mcesnauskas
asked on
Timeout waiting for transaction response from IISADMIN and then all services terminate one by one.
I saw this topic posted in earlier questions from your forums, but with little results. The following repeatedly keeps showing up in my event viewer:
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7011
Date: 6/19/2005
Time: 1:19:42 PM
User: N/A
Computer: NECSEXCH
Description:
Timeout (30000 milliseconds) waiting for a transaction response
from the IISADMIN service.For more information, see Help and
Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7031
Date: 6/19/2005
Time: 1:19:57 PM
User: N/A
Computer: NECSEXCH
Description:
The IIS Admin Service service terminated unexpectedly. It has
done this 8 time(s). The following corrective action will be
taken in 0 milliseconds: No action.For more information, see
Help and Support Center at http://go.microsoft.com/fwlink/events
.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7031
Date: 6/19/2005
Time: 1:19:57 PM
User: N/A
Computer: NECSEXCH
Description:
The Microsoft Exchange IMAP4 service terminated unexpectedly.
It has done this 8 time(s). The following corrective action
will be taken in 0 milliseconds: No action.For more information,
see Help and Support Center at http://go.microsoft.com/fwlink/
events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7031
Date: 6/19/2005
Time: 1:19:57 PM
User: N/A
Computer: NECSEXCH
Description:
The Microsoft Exchange POP3 service terminated unexpectedly.
It has done this 8 time(s). The following corrective action
will be taken in 0 milliseconds: No action.For more information,
see Help and Support Center at http://go.microsoft.com/fwlink/
events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7031
Date: 6/19/2005
Time: 1:19:57 PM
User: N/A
Computer: NECSEXCH
Description:
The Microsoft Exchange Routing Engine service terminated
unexpectedly. It has done this 8 time(s). The following
corrective action will be taken in 0 milliseconds: No action.For
more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7031
Date: 6/19/2005
Time: 1:19:57 PM
User: N/A
Computer: NECSEXCH
Description:
The Simple Mail Transport Protocol (SMTP) service terminated
unexpectedly. It has done this 8 time(s). The following
corrective action will be taken in 0 milliseconds: No action.
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7031
Date: 6/19/2005
Time: 1:19:57 PM
User: N/A
Computer: NECSEXCH
Description:
The World Wide Web Publishing Service service terminated
unexpectedly. It has done this 8 time(s). The following
corrective action will be taken in 0 milliseconds: No action.
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
You can start the services back up and it runs fine, without hesitation. The problem is that it keeps happening. It's at random times and it will either happen a couple of times a day, or not for a few days at a time. Microsoft has now been working on this for 2 weeks. All service packs and patches are up to date on Both Windows 2000 Server and Microsoft Exchange 2000. In a previous posting, they thought of a possible "rootkit" hidden. I've tested for this as well and no evidence of this or any other DoS attacks on the system. Please let me know if anyone has found the reasoning behind this. I just want to be able to leave the office and not be on call all the time!!!
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7011
Date: 6/19/2005
Time: 1:19:42 PM
User: N/A
Computer: NECSEXCH
Description:
Timeout (30000 milliseconds) waiting for a transaction response
from the IISADMIN service.For more information, see Help and
Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7031
Date: 6/19/2005
Time: 1:19:57 PM
User: N/A
Computer: NECSEXCH
Description:
The IIS Admin Service service terminated unexpectedly. It has
done this 8 time(s). The following corrective action will be
taken in 0 milliseconds: No action.For more information, see
Help and Support Center at http://go.microsoft.com/fwlink/events
.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7031
Date: 6/19/2005
Time: 1:19:57 PM
User: N/A
Computer: NECSEXCH
Description:
The Microsoft Exchange IMAP4 service terminated unexpectedly.
It has done this 8 time(s). The following corrective action
will be taken in 0 milliseconds: No action.For more information,
see Help and Support Center at http://go.microsoft.com/fwlink/
events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7031
Date: 6/19/2005
Time: 1:19:57 PM
User: N/A
Computer: NECSEXCH
Description:
The Microsoft Exchange POP3 service terminated unexpectedly.
It has done this 8 time(s). The following corrective action
will be taken in 0 milliseconds: No action.For more information,
see Help and Support Center at http://go.microsoft.com/fwlink/
events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7031
Date: 6/19/2005
Time: 1:19:57 PM
User: N/A
Computer: NECSEXCH
Description:
The Microsoft Exchange Routing Engine service terminated
unexpectedly. It has done this 8 time(s). The following
corrective action will be taken in 0 milliseconds: No action.For
more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7031
Date: 6/19/2005
Time: 1:19:57 PM
User: N/A
Computer: NECSEXCH
Description:
The Simple Mail Transport Protocol (SMTP) service terminated
unexpectedly. It has done this 8 time(s). The following
corrective action will be taken in 0 milliseconds: No action.
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7031
Date: 6/19/2005
Time: 1:19:57 PM
User: N/A
Computer: NECSEXCH
Description:
The World Wide Web Publishing Service service terminated
unexpectedly. It has done this 8 time(s). The following
corrective action will be taken in 0 milliseconds: No action.
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
You can start the services back up and it runs fine, without hesitation. The problem is that it keeps happening. It's at random times and it will either happen a couple of times a day, or not for a few days at a time. Microsoft has now been working on this for 2 weeks. All service packs and patches are up to date on Both Windows 2000 Server and Microsoft Exchange 2000. In a previous posting, they thought of a possible "rootkit" hidden. I've tested for this as well and no evidence of this or any other DoS attacks on the system. Please let me know if anyone has found the reasoning behind this. I just want to be able to leave the office and not be on call all the time!!!
Do you run GFI Mail Essentials on the Exchange server? We had a similar problem with GFI installed, but it was fixed with a patch from GFI.
ASKER
I'm sorry for leaving this information out. I have Symantec Mail Security for Exchange version 4.5 installed.
Can't say for sure that this will help but symptoms are similar.
The problem I ran into was specific to GFI Mail Essentials on Win2k with Exchange 2K, something about a thread leak if I recall correctly (too many threads started under heavy load). There may be something similar in the Symantec product. Maybe it will point you in the right direction. Then again, maybe not...
The GFI-related articles are available at:
http://kbase.gfi.com/showarticle.asp?id=KBID002168
http://forums.gfi.com/cgi-bin/ultimatebb.cgi?ubb=get_topic;f=7;t=002716
The problem I ran into was specific to GFI Mail Essentials on Win2k with Exchange 2K, something about a thread leak if I recall correctly (too many threads started under heavy load). There may be something similar in the Symantec product. Maybe it will point you in the right direction. Then again, maybe not...
The GFI-related articles are available at:
http://kbase.gfi.com/showarticle.asp?id=KBID002168
http://forums.gfi.com/cgi-bin/ultimatebb.cgi?ubb=get_topic;f=7;t=002716
ASKER
Thanks.... I'm going to take a look. I appreciate you trying to help, this has been an issue now for weeks. This is the first time I've posted with you guys and I appreciate the kindness and professionalism. Thank you.
Sure thing. Hopefully it is of some help. When I encountered the problem I did not install the hotfix, I simply retuned my mail filtering rules. I believe my top-priority rule was doing reverse DNS lookups on each email message, and that by moving that rule to a lower priority (making keyword checking and bayesian filtering the priority spam filter rules, with a reverse DNS check happening only on messages that passed the other filters first) actually fixed the problem on my end. It was pretty time consuming finding the fix, though.
ASKER
After weeks of working on this issue, transferring files, examining the server, searching reports, Microsoft has finally come up with a possible solution. They sifted through a dump and came to the conclusion that it's a "Vulnerability in Exchange Server Could Allow Remote Code Execution (894549)" and sent me to this link:
http://www.microsoft.com/technet/security/Bulletin/MS05-021.mspx
I'm including this information for others that may ever experience such a problem. Apparently it's a known vulnerability. I will be applying the patch today at lunch and we'll see how it goes. For everyone's reference I will let you know if this fixes the issues.
http://www.microsoft.com/technet/security/Bulletin/MS05-021.mspx
I'm including this information for others that may ever experience such a problem. Apparently it's a known vulnerability. I will be applying the patch today at lunch and we'll see how it goes. For everyone's reference I will let you know if this fixes the issues.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.