+ Post New Thread
Page 1 of 5 12345 LastLast
Results 1 to 15 of 65
Windows Server 2008 Thread, Event ID 2012 Source Srv on Server 2008 in Technical; I've been getting these errors on a few of my 2008 SP2 servers and i've not been able to get ...
  1. #1
    cookie_monster's Avatar
    Join Date
    May 2007
    Location
    Derbyshire
    Posts
    4,217
    Thank Post
    394
    Thanked 278 Times in 239 Posts
    Rep Power
    75

    Event ID 2012 Source Srv on Server 2008

    I've been getting these errors on a few of my 2008 SP2 servers and i've not been able to get to the bottom of it. It says "Occassional errors are expected, but large amounts of these indicate a possible error in your network configuration.". It doesn't really give me an idea of how many errors might indicate a problem with my setup, I see about two-four per hour.

    http://www.eventid.net/display.asp?e...012&source=Srv

    There's not much info out there about the error but a few posts have pointed the finger at AV software, I'm wondering if anyone else sees this error on their 2008 servers.

    I'm pretty sure it's not a hardware or driver issues as i'm getting it on a physical HP server and on a couple of Xenserver VM's that are hosted on a Sun box. I haven't been able to rule out the switch yet but none of the 2003 servers on the same switch show the error. The only shared config other than the switch is the AV software NOD32. When I get chance i'll try a box without that.

    Any other ideas?

    Thanks.

  2. #2
    Richie1972's Avatar
    Join Date
    Apr 2006
    Location
    Blackburn
    Posts
    239
    Thank Post
    2
    Thanked 6 Times in 6 Posts
    Rep Power
    19
    I had this occurring a lot one one file server (2008 Enterprise X64) that was a Hyper-V guest running Sophos as its AV.
    I upped the RAM and CPUs which reduced the frequency.
    In the end, due to other problems, I ended up re-installing the server, so never really solved it

  3. #3
    PEO
    PEO is offline
    PEO's Avatar
    Join Date
    Oct 2007
    Posts
    2,096
    Thank Post
    457
    Thanked 152 Times in 96 Posts
    Rep Power
    72
    Hi, did you ever get to the bottom of this, Im having similar issues. i'm starting to think that its this dam stupid kaspersky antivirus

  4. #4
    dhoward_westexetc's Avatar
    Join Date
    May 2008
    Location
    Exeter, Devon
    Posts
    225
    Thank Post
    46
    Thanked 21 Times in 17 Posts
    Rep Power
    17
    We are having this effect as well on 1 2008 R2 server (PowerEdge R710) and one Storage Server 2008 NAS appliance (PowerVault NX3100). Have tried everything I can think of, updated BIOS, re-installed NIC drivers, check all the settings etc, and I am totally lost. We get around the same frequency, several per hour that tend to happen in groups.
    RAID drivers/firmware, HDD firmware is all up to date.

    Our AV is McAfee VirusScan 8.7i Enterprise with patch 4 installed.

    Anyone have any ideas on what else I should troubleshoot?
    Last edited by dhoward_westexetc; 21st October 2010 at 04:01 PM. Reason: Added AV

  5. #5

    Join Date
    Jan 2006
    Location
    Surburbia
    Posts
    2,178
    Thank Post
    74
    Thanked 307 Times in 243 Posts
    Rep Power
    116
    Hmm.. there is definitely something in this one i.e. I've noticed it happening on both 32-bit 2008 and 64-bit 2008 R2 servers, but not very often on 2003. This is different sites, but common features are:

    - They are all DCs.
    - They all have McAfee 9.7i Patch 3 or 4, but if that's the cause then it's a serious regresssion because I remember that messing with the net redirector and causing this a few years ago - they eventually fixed it.
    - Most have IPV6, SNP, new autotuning features and so on turned off.

    I'm not seriously worried but I would like them gone. Something I haven't gotten around to yet is actually looking at the event data ... it might not be that useful but there is an error code i.e. extra clue, somewhere in there.

  6. Thanks to PiqueABoo from:

    dhoward_westexetc (22nd October 2010)

  7. #6
    dhoward_westexetc's Avatar
    Join Date
    May 2008
    Location
    Exeter, Devon
    Posts
    225
    Thank Post
    46
    Thanked 21 Times in 17 Posts
    Rep Power
    17
    Quote Originally Posted by PiqueABoo View Post
    Hmm.. there is definitely something in this one i.e. I've noticed it happening on both 32-bit 2008 and 64-bit 2008 R2 servers, but not very often on 2003. This is different sites, but common features are:

    - They are all DCs.
    - They all have McAfee 9.7i Patch 3 or 4, but if that's the cause then it's a serious regresssion because I remember that messing with the net redirector and causing this a few years ago - they eventually fixed it.
    - Most have IPV6, SNP, new autotuning features and so on turned off.

    I'm not seriously worried but I would like them gone. Something I haven't gotten around to yet is actually looking at the event data ... it might not be that useful but there is an error code i.e. extra clue, somewhere in there.
    Our problem servers aren't DCs, they are member servers. Our 2008 R2 DC does not exhibit this issue.
    I haven't found the event data all that useful TBH. On my google searches all the event logs show similar byte data, but no real pinpoint to the cause.

    Interesting you mention McAfee 8.7i - I heard several reports of AV causing this. But then I don't really want to disable AV on servers. Suppose it could be a useful test for a very short time. Trouble is 8.7i is the only McAfee AV that will work on Server 2008 R2.

    What I have noticed is that the problem servers are ones with a lot of file access on network shares (one is our File server, the other one holds our menus for our redirected desktop/start menu for students), generally with heavy loads the problem appears, but outside of peak times the problem all but vanishes.

    I'll probably look at the AV route on Friday....
    Last edited by dhoward_westexetc; 21st October 2010 at 09:37 PM. Reason: added file access

  8. #7

    SYNACK's Avatar
    Join Date
    Oct 2007
    Posts
    11,271
    Thank Post
    884
    Thanked 2,749 Times in 2,322 Posts
    Blog Entries
    11
    Rep Power
    785
    TCP/IP offloading to the NIC going wrong maybe, especially if its passing through to a VM.

  9. Thanks to SYNACK from:

    PiqueABoo (21st October 2010)

  10. #8

    Join Date
    Jan 2006
    Location
    Surburbia
    Posts
    2,178
    Thank Post
    74
    Thanked 307 Times in 243 Posts
    Rep Power
    116
    Good thought, but which TCP/IP offloading? Looking at a system that produces most of these events (most workstations & the busiest) I've just gone to the Intel 82574L Gigabit NIC advanced config and turned off:

    - IPv4 Checksum Offload
    - Large Send Offload (IPv4)
    - TCP Checksum Offload (IPv4)

    IIRC the TCP checksum first has crossed my path in the past on some 2003 boxes, the large send was part of someone else's fix for a VM scenario but I'm not fussy, and I added the IPv4 Checksum because I suppose I may as well knock out IP checksums as well as the TCP ones.

    PS: Did this remotely and of course the connection dropped for each change - it's funny how much panicking you can fit into in a couple of seconds.
    Last edited by PiqueABoo; 21st October 2010 at 10:59 PM. Reason: Added another disabled setting

  11. Thanks to PiqueABoo from:

    dhoward_westexetc (22nd October 2010)

  12. #9
    dhoward_westexetc's Avatar
    Join Date
    May 2008
    Location
    Exeter, Devon
    Posts
    225
    Thank Post
    46
    Thanked 21 Times in 17 Posts
    Rep Power
    17
    Did those TCP offload changes on our 2008 R2 server and that brought it to its knees! Mind you it could have already gone wrong....
    I'll do those changes again over half term and test them to ensure good connectivity.

    I also notice there are 3 other hotfixes relating to Hyper-V, which is on our 2008 R2 box, KBs 981791, 974909 and 981836. I'll probably also try those and see if they make it any better. I think I will do those over half term though, given this morning's experience! We had the 981791 error last night.

    I'll also test McAfee over half term as well.

  13. #10

    Join Date
    Jan 2006
    Location
    Surburbia
    Posts
    2,178
    Thank Post
    74
    Thanked 307 Times in 243 Posts
    Rep Power
    116
    Back to the drawing board (those offload changes didn't change anything for me). Can only think that something I'm doing must be causing these - I've got a new 2K8R2 box without AV on it yet, so if these 2012s haven't already started I'll watch out for them when AV goes on towards the end of next week.

  14. Thanks to PiqueABoo from:

    dhoward_westexetc (22nd October 2010)

  15. #11
    dhoward_westexetc's Avatar
    Join Date
    May 2008
    Location
    Exeter, Devon
    Posts
    225
    Thank Post
    46
    Thanked 21 Times in 17 Posts
    Rep Power
    17
    Quote Originally Posted by PiqueABoo View Post
    Back to the drawing board (those offload changes didn't change anything for me). Can only think that something I'm doing must be causing these - I've got a new 2K8R2 box without AV on it yet, so if these 2012s haven't already started I'll watch out for them when AV goes on towards the end of next week.
    That's useful to know, thanks for that. I'll ditch the idea at our end regarding the TCP/IP offload, and try instead ripping out McAfee on our menus server.

    Let me know how it goes for you next week, particularly if you get the 2012s during half term. It sounds like you are in the same boat as me!

    One more thing, does one of your servers that have the 2012s have Hyper-V installed on it? There is an update rollup for Hyper-V, dated 24 August 2010.
    Last edited by dhoward_westexetc; 22nd October 2010 at 06:16 PM. Reason: Hyper-V

  16. #12

    Join Date
    Jan 2006
    Location
    Surburbia
    Posts
    2,178
    Thank Post
    74
    Thanked 307 Times in 243 Posts
    Rep Power
    116
    No hyper-v involved, but that large send offload coupled with another change I forget was someone's solution somewhere for this event on a hyper-v guest.

    + I've looked at a few and so far for me they're all the Invalid Device State error code 0xc0000184

  17. #13
    dhoward_westexetc's Avatar
    Join Date
    May 2008
    Location
    Exeter, Devon
    Posts
    225
    Thank Post
    46
    Thanked 21 Times in 17 Posts
    Rep Power
    17
    Quote Originally Posted by PiqueABoo View Post
    No hyper-v involved, but that large send offload coupled with another change I forget was someone's solution somewhere for this event on a hyper-v guest.

    + I've looked at a few and so far for me they're all the Invalid Device State error code 0xc0000184
    I think all of ours are that one as well, i'll check on Monday. Chances are then if that is the case then there is the same cause. It will be interesting to see if you get the error when you install your AV.

  18. #14
    PEO
    PEO is offline
    PEO's Avatar
    Join Date
    Oct 2007
    Posts
    2,096
    Thank Post
    457
    Thanked 152 Times in 96 Posts
    Rep Power
    72
    In my case I have SAN involved. I managed to reduce mine by changing the network cards. At Peak times i.e a wednesday the schools network is heavily used and thats when I start to see the error more, pluss the system can slow to an almost hault.

    I isolated all the network devices and fund duplicate Ip addresses on two switches and a switch with the sam IP as the UPS network card!!

    will see if that makes any improvement and report back.

  19. #15
    jsnetman's Avatar
    Join Date
    Oct 2007
    Posts
    887
    Thank Post
    23
    Thanked 134 Times in 126 Posts
    Rep Power
    40
    I was also getting these errors when first setting up our 2 DC's win server 2008r2. Never got to the bottom of the errors so decided to team all four nics on both servers and then load balance the connections across our switches in the main server room (never got the errors again). We also had one big subnet, had 600 PC's/Laptops and maybe 200 network devices on the same subnet, basically far too many for one subnet so created two extra vlans with routing to segment the broadcast traffic.

    Problem being when we teamed the nics Hyper-V did not like the teamed nics with bromcom nic drivers. Think this has been fixed now so am going to unteam them install hyper-v then team them back up again to get hyper-v running again.

    What I'm really indicating here is possible network design problems which server 08 is more sensitive to. I came to my current school when we had 150 pc's and a few printers so just had one small subnet for all devices. As the network grew to its present size I did not look at the design of the netwok and it gradually degraded almost to a stop.
    Last edited by jsnetman; 30th October 2010 at 09:11 AM.



SHARE:
+ Post New Thread
Page 1 of 5 12345 LastLast

Similar Threads

  1. Moodle / Server 2008 / IIS7 / MS SQL Server 2008 Express
    By Kamran7860 in forum Virtual Learning Platforms
    Replies: 3
    Last Post: 23rd November 2010, 07:03 AM
  2. MSI installation with group policy - srv 2008
    By lafleur1977 in forum Windows Server 2008
    Replies: 14
    Last Post: 20th October 2009, 04:03 PM
  3. Replies: 1
    Last Post: 5th May 2009, 03:17 PM
  4. 360 LAN Event: XL SUMMER 2008
    By EduTech in forum Gaming
    Replies: 4
    Last Post: 10th June 2008, 01:11 AM
  5. Insight Client Event 2008
    By powdarrmonkey in forum General Chat
    Replies: 3
    Last Post: 14th February 2008, 04:37 PM

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •