, although I'm just as likely to install a 3rd party agent on the machines to perform this role with greater functionality and manageability for the same effort. I've only seen organisations
    using commercial agents (snare, splunk, etc) or WMI for log collection in practice, so I don't think I'm the only one with reservations about it.
    Anything that involves making configuration changes to a large and very varied estate is not something to do lightly. Particularly if alternatives exist that don't require this change to be carried out immediately. That is why I'm looking to properly understand
    the pros and cons of these "legacy" approaches for use as an interim solution if nothing more.
    Pulling probably is more resource intensive, although I've not seen an actual comparison, but it's not really that fragile in my experience. If a single pull fails, you just collect the logs you missed at the next pull cycle in a few seconds/minutes.
    All logs are pulled directly into a SIEM for analysis, so that part is covered.
    Anyway, I appreciate the input, but I'm still holding out for concrete reasons to move away from WMI/RPC or to embrace WinRM. Bear in mind I'm considering fixing something that doesn't look broken to me!
    Cheers,

  • Event log

    I see that many people are having rebooting problems with the HH5.
    I thought I had had only one, on the second day after installation, but apparently I had another in the second night.
    Other than those mine has been fine so far.
    On viewing my event log under the boot tab I see the following, which is a little odd as I only got the router on the 9th April and installed it on the 11th  
    Boots on 1st January?? 

    Mike_D:
    My HH5 had a couple of undated entries (1st Jan) on delivery - I assume it was turned on twice on the production line for QA purposes without being connected to a MSAN where it could bet NTP. The hubs are remotely managed by, or on behalf of BT. They appear to try to contact a control server periodically, after booting and at various points thereafter. Additionally, or as an integral part of these management events, the hub may be rebooted on command of BT or their suppliers/contractors This is normaly to aqpply new settings, update the firmware, or perform similar changes that require the hub software to bve rebooted.
    As part of the boot process, the HH 5 will contact an NTP server to set it's time. If this is a warm boot (the power not having been disconnected) then the hub will record these events with the correct timestamp in the logs. If the reboot has been caused by a power faulire (especially ane extended power-off)  or power-button press, then it's probable that the hub will lose it's concept of real time and  record the boot event at or near 1st Jan, probably in the year 1970.
    Infinite:
    I'd be very careful mentioning " LC* T*rm. R*quests " - I've spent the whole night, through the night, reading these forums. Others and customers mentioning those phrases tend to get threads locked or banned by the mods.
    I can only assume that untrained customers have been "interpreting" entries in the logs. 99% of the entries are normal, only when viewed in context do they mean anything. It seems that BT know they have a problem of some sort on the HH5 (repeated reboots, not affecting all customers), but the forums are full of people jumpingon the bandwagon saying "me too".
    In response to mention of the dreaded phrase, the mods are even pointing people posting router logs that DON'T contain the phrase assuming they are troublemakers (!?) - I was pointed to a completely irrelevant locked thread last night myself :/
    This was rather offensive as I was only providing the type of information that could help diagnose my problem and had nothing whatsoever to do with the other thread at all - it did not even contaion the phrase that gets threads locked.
    I'm just waiting for the ban, with a very bad experience with the callcentre the last time I tried, my only hope is these forums.
    If they wont work with me on it there's no hope - I run a fleet of 8 CWMP (TR069) servers myself
    My symptoms summary - (seeing my post may have caused quite a few people to look at their logs):
    Starting on the 15th around 0600-0700hrs, is a constant reboot every 31-34 minutes of a HH5.
    In my case (not necessarily in other cases) before that entry was an openRG command that appeared to trigger the reboot cycles. My HH5 is, and has been from before the fault occured, in a default state other then the WiFi ESSIDs, on a perfect line with excellent SNR and sync rates.  
    I'm hoping to be contacted soon, before the relevant events in the log are overwritten by other rubbish caused by the reboots. Having read the locked threads and contacted other affected customers elsewhere, I don't have much hope I'm afraid.  :/ 
    I've used the "contact the mod" method as I was told and am awaiting futher contact after giving them my account number, contact number and email. Hopefully this will happen before the pertinent events are lost from my logs due to being overwritten - this is already happening on the TR069 syslog

Maybe you are looking for

  • Mail OS wont open, it just says "program not answering"

    I just intalled the latest update, and now when i click to open mail OS, i wont open the program, i just gives the message "Program not answerin" when i right click on the mail icon.

  • Itunes 8 will not launch on windows vista

    When I have mt ipod connected to the computer, itunes launches fine and automatically. When I try to open itunes without the ipod connected, I get a dialog box, "please wait while windows configures itunes", then a staus bar, gathering required infor

  • Got a new iPhone!

    I got a new iPhone and I understand that I can import data from MS Outlook to my iPhone, and that I can export data (I suppose through sync) from my PDA to Outlook.  I am running Windows Vista, and I have the Palm VIIx.  I am connected to my computer

  • Old with the old, in with the new

    Looking to see if anyone has dealt with the SPA-2100 and if anyone has heard if the old Sipura piece will have SCCP available. We are in the mists of upgading our CCM4.1.3 to CCM5.0SIP but can really use the newer ATA's features working on the 4.1.3(

  • Problem loading apps in iCloud

    When I log into iCloud on my PC (Window 7), I get an error message for each app (mail, contacts, calendar, etc) that there is a problem loading.  What is the issue?