Announcement

Collapse
No announcement yet.

Event ID 1000 and 1015 on a server 2003 box running Citrix MetaFrame XP 1.0

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • Event ID 1000 and 1015 on a server 2003 box running Citrix MetaFrame XP 1.0

    Recently i upgraded an APP on this server. every since then it has been hanging and we have had to restart it. The thing is i can still ping the server but that is about it. We are getting the following event id's

    Event Type: Error
    Event Source: Application Error
    Event Category: (100)
    Event ID: 1000
    Date: 9/18/2008
    Time: 7:09:58 AM
    User: N/A
    Computer: NT12
    Description:
    Faulting application lsass.exe, version 5.2.3790.0, faulting module ntdll.dll, version 5.2.3790.0, fault address 0x00063ee1.


    Data:
    0000: 41 70 70 6c 69 63 61 74 Applicat
    0008: 69 6f 6e 20 46 61 69 6c ion Fail
    0010: 75 72 65 20 20 6c 73 61 ure lsa
    0018: 73 73 2e 65 78 65 20 35 ss.exe 5
    0020: 2e 32 2e 33 37 39 30 2e .2.3790.
    0028: 30 20 69 6e 20 6e 74 64 0 in ntd
    0030: 6c 6c 2e 64 6c 6c 20 35 ll.dll 5
    0038: 2e 32 2e 33 37 39 30 2e .2.3790.
    0040: 30 20 61 74 20 6f 66 66 0 at off
    0048: 73 65 74 20 30 30 30 36 set 0006
    0050: 33 65 65 31 3ee1

    Event Type: Error
    Event Source: Winlogon
    Event Category: None
    Event ID: 1015
    Date: 9/18/2008
    Time: 7:09:58 AM
    User: N/A
    Computer: NT12
    Description:
    A critical system process, C:\WINDOWS\system32\lsass.exe, failed with status code c0000354. The machine must now be restarted.


    Event Type: Error
    Event Source: Userenv
    Event Category: None
    Event ID: 1110
    Date: 9/18/2008
    Time: 6:58:48 AM
    User: NT AUTHORITY\SYSTEM
    Computer: NT12
    Description:
    Attempt to determine whether user and machine accounts are in the same forest failed (There are currently no logon servers available to service the logon request. ).



    I have run a virus scan on the server and it seems to be clean
    any idea's.

    This server currently doesn't have SP1 installed. it is critical and i know with the older version of metaframe there was issues with SP1.

  • #2
    Re: Event ID 1000 and 1015 on a server 2003 box running Citrix MetaFrame XP 1.0

    LSASS used to be hit by a worm/trojan I seem to remember a while ago.
    Can you scan with another program, or even better see if this server still crashes unplugged?

    Can you roll back the change to the APP and does that APP have requirements on the OS to be a certain version?

    Is your DNS etc all working correctly?

    A couple of links:
    http://forums.techarena.in/windows-s...elp/402344.htm
    http://support.microsoft.com/kb/911185
    cheers
    Andy

    Please read this before you post:


    Quis custodiet ipsos custodes?

    Comment


    • #3
      Re: Event ID 1000 and 1015 on a server 2003 box running Citrix MetaFrame XP 1.0

      It is a production metaframe server. can't really unplug it it works fine after i reboot it. I have a backup raid i was going to put in place today COB before i installed the new app. DNS is working fine.
      I did find these though

      Lsass.exe stops responding:
      http://support.microsoft.com/?scid=kb;en-us;821265

      Lsass.exe error:
      http://support.microsoft.com/Default...b;en-us;826819

      Lsass.exe-=Windows 2003 server unresponsive:
      http://support.microsoft.com/?scid=kb;en-us;821008

      Comment


      • #4
        Re: Event ID 1000 and 1015 on a server 2003 box running Citrix MetaFrame XP 1.0

        It isn't a DC though

        Comment


        • #5
          Re: Event ID 1000 and 1015 on a server 2003 box running Citrix MetaFrame XP 1.0

          fair enough!

          SFC maybe to see if a file has been changed?
          http://support.microsoft.com/kb/310747
          cheers
          Andy

          Please read this before you post:


          Quis custodiet ipsos custodes?

          Comment


          • #6
            Re: Event ID 1000 and 1015 on a server 2003 box running Citrix MetaFrame XP 1.0

            Can i run this while the server is up and running. It shouldn't affect anything right?

            Comment


            • #7
              Re: Event ID 1000 and 1015 on a server 2003 box running Citrix MetaFrame XP 1.0

              It does replace files that aren't correct on the fly, the switches tell you what happens.
              cheers
              Andy

              Please read this before you post:


              Quis custodiet ipsos custodes?

              Comment


              • #8
                Re: Event ID 1000 and 1015 on a server 2003 box running Citrix MetaFrame XP 1.0

                I have set everynight at midnight to reboot the metaframe servers. This one wasn't rebooting. I have restarted and and cleared the logs. i will see how things go.
                Thanks for your help Andy

                Comment


                • #9
                  Re: Event ID 1000 and 1015 on a server 2003 box running Citrix MetaFrame XP 1.0

                  Haven't really done much.
                  It's a shame you can't get it updated to SP2 but these things do happen.
                  cheers
                  Andy

                  Please read this before you post:


                  Quis custodiet ipsos custodes?

                  Comment


                  • #10
                    Re: Event ID 1000 and 1015 on a server 2003 box running Citrix MetaFrame XP 1.0

                    well you did reply yeah i would love to upgrade this box but i would need to install about 12 Citrix hotfixes also.

                    Comment


                    • #11
                      Re: Event ID 1000 and 1015 on a server 2003 box running Citrix MetaFrame XP 1.0

                      Well it has seem to kick me out of the RDP session. i got this in the event log

                      Event Type: Error
                      Event Source: Symantec AntiVirus
                      Event Category: None
                      Event ID: 45
                      Date: 9/18/2008
                      Time: 2:19:15 PM
                      User: NT AUTHORITY\SYSTEM
                      Computer: NT12
                      Description:


                      SYMANTEC TAMPER PROTECTION ALERT

                      Target: C:\Program Files\Common Files\Symantec Shared\ccApp.exe
                      Event Info: Terminate Process
                      Action Taken: Logged
                      Actor Process: C:\WINDOWS\System32\svchost.exe (PID 92
                      Time: Thursday, September 18, 2008 2:18:35 PM

                      Comment


                      • #12
                        Re: Event ID 1000 and 1015 on a server 2003 box running Citrix MetaFrame XP 1.0

                        Do you have Symantec AV on there? Check the NIC for a teefer2 and see if unticking it (probably with a bounce) makes a difference.
                        I dislike Symantec AV personally but maybe reducing what it does to just online file scanning rather than the additional bits like Tamper Protection would be worth a go?
                        cheers
                        Andy

                        Please read this before you post:


                        Quis custodiet ipsos custodes?

                        Comment


                        • #13
                          Re: Event ID 1000 and 1015 on a server 2003 box running Citrix MetaFrame XP 1.0

                          teefer2? what is that?

                          Comment


                          • #14
                            Re: Event ID 1000 and 1015 on a server 2003 box running Citrix MetaFrame XP 1.0

                            Sorry, should give more info!
                            Teefer2 is the "protection" that gets installed on the NIC by symantec endpoint security depending on the version of your AV. Just see if it is listed. It has caused problems with other apps for example.

                            i.e.
                            https://forums.symantec.com/syment/b...thread.id=1075
                            cheers
                            Andy

                            Please read this before you post:


                            Quis custodiet ipsos custodes?

                            Comment


                            • #15
                              Re: Event ID 1000 and 1015 on a server 2003 box running Citrix MetaFrame XP 1.0

                              we are not running endpoint yet.

                              Comment

                              Working...
                              X