Announcement

Collapse
No announcement yet.

Event ID 16002 and DCOM errors help

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • Event ID 16002 and DCOM errors help

    We have recently added several new Server 2012 r2 servers in our environment and are receiving the same multiple errors for them. The most trouble some is the event ID 16002 error which when it appears in the logs it happens constantly and we lose all network connectivity to the server. Only way to resolve the issue is by rebooting the server
    Log Name: System
    Source: AFD
    Date: 6/17/2015 6:48:14 PM
    Event ID: 16002
    Task Category: None
    Level: Warning
    Keywords: Classic
    User: N/A
    Computer: server.domain.com
    Description:
    Closing a UDP socket with local port number 61573 in process 3772 is taking longer than expected. The local port number may not be available until the close operation is completed. This happens typically due to misbehaving network drivers. Ensure latest updates are installed for Windows and any third-party networking software including NIC drivers, firewalls, or other security products.

    Log Name: System
    Source: AFD
    Date: 6/17/2015 6:48:18 PM
    Event ID: 16002
    Task Category: None
    Level: Warning
    Keywords: Classic
    User: N/A
    Computer: server.domain.com
    Description:
    Closing a UDP socket with local port number 55104 in process 3772 is taking longer than expected. The local port number may not be available until the close operation is completed. This happens typically due to misbehaving network drivers. Ensure latest updates are installed for Windows and any third-party networking software including NIC drivers, firewalls, or other security products.

    The other error we are receiving are dcom errors
    Log Name: System
    Source: Microsoft-Windows-DistributedCOM
    Date: 6/18/2015 8:46:47 AM
    Event ID: 10005
    Task Category: None
    Level: Error
    Keywords: Classic
    User: Server\username
    Computer: server.domain.com
    Description:
    DCOM got error "1068" attempting to start the service netprofm with arguments "Unavailable" in order to run the server:
    {A47979D2-C419-11D9-A5B4-001185AD2B89}

  • #2
    What have you done to troubleshoot the issue? For a start have checked that the network card drivers are up to date and that the servers are fully patched?
    A recent poll suggests that 6 out of 7 dwarfs are not happy

    Comment


    • #3
      Originally posted by Blood View Post
      What have you done to troubleshoot the issue? For a start have checked that the network card drivers are up to date and that the servers are fully patched?
      Sorry for the late reply, I have installed the latest NIC drivers and the latest firmware for all the 2012 servers. Yes the servers have the latest updates

      Comment


      • #4
        What application do you have running on the server? Do you have AV on the servers?

        Have you tried looking at what Procmon and Procexp show when the server stops working?

        What process is "3772"? In procexp (or Task Manager) it's the PID that you can correlate to a process.
        Regards,
        Jeremy

        Network Consultant/Engineer
        Baltimore - Washington area and beyond
        www.gma-cpa.com

        Comment


        • #5
          Originally posted by JeremyW View Post
          What application do you have running on the server? Do you have AV on the servers?

          Have you tried looking at what Procmon and Procexp show when the server stops working?

          What process is "3772"? In procexp (or Task Manager) it's the PID that you can correlate to a process.
          We have IIS running on the server and the only installed application is IBM Cognos. The port numbers arent relied to a specific port, but it points to scvhost. I have a feeling that IIS is causing the problem since it is currently configured to the IBM Cognos application, and we have verified that the IBM app uses UDP

          Comment


          • #6
            You can see exactly which service is using svchost using this great little utility:
            http://svchostviewer.codeplex.com/

            It lists all instances of svchost and the associated PID. Takes the guessing out of the game.
            A recent poll suggests that 6 out of 7 dwarfs are not happy

            Comment

            Working...
            X