Solved

Event ID 2022 in Windows NT 4.0

Posted on 1998-11-01
29
1,799 Views
Last Modified: 2013-12-28
Help!!! This is REALLY urgent.

I have a critical server that is running Windows NT Server 4.0 SP3 on a PentiumII 350Mhz 256MB RAM machine.
Every once in a while, the Server service stops responding. This means users cannot logon, access shares, and do anything. Plus, the server ignores keyboard input and will not let a user log-on locally.
However, TCP/IP is still functioning (I can ping it), which means this is NOT a hardware hang.
Because there is no way to communicate with it, the only option left is to shut the power off and restart it (and we all know how NT likes it when you do that...)
After it powers on, I can sea that prior to the hang, the System event log contains 3-5 entries of Event ID 2022 (which originate from the Server Service, as expected). The message text reads:
"The server was unable to find a free connection 93 times in the last 60 seconds. " (of course the numbers vary from entry to entry).
Microsoft Support site has a fix, but warns it's only valid for Windows NT 3.1 (and indeed, that fix is not helping here).
This is VERY urgent because it is unpredictable and it causes all the users to lose their work, plus the power-off power-on corrupts the file system.

HELP ! ! !
0
Comment
Question by:tall
29 Comments
 
LVL 5

Expert Comment

by:Mujeeb082598
ID: 1794237
Hi :)

Try useing

net config server /autodisconnect:time

/autodisconnect:time

Sets the maximum number of minutes a user's session can be inactive before it is disconnected. You can specify -1 to never disconnect. The range is -1-65535 minutes; the default is 15.

Maybe someone might have used it with -1 so try runt the command again with 15 or any other time u would like to set for autodisconnect for inactive users.
0
 
LVL 95

Expert Comment

by:Lee W, MVP
ID: 1794238
Have you considered SP4?  I know that before doing any major change like that, it's always a good idea to test it, but I was looking over the list at Microsoft's site of what SP4 fixes and it's incredibly long.
0
 
LVL 2

Expert Comment

by:livni
ID: 1794239
I know about a bug in NT 4.0 :
if you have the character '=' in one of your environment
variables, you will not be able to log on locally.

you can change it with regedt32 from the net.
0
 

Author Comment

by:tall
ID: 1794240
We don't have any environment variables with "=". Anyway, it won't let you connect from the net because the server service died.
I looked at the AutoDisconnect parameter, and it's set to 15, like the default.
BTW: I saw some article in Microsoft's web site about a fact that anti-virus software that uses filtering (= scanning in real time) may cause the server service to go into a deadlock.
Anybody heard anything (or better, heard of a fix ?)

0
 

Author Comment

by:tall
ID: 1794241
 
0
 
LVL 5

Expert Comment

by:Mujeeb082598
ID: 1794242
Hi :)

Which anti virus software u are using and what version.

Check on the company site of your anti virus software and see if they might have any patch for it.
0
 
LVL 13

Expert Comment

by:akb
ID: 1794243
Why don't you try running without your anti-virus software for a while.  If all work stations have anti-virus software, the server will be reasonably OK.  This will prove if the anti-virus software is the problem.
0
 
LVL 7

Expert Comment

by:BlackMan
ID: 1794244
tall,

We had the exact same problem on one of out mainservers (Quad PPro 200 with 500 GB) with 1200 users connected. We escalated the problem and a priority 1 problem at Digital Support and received a number of patches from MS. We made a couple of network traces that showed network trafic at the period of the error (hard to do on a 100 MBit FDDI :-). We made performance logs. We stopped AV programs, backup software and everything else that was not needed for the server to run. All of this was sent to MS and we haven't received a usefull answer yet (the problems started nearly one year ago!)
What we found out, was that the problem occured more often if the server was stressed. We had another server with the excat same configuration and when we split the load between the servers, the event didn't occur that often (about 2-3 times a week). Strange enough, we found out that the PDC for our account domain reported the same error now and then, but it did it in the middle of the night, where it couldn't be that hard loaded. Our mainservers usally did it about an hour after the users started to work and about an hour after they returned from lunch.
Our servers are installed as Domain Controllers and when we promote one of then as PDC, we get an increased error rate, so our plan is to reinstall the servers as stand-alone servers in the domain.
One think that differs between your description and our problem, is that our server "comes alive" again after a few minutes, usally one minute after the last event is logged in the eventlog.

Sorry, I can't solve your problem (and neither can MS, I guess :-), but at least now you know that you're not alone :-)

0
 
LVL 5

Expert Comment

by:tfabian
ID: 1794245
a couple of ideas..

re: SP4  becareful with it.. I attempted to install it a week ago, and my machine hasn't functioned properly since..  it ended up trashing on NTFS partition, and when I attempted to rebuild it, it went heywire.. but that's not your issue.. although it might help..

I'ld look at whether or not you've got all the various hotfixes for SP 3 installed.. it almost sounds as if you're getting hit by a Denial of Service attack..   ie. someone might be bombarding your server with packets and causing it to fail.. some of the hotfixes  specifically refer to solving this type of problem..

also, if your system isn't behind a firewall, consider putting it behind one, and seeing if the problem persists.. if you are being bombed by someone outside your organization, a firewal should block any unauthorized traffic...


  good luck


0
 

Author Comment

by:tall
ID: 1794246
The server is behind a firewall, and it's totally inaccessible from outside our corporate network (it doesn't even have a registered IP address that you can ping).
However, I'll check the hotfix list to see of there were any fixes to the Server Service after SP3 was released.


0
 

Expert Comment

by:adnanza
ID: 1794247
Could you please specify what other software or services you are running on this machine. secondly how many users do you have and what is the work load on the server, check the processor and the DPC values from the performance monitor
0
 
LVL 5

Expert Comment

by:j_powers
ID: 1794248
Here is another Q article that may help.

Event 2022 During Directory Replication
Last reviewed: December 31, 1997
Article ID: Q139607
 
 


--------------------------------------------------------------------------------

The information in this article applies to:
Microsoft Windows NT Server version 3.51, and 4.0


SYMPTOMS
A Windows NT Server that is replicating files to 40 or 50 Windows NT Workstations is records an event 2022 message every 15 minutes. Example event message:


   Date:                  Event ID:  2022
   Time:                  Source:    Srv
   User:      N/A         Type:      Warning
   Computer:  NTSERVER    Category:  None

   Description:
   The server was unable to find a free connection 4 times in the last
   60 seconds.

   Data: Words:
   0000: 00000000 00480003 00000000 800007e6
   0010: 00000000 c000009a 00000000 00000000
   0020: 00000000 00000000


STATUS
Microsoft has confirmed this to be a problem in Windows NT. We are researching this problem and will post new information here in the Microsoft Knowledge Base as it becomes available.
 

0
 

Expert Comment

by:adnanza
ID: 1794249
as mentioned by J_powers it could be the problem in the replication. If you think that this is the problem then I could check out the parameters in the registry for controlling the replication,i.e, number of machines to send the request for update and things like that....
Let me know
0
 

Author Comment

by:tall
ID: 1794250
We are not using directory replication.

The server has around 60-70 users logged on at peak time, but they are all running the applications from the SERVER (and not from the local hard drive), which creates more load.
The processor is usually at 0-10% utilization. The %DPC is usually 1-2%.
Services running on the machine are:
* Quota Advisor (disk quota metering)
* SQL Server 6.5
* RAS (for incoming calls), but it's currently inactive (disabled in Control Panel)
* UPS service
* McAfee Netshield 3.1.4a (currently disabled as we are suspecting that this is the problem -   see above).
* Network licensing server (NetSentinel) - this is a tiny server which does almost nothing but communicate with a hardware lock found on the parallel port. It never gave us any trouble.

0
The problems with reply email signatures

Do you wish that you could place an email signature under a reply? Well, unfortunately, you can't. That great Exchange/Office 365 signature you've created will just appear at the bottom of an email chain. What a pain! Is there really no way to solve this? Well, there might be...

 
LVL 7

Expert Comment

by:BlackMan
ID: 1794251
As a note to my former comment, I'll bet you, that if you reduce the load on the server (at least as a test), you're problems are gone!
Are the server installed as a DC?
0
 

Author Comment

by:tall
ID: 1794252
Yes, it's the PDC, and it has one BDC.

0
 
LVL 7

Expert Comment

by:BlackMan
ID: 1794253
Try to promote the BDC to PDC to reduce the load on the server...
0
 
LVL 2

Expert Comment

by:livni
ID: 1794254
Have you tried this one:

Article ID: Q130922 The information in this article applies to:

•Microsoft Windows NT Advanced Server version 3.1 •Microsoft Windows NT Server version 3.x •Microsoft Windows for Workgroups version 3.x

SYMPTOMS

After you share a Gateway Service for NetWare (GSNW) session, the following event log appears in the Event Viewer when a Windows for Workgroups version 3.11 client computer attempts to connect to the Windows NT server share:



   Event ID: 2022
   Source: SRV
   Type: Error
   Description: The server was unable to find a free connection
   <number> times in the last <seconds> seconds.




WORKAROUND

To work around this problem, you can modify the registry.

WARNING: Using Registry Editor incorrectly can cause serious, system-wide problems that may require you to reinstall Windows NT to correct them. Microsoft cannot guarantee that any problems resulting from the use of Registry Editor can be solved. Use this tool at your own risk.



1.Run the Registry Editor (Regedt32.exe).

2.From the HKEY_LOCAL_MACHINE subtree, go to the following subkey:





      \SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters





3.On the Edit menu, click Add Value.

4.Add the following:



      Value Name:   MaxFreeConnections
      Data Type:    REG_DWORD
      Data:         8

      Value Name:   MaxWorkItems
      Data Type:    REG_DWORD
      Data:         255

      NOTE: The maximum number for Work Items is 512. You should use
      255 first, and then increase it as needed, up to a maximum of 512.






5.Quit Registry Editor.

6.At the command prompt, type the following:





      net config server /autodisconnect:-1





NOTE: Be sure you do not type a space between the ":" and "-1" or a syntax error occurs.

7.Shut down and restart Windows NT.
0
 
LVL 2

Expert Comment

by:livni
ID: 1794255
Have you tried this one:

Article ID: Q130922 The information in this article applies to:

•Microsoft Windows NT Advanced Server version 3.1 •Microsoft Windows NT Server version 3.x •Microsoft Windows for Workgroups version 3.x

SYMPTOMS

After you share a Gateway Service for NetWare (GSNW) session, the following event log appears in the Event Viewer when a Windows for Workgroups version 3.11 client computer attempts to connect to the Windows NT server share:



   Event ID: 2022
   Source: SRV
   Type: Error
   Description: The server was unable to find a free connection
   <number> times in the last <seconds> seconds.




WORKAROUND

To work around this problem, you can modify the registry.

WARNING: Using Registry Editor incorrectly can cause serious, system-wide problems that may require you to reinstall Windows NT to correct them. Microsoft cannot guarantee that any problems resulting from the use of Registry Editor can be solved. Use this tool at your own risk.



1.Run the Registry Editor (Regedt32.exe).

2.From the HKEY_LOCAL_MACHINE subtree, go to the following subkey:





      \SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters





3.On the Edit menu, click Add Value.

4.Add the following:



      Value Name:   MaxFreeConnections
      Data Type:    REG_DWORD
      Data:         8

      Value Name:   MaxWorkItems
      Data Type:    REG_DWORD
      Data:         255

      NOTE: The maximum number for Work Items is 512. You should use
      255 first, and then increase it as needed, up to a maximum of 512.






5.Quit Registry Editor.

6.At the command prompt, type the following:





      net config server /autodisconnect:-1





NOTE: Be sure you do not type a space between the ":" and "-1" or a syntax error occurs.

7.Shut down and restart Windows NT.
0
 

Author Comment

by:tall
ID: 1794256
Tried that. Been there. Done that. Didn't work.
Anyway, they say in the article that it only applies to NT versions below 4.0
BTW: I really appriciate all the effort. I never dreamed I'd get that many replies.
0
 
LVL 1

Expert Comment

by:derosa
ID: 1794257
It does sound as if someone is internally at hacking at the server. I remember reading about users telneting to specic port number( idon't remember which one) the server service would lock.

0
 
LVL 5

Expert Comment

by:tfabian
ID: 1794258
here's a partial list of some of the post SP3 hotfixes...  the list is current up to the ones I installed... ie. I grabbed this file from the MS ftp site at that time..   after awhile, I got too busy...

subsequently, I've installed SP4 on one machine, but as I mentioned earlier, I had some problems.. ended up having to reformat and install a fresh installation of NT, then SP4 without the other stuff.. haven't tried it on the rest of my systems yet...


anyway, without further ado...

----------------------------------------------------------------------------------------------------------------

Windows NT 4.0 Post SP3 Hotfixes Readme
=======================================

There are many Post Service Pack 3 hotfixes available on this FTP server.
Microsoft recommends waiting for Service Pack 4 unless you are currently
running into a specific problem resolved by one of these fixes.

These hotfixes are, for the most part, cumulative. This means that the
latest binary also includes fixes previously made to the same binary.
For example, the 01/09/98 version of Tcpip.sys (teardrop2-fix) also
includes previous fixes to Tcpip.sys (such as land-fix, icmp-fix, and
oob-fix).

When you apply multiple fixes, please install them in the following order
to ensure a newer fix is not replaced by an older one.

   oob-fix
   asp-fix
   java-fix
   dns-fix
   iis-fix
   lsa-fix
   dblclick-fix
   icmp-fix
   zip-fix
*  roll-up
   mdl-fix
   getadmin-fix
*  roll-up/cluster
   winsupd-fix
   ndis-fix
   scsi-fix
   2gcrash
   simptcp-fix
   ide-fix
   wan-fix
   land-fix
   pent-fix (x86 only)
   joystick-fix (x86 only)
   SAG-fix
   iis4-fix
   pptp-fix
   teardrop2-fix
   tapi21-fix
   pcm-fix
   srv-fix
   y2k-fix
   euro-fix
   atapi-fix
   netbt-fix
   lsa2-fix

* Please refer to notes in the binaries list before applying these fixes.


The following fixes have been archived (made obsolete by a newer fix):

   oob-fix      (tcpip.sys)    Included in teardrop2-fix
   java-fix     (win32k.sys)   Included in getadmin-fix
   dblclick-fix (win32k.sys)   Included in getadmin-fix
   mdl-fix      (ntoskrnl.exe) Included in getadmin-fix
                (ntkrnlmp.exe)
   icmp-fix     (tcpip.sys)    Included in teardrop2-fix
   land-fix     (tcpip.sys)    Included in teardrop2-fix
   lsa-fix      (Lsasrv.dll)   Included in lsa2-fix


The following list displays binaries supplied with each hotfix. This may be
of use in determining which fixes are applied on a given system.

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40
   /hotfixes-postsp3

NOTE: The above path is one line; it has been wrapped for readability.

/archive/oob-fix

   05/22/97  09:06a               217,416 Oobfix_i.exe
   05/20/97  04:50p               143,472 Tcpip.sys (x86)

   05/22/97  09:06a               287,680 Oobfix_a.exe
   05/20/97  03:50p               260,720 Tcpip.sys (Alpha)

/asp-fix

   05/28/97  05:16a             1,323,068 Aspfix.exe
   05/07/97  10:01p               379,504 Asp.dll (x86)
   05/07/97  10:16p               553,744 Asp.dll (Alpha)

/archive/java-fix

   05/28/97  02:04p             1,270,904 Javafixi.exe
   05/23/97  05:59p             1,233,200 Win32k.sys (x86)

   05/28/97  02:04p             1,483,728 Javafixa.exe
   05/23/97  04:57p             2,042,608 Win32k.sys (Alpha)

/dns-fix

   06/09/97  03:11p               177,744 Dnsfix_i.exe
   05/30/97  06:09p               116,496 Dns.exe (x86)

   06/09/97  03:11p               220,904 Dnsfix_a.exe
   05/30/97  05:46p               194,832 Dns.exe (Alpha)

/iis-fix

   06/20/97  02:06p               165,168 Iis-fixi.exe
   06/20/97  09:34a               113,936 W3svc.dll (x86)

   06/20/97  02:06p               200,400 Iis-fixa.exe
   06/20/97  08:34a               171,280 W3svc.dll (Alpha)

/archive/lsa-fix

   06/25/97  02:25p               220,560 Lsa-fixi.exe
   06/25/97  12:56p               152,336 Lsasrv.dll (x86)

   06/25/97  02:25p               261,312 Lsa-fixa.exe
   06/25/97  11:55a               249,104 Lsasrv.dll (Alpha)

/archive/dblclick-fix

   06/30/97  09:00a             1,271,168 W32kfixi.exe
   06/23/97  05:06p             1,233,616 Win32k.sys (x86)

   06/30/97  09:00a             1,483,760 W32kfixa.exe
   06/23/97  04:06p             2,043,600 Win32k.sys (Alpha)

/archive/icmp-fix

   07/01/97  01:38p               221,312 Icmpfixi.exe
   06/30/97  07:58p               139,792 Tcpip.sys (x86)

   07/01/97  01:38p               291,728 Icmpfixa.exe
   06/30/97  06:57p               257,136 Tcpip.sys (Alpha)

/zip-fix

   07/14/97  08:50a                99,576 Zip-fixi.exe
   05/28/97  12:32p                13,680 Class2.sys (x86)
   05/28/97  12:33p                15,248 Disk.sys (x86)
   05/28/97  12:33p                 8,368 Sfloppy.sys (x86)

   07/14/97  08:50a               142,288 Zip-fixa.exe
   05/28/97  11:32a                23,408 Class2.sys (Alpha)
   05/28/97  11:33a                23,856 Disk.sys (Alpha)
   05/28/97  11:33a                12,624 Sfloppy.sys (Alpha)

/roll-up

   Unlike most other hotfixes, these binaries are not cumulative and do
   not include fixes from earlier dates.

      11/24/97  02:49p             1,207,368 Roll-upi.exe
      11/05/97  10:50a                67,568 Mup.sys (x86)
      11/05/97  10:45a               934,272 Ntkrnlmp.exe (x86)
      11/05/97  10:44a               914,944 Ntoskrnl.exe (x86)
      11/10/97  11:07a               705,296 Ole32.dll (x86)
      11/07/97  03:15p                37,648 Rpcltccm.dll (x86)
      11/10/97  11:07a                34,064 Rpcltscm.dll (x86)
      11/13/97  04:22p               317,200 Rpcrt4.dll (x86)
      11/13/97  04:22p               103,696 Rpcss.exe (x86)

      11/24/97  02:49p             1,630,536 Roll-upa.exe
      10/31/97  02:11p             1,217,296 Ole32.dll (Alpha)
      10/21/97  04:00p                81,680 Rpcltccm.dll (Alpha)
      10/23/97  04:52p                59,152 Rpcltscm.dll (Alpha)
      11/11/97  04:23p               550,672 Rpcrt4.dll (Alpha)
      08/21/97  11:35a             1,367,616 Ntoskrnl.exe (Alpha)
      08/21/97  11:36a             1,395,136 Ntkrnlmp.exe (Alpha)
      11/13/97  02:16p               187,152 Rpcss.exe (Alpha)
      08/19/97  12:58p               119,664 Mup.sys (Alpha)

/archive/mdl-fix

   01/26/98  04:10p             1,306,992 Mdlfix-i.exe
   06/27/97  03:35p               934,208 Ntkrnlmp.exe (x86)
   06/27/97  03:34p               914,816 Ntoskrnl.exe (x86)

   01/26/98  04:10p             1,477,328 Mdlfix-i.exe
   06/27/97  02:34p             1,393,600 Ntkrnlmp.exe (Alpha)
   06/27/97  02:34p             1,366,144 Ntoskrnl.exe (Alpha)

/getadmin-fix

   07/15/97  11:41a             1,375,936 Admnfixi.exe
   07/11/97  11:28a               935,040 Ntkrnlmp.exe (x86)
   07/11/97  11:27a               915,648 Ntoskrnl.exe (x86)
   07/11/97  10:18p               323,344 User32.dll (x86)
   07/12/97  05:34p             1,233,776 Win32k.sys (x86)

   07/15/97  11:42a             1,975,272 Admnfixa.exe
   07/14/97  11:28a               579,344 User32.dll (Alpha)
   07/11/97  10:27a             1,367,360 Ntoskrnl.exe (Alpha)
   07/11/97  10:27a             1,394,816 Ntkrnlmp.exe (Alpha)
   07/14/97  11:23a             2,043,696 Win32k.sys (Alpha)

/roll-up/CLUSTER

   This fix includes the get-admin fix.  If you install the cluster fix,
   you should not install the getadmin fix (either before or after the
   cluster fix is installed).

      12/10/97  04:58p             2,329,344 Clusfixi.exe
      11/04/97  01:14p                43,280 Clusapi.dll (x86)
      11/04/97  01:17p                15,632 Clusprxy.exe (x86)
      11/04/97  01:16p               156,432 Clusres.dll (x86)
      11/04/97  01:13p               453,392 Clussvc.exe (x86)
      05/28/97  11:45a                68,288 Halmps.dll (x86)
      11/04/97  01:16p                21,776 Iisclus3.dll (x86)
      10/07/97  10:51a                72,464 Mswsock.dll (x86)
      11/05/97  10:50a                67,568 Mup.sys (x86)
      12/04/97  09:40p               119,856 Netbt.sys (x86)
      11/12/97  01:30p               374,096 Ntfs.sys (x86)
      08/22/97  04:37p               935,936 Ntkrnlmp.exe (x86)
      08/22/97  04:36p               916,096 Ntoskrnl.exe (x86)
      11/10/97  11:07a               705,296 Ole32.dll (x86)
      10/07/97  10:51a                40,720 Rnr20.dll (x86)
      11/07/97  03:15p                37,648 Rpcltccm.dll (x86)
      11/10/97  11:07a                34,064 Rpcltscm.dll (x86)
      11/13/97  04:22p               317,200 Rpcrt4.dll (x86)
      11/13/97  04:22p               103,696 Rpcss.exe (x86)
      07/09/97  12:58p             1,233,680 Win32k.sys (x86)
      10/22/97  12:48p                59,664 Ws2_32.dll (x86)
      10/13/97  03:01p                20,240 Wsock32.dll (x86)

      12/10/97  04:58p             3,326,512 Clusfixa.exe
      11/04/97  02:28p                78,096 Clusapi.dll (Alpha)
      11/04/97  02:29p               253,200 Clusres.dll (Alpha)
      11/04/97  02:29p                32,016 Iisclus3.dll (Alpha)
      10/07/97  10:49a               115,472 Mswsock.dll (Alpha)
      10/31/97  02:11p             1,217,296 Ole32.dll (Alpha)
      10/07/97  10:49a                67,856 Rnr20.dll (Alpha)
      10/21/97  04:00p                81,680 Rpcltccm.dll (Alpha)
      10/23/97  04:52p                59,152 Rpcltscm.dll (Alpha)
      11/11/97  04:23p               550,672 Rpcrt4.dll (Alpha)
      10/22/97  12:46p               108,816 Ws2_32.dll (Alpha)
      10/13/97  02:59p                24,848 Wsock32.dll (Alpha)
      11/04/97  02:30p                24,336 Clusprxy.exe (Alpha)
      11/04/97  02:28p               730,896 Clussvc.exe (Alpha)
      08/22/97  04:35p             1,367,808 Ntoskrnl.exe (Alpha)
      08/22/97  04:35p             1,395,392 Ntkrnlmp.exe (Alpha)
      11/13/97  02:16p               187,152 Rpcss.exe (Alpha)
      08/19/97  12:58p               119,664 Mup.sys (Alpha)
      12/04/97  09:37p               220,048 Netbt.sys (Alpha)
      11/04/97  02:43p               553,072 Ntfs.sys (Alpha)
      07/09/97  11:58a             2,043,696 Win32k.sys (Alpha)

/winsupd-fix

   08/07/97  12:59p               241,664 Winsfixi.exe
   08/05/97  04:29p               191,248 Wins.exe (x86)

   08/07/97  12:59p               309,680 Winsfixa.exe
   08/05/97  03:29p               343,312 Wins.exe (Alpha)

/ndis-fix

   08/08/97  10:19a               191,776 Ndisfixi.exe
   07/22/97  06:54p               130,384 Ndis.sys (x86)

   08/08/97  10:19a               251,608 Ndisfixa.exe
   07/22/97  05:54p               236,240 Ndis.sys (Alpha)

/scsi-fix

   09/05/97  09:01a                91,080 Scsifixi.exe
   07/02/97  06:41p                34,096 Scsiport.sys (x86)

   09/05/97  09:02a               142,624 Scsifixa.exe
   07/02/97  05:41p                53,456 Scsiport.sys (Alpha)

/2gcrash

   10/31/97  04:16p               766,928 2gcrashi.exe
   07/29/97  06:29p                40,208 Dumpchk.exe (x86)
   07/29/97  06:29p               122,128 Dumpexam.exe (x86)
   07/29/97  06:29p               140,048 I386kd.exe (x86)
   08/29/97  09:36a               935,872 Ntkrnlmp.exe (x86)
   08/29/97  09:35a               916,032 Ntoskrnl.exe (x86)
   07/30/97  12:14p                23,312 Savedump.exe (x86)

   10/31/97  04:16p             1,045,840 2gcrasha.exe
   07/29/97  05:28p                94,480 Dumpchk.exe (Alpha)
   07/29/97  05:28p               163,600 Dumpexam.exe (Alpha)
   07/29/97  05:28p               219,920 I386kd.exe (Alpha)
   08/29/97  09:34a             1,367,744 Ntoskrnl.exe (Alpha)
   08/29/97  09:34a             1,395,328 Ntkrnlmp.exe (Alpha)
   07/30/97  11:13a                57,616 Savedump.exe (Alpha)

/simptcp-fix

   10/31/97  04:17p               288,632 Chargeni.exe
   10/21/97  04:04p                44,304 Msafd.dll (x86)
   08/06/97  03:49p                20,752 Simptcp.dll (x86)
   07/09/97  06:36p               139,856 Tcpip.sys (x86)
   10/21/97  04:06p                18,704 Wshtcpip.dll (x86)

   10/31/97  04:17p               360,760 Chargena.exe
   10/21/97  04:00p                74,000 Msafd.dll (Alpha)
   08/06/97  02:48p                30,480 Simptcp.dll (Alpha)
   10/21/97  04:00p                28,432 Wshtcpip.dll (Alpha)
   07/09/97  05:35p               257,264 Tcpip.sys (Alpha)

/ide-fix

   11/18/97  11:38a               111,472 Idefix-i.exe
   08/19/97  12:39p                26,352 Atapi.sys (x86)
   10/20/97  10:07p                26,416 Atdisk.sys (x86)

   11/18/97  11:39a               174,720 Idefix-a.exe
   08/19/97  12:38p                60,176 Atapi.sys (Alpha)
   10/11/97  03:19a                38,128 Atdisk.sys (Alpha)

/wan-fix

   11/20/97  11:06a               120,840 Wanfix-i.exe
   11/17/97  01:35p                57,744 Ndiswan.sys (x86)

   11/20/97  11:06a               173,984 Wanfix-a.exe
   11/17/97  01:32p               103,728 Ndiswan.sys (Alpha)

/archive/land-fix

   11/26/97  12:01p               221,368 Landfixi.exe
   11/25/97  04:54p               143,472 Tcpip.sys (x86)

   11/26/97  12:01p               296,112 Landfixa.exe
   11/25/97  04:52p               263,376 Tcpip.sys (Alpha)

/pent-fix

   02/27/98  12:43p               802,800 Pentfix.exe
   11/24/97  12:24p                51,968 Hal.dll (x86)
   11/24/97  12:24p                48,384 Hal486c.dll (x86)
   11/24/97  12:25p                66,400 Halapic.dll (x86)
   11/24/97  12:24p                46,112 Halast.dll (x86)
   11/24/97  12:25p                82,208 Halcbus.dll (x86)
   11/24/97  12:25p                80,320 Halcbusm.dll (x86)
   11/24/97  12:24p                46,400 Halmca.dll (x86)
   11/24/97  12:25p                68,544 Halmps.dll (x86)
   11/24/97  12:25p                67,552 Halmpsm.dll (x86)
   11/24/97  12:26p                79,008 Halncr.dll (x86)
   11/24/97  12:25p                40,192 Haloli.dll (x86)
   11/24/97  12:25p                56,608 Halsp.dll (x86)
   11/24/97  12:25p                40,768 Halwyse7.dll (x86)
   11/20/97  06:23p               938,816 Ntkrnlmp.exe (x86)
   11/20/97  06:22p               918,848 Ntoskrnl.exe (x86)

/joystick-fix

   12/10/97  04:59p                66,200 Joy-fixi.exe
   11/24/97  02:48p                 7,760 Joystick.sys (x86)

/SAG-fix

   12/10/97  04:59p               526,072 Dcomfixi.exe
   12/08/97  10:16a               680,208 Ole32.dll (x86)
   12/08/97  10:17a               312,592 Rpcrt4.dll (x86)
   12/08/97  10:17a               104,720 Rpcss.exe (x86)

   12/10/97  04:59p               785,120 Dcomfixa.exe
   12/08/97  10:14a             1,217,296 Ole32.dll (Alpha)
   12/08/97  10:14a               552,208 Rpcrt4.dll (Alpha)
   12/08/97  10:13a               187,152 Rpcss.exe (Alpha)

/iis4-fix

   12/11/97  04:40p               340,848 Iis4fixi.exe
   12/11/97  09:16a                65,488 Afd.sys (x86)
   12/01/97  03:15p               147,632 Tcpip.sys (x86)

   12/11/97  04:40p               374,968 Iis4fixa.exe
   11/21/97  03:41p               112,304 Afd.sys (Alpha)
   11/26/97  01:13p               263,216 Tcpip.sys (Alpha)

/pptp-fix

   01/08/98  03:46p               103,528 Pptpfixi.exe
   12/05/97  01:47p                40,144 Raspptpe.sys (x86)

   01/08/98  03:46p               154,624 Pptpfixa.exe
   12/05/97  01:44p                75,856 Raspptpe.sys (Alpha)

/teardrop2-fix

   01/09/98  12:23p               221,464 Tearfixi.exe
   01/09/98  08:16a               143,664 Tcpip.sys (x86)

   01/09/98  12:23p               297,408 Tearfixa.exe
   01/09/98  08:13a               263,536 Tcpip.sys (Alpha)

/tapi21-fix

   01/12/98  10:29a               172,112 Tapi21fi.exe
   01/05/98  01:34p               140,560 Tapisrv.exe (x86)

   01/12/98  10:31a               228,468 Tapi21fa.exe
   01/05/98  01:33p               220,944 Tapisrv.exe (Alpha)

/pcm-fix

   02/11/98  09:10a               101,384 Pcmfix-i.exe
   02/04/98  10:21a                40,688 Pcmcia.sys (x86)

   02/11/98  09:10a               153,376 Pcmfix-a.exe
   02/04/98  10:17a                69,200 Pcmcia.sys (Alpha)

/srv-fix

   02/12/98  10:24a               308,848 Srvfix-i.exe
   02/09/98  11:16a               229,872 Srv.sys (x86)

   02/12/98  10:24a               422,424 Srvfix-a.exe
   02/09/98  11:13a               466,416 Srv.sys (Alpha)

/y2k-fix

   03/27/98  03:42p               599,080 Y2kfixi.exe
   03/23/98  11:25a                57,104 Docprop.dll (x86)
   09/10/97  11:44a               295,184 Netui2.dll (x86)
   03/18/98  11:55a             1,277,712 Shell32.dll (x86)
   02/09/98  11:27a                53,008 Timedate.cpl (x86)

   03/27/98  03:42p               891,224 Y2kfixa.exe
   03/23/98  11:26a                83,216 Docprop.dll (Alpha)
   09/10/97  11:42a               528,656 Netui2.dll (Alpha)
   03/18/98  11:57a             1,866,000 Shell32.dll (Alpha)
   02/09/98  11:24a                88,336 Timedate.cpl (Alpha)

/euro-fix

   04/08/98  09:31a             1,340,288 Eurofixi.exe
   01/26/98  01:33p               151,232 Arial.ttf
   01/26/98  01:33p               152,260 Arialbd.ttf
   01/26/98  01:33p               171,756 Arialbi.ttf
   01/26/98  01:33p               151,660 Ariali.ttf
   01/26/98  01:33p               180,288 Cour.ttf
   01/26/98  01:33p               181,388 Courbd.ttf
   01/26/98  01:33p               186,412 Courbi.ttf
   01/26/98  01:33p               195,104 Couri.ttf
   01/26/98  01:27p                 7,028 Ctype.nls
   01/26/98  01:27p                66,082 C_1250.nls
   01/26/98  01:27p                66,082 C_1251.nls
   01/26/98  01:27p                66,082 C_1252.nls
   01/26/98  01:27p                66,082 C_1253.nls
   01/26/98  01:27p                66,082 C_1254.nls
   01/26/98  01:27p                66,082 C_1255.nls
   01/26/98  01:27p                66,082 C_1256.nls
   01/26/98  01:27p                66,082 C_1257.nls
   01/26/98  01:27p                66,082 C_1258.nls
   01/26/98  01:39p                 9,488 Kbdbe.dll (x86)
   01/26/98  01:39p                 9,488 Kbdbene.dll (x86)
   01/26/98  01:39p                10,512 Kbdcz.dll (x86)
   01/26/98  01:39p                10,000 Kbdcz1.dll (x86)
   01/26/98  01:39p                 9,488 Kbdda.dll (x86)
   01/26/98  01:39p                 9,488 Kbdest.dll (x86)
   01/26/98  01:39p                 9,488 Kbdfi.dll (x86)
   01/26/98  01:39p                 9,488 Kbdfr.dll (x86)
   01/26/98  01:39p                 9,488 Kbdgkl.dll (x86)
   01/26/98  01:39p                 9,488 Kbdgr.dll (x86)
   01/26/98  01:39p                 8,976 Kbdhe.dll (x86)
   01/26/98  01:39p                 8,976 Kbdhe220.dll (x86)
   01/26/98  01:39p                 8,976 Kbdhe319.dll (x86)
   01/26/98  01:39p                 8,976 Kbdhela2.dll (x86)
   01/26/98  01:39p                 9,488 Kbdhela3.dll (x86)
   01/26/98  01:39p                10,000 Kbdhu.dll (x86)
   01/26/98  01:39p                 8,976 Kbdhu1.dll (x86)
   01/26/98  01:39p                 9,488 Kbdic.dll (x86)
   01/26/98  01:39p                 8,976 Kbdir.dll (x86)
   01/26/98  01:39p                 8,976 Kbdit.dll (x86)
   01/26/98  01:39p                 8,976 Kbdit142.dll (x86)
   01/26/98  01:39p                 8,976 Kbdlt.dll (x86)
   01/26/98  01:39p                 9,488 Kbdlv.dll (x86)
   01/26/98  01:39p                 9,488 Kbdlv1.dll (x86)
   01/26/98  01:39p                 9,488 Kbdne.dll (x86)
   01/26/98  01:39p                 9,488 Kbdno.dll (x86)
   01/26/98  01:39p                10,000 Kbdpl.dll (x86)
   01/26/98  01:39p                 8,976 Kbdpl1.dll (x86)
   01/26/98  01:39p                 9,488 Kbdpo.dll (x86)
   01/26/98  01:39p                 9,488 Kbdsf.dll (x86)
   01/26/98  01:39p                10,000 Kbdsg.dll (x86)
   01/26/98  01:39p                10,000 Kbdsl.dll (x86)
   01/26/98  01:39p                10,000 Kbdsl1.dll (x86)
   01/26/98  01:39p                 9,488 Kbdsp.dll (x86)
   01/26/98  01:39p                 9,488 Kbdsw.dll (x86)
   01/26/98  01:39p                 9,488 Kbdtuf.dll (x86)
   01/26/98  01:39p                 9,488 Kbdtuq.dll (x86)
   01/26/98  01:39p                 8,976 Kbduk.dll (x86)
   01/26/98  01:39p                 9,488 Kbdusx.dll (x86)
   01/26/98  01:39p                 8,976 Kbdycc.dll (x86)
   01/26/98  01:39p                10,000 Kbdycl.dll (x86)
   01/26/98  01:27p               145,870 Locale.nls
   01/26/98  01:27p                   136 L_except.nls
   01/26/98  01:27p                 7,046 L_intl.nls
   01/26/98  01:27p               262,148 Sortkey.nls
   01/26/98  01:27p                 9,254 Sorttbls.nls
   01/26/98  01:33p                66,028 Symbol.ttf
   01/26/98  01:33p               197,196 Times.ttf
   01/26/98  01:33p               190,492 Timesbd.ttf
   01/26/98  01:33p               178,680 Timesbi.ttf
   01/26/98  01:33p               189,008 Timesi.ttf
   01/26/98  01:33p                81,328 Wingding.ttf

   04/08/98  09:31a             1,385,344 Eurofixa.exe
   01/26/98  01:30p               151,232 Arial.ttf
   01/26/98  01:30p               152,260 Arialbd.ttf
   01/26/98  01:30p               171,756 Arialbi.ttf
   01/26/98  01:30p               151,660 Ariali.ttf
   01/26/98  01:30p               180,288 Cour.ttf
   01/26/98  01:30p               181,388 Courbd.ttf
   01/26/98  01:30p               186,412 Courbi.ttf
   01/26/98  01:30p               195,104 Couri.ttf
   01/26/98  01:23p                 7,028 Ctype.nls
   01/26/98  01:23p                66,082 C_1250.nls
   01/26/98  01:23p                66,082 C_1251.nls
   01/26/98  01:23p                66,082 C_1252.nls
   01/26/98  01:23p                66,082 C_1253.nls
   01/26/98  01:23p                66,082 C_1254.nls
   01/26/98  01:23p                66,082 C_1255.nls
   01/26/98  01:23p                66,082 C_1256.nls
   01/26/98  01:23p                66,082 C_1257.nls
   01/26/98  01:23p                66,082 C_1258.nls
   01/26/98  01:36p                13,584 Kbdbe.dll (Alpha)
   01/26/98  01:36p                13,584 Kbdbene.dll (Alpha)
   01/26/98  01:36p                14,608 Kbdcz.dll (Alpha)
   01/26/98  01:36p                14,096 Kbdcz1.dll (Alpha)
   01/26/98  01:36p                13,584 Kbdda.dll (Alpha)
   01/26/98  01:36p                13,584 Kbdest.dll (Alpha)
   01/26/98  01:36p                13,584 Kbdfi.dll (Alpha)
   01/26/98  01:36p                13,584 Kbdfr.dll (Alpha)
   01/26/98  01:36p                14,096 Kbdgkl.dll (Alpha)
   01/26/98  01:36p                13,584 Kbdgr.dll (Alpha)
   01/26/98  01:36p                13,584 Kbdhe.dll (Alpha)
   01/26/98  01:36p                13,584 Kbdhe220.dll (Alpha)
   01/26/98  01:36p                13,584 Kbdhe319.dll (Alpha)
   01/26/98  01:36p                13,584 Kbdhela2.dll (Alpha)
   01/26/98  01:36p                13,584 Kbdhela3.dll (Alpha)
   01/26/98  01:36p                14,096 Kbdhu.dll (Alpha)
   01/26/98  01:36p                13,072 Kbdhu1.dll (Alpha)
   01/26/98  01:36p                13,584 Kbdic.dll (Alpha)
   01/26/98  01:36p                13,072 Kbdir.dll (Alpha)
   01/26/98  01:36p                13,072 Kbdit.dll (Alpha)
   01/26/98  01:36p                13,072 Kbdit142.dll (Alpha)
   01/26/98  01:36p                13,072 Kbdlt.dll (Alpha)
   01/26/98  01:36p                13,584 Kbdlv.dll (Alpha)
   01/26/98  01:36p                13,584 Kbdlv1.dll (Alpha)
   01/26/98  01:36p                13,584 Kbdne.dll (Alpha)
   01/26/98  01:36p                13,584 Kbdno.dll (Alpha)
   01/26/98  01:36p                14,096 Kbdpl.dll (Alpha)
   01/26/98  01:36p                13,584 Kbdpl1.dll (Alpha)
   01/26/98  01:36p                13,584 Kbdpo.dll (Alpha)
   01/26/98  01:36p                13,584 Kbdsf.dll (Alpha)
   01/26/98  01:36p                14,096 Kbdsg.dll (Alpha)
   01/26/98  01:36p                14,096 Kbdsl.dll (Alpha)
   01/26/98  01:36p                14,096 Kbdsl1.dll (Alpha)
   01/26/98  01:36p                13,584 Kbdsp.dll (Alpha)
   01/26/98  01:36p                13,584 Kbdsw.dll (Alpha)
   01/26/98  01:36p                14,096 Kbdtuf.dll (Alpha)
   01/26/98  01:36p                14,096 Kbdtuq.dll (Alpha)
   01/26/98  01:36p                13,072 Kbduk.dll (Alpha)
   01/26/98  01:36p                13,584 Kbdusx.dll (Alpha)
   01/26/98  01:36p                13,072 Kbdycc.dll (Alpha)
   01/26/98  01:36p                14,096 Kbdycl.dll (Alpha)
   01/26/98  01:24p               145,870 Locale.nls
   01/26/98  01:24p                   136 L_except.nls
   01/26/98  01:24p                 7,046 L_intl.nls
   01/26/98  01:24p               262,148 Sortkey.nls
   01/26/98  01:24p                 9,254 Sorttbls.nls
   01/26/98  01:30p                66,028 Symbol.ttf
   01/26/98  01:30p               197,196 Times.ttf
   01/26/98  01:30p               190,492 Timesbd.ttf
   01/26/98  01:30p               178,680 Timesbi.ttf
   01/26/98  01:30p               189,008 Timesi.ttf
   01/26/98  01:30p                81,328 Wingding.ttf

/atapi-fix

   04/16/98  08:43a                86,096 Ata-fixi.exe
   01/26/98  01:16p                26,448 Atapi.sys (x86)

   04/16/98  08:43a               147,792 Ata-fixa.exe
   01/26/98  01:12p                60,336 Atapi.sys (Alpha)

/netbt-fix

   04/22/98  03:05p               193,464 Nbtfix-i.exe
   12/18/97  06:43p               119,856 Netbt.sys (x86)

   04/22/98  03:05p               260,608 Nbtfix-a.exe
   12/18/97  06:40p               220,048 Netbt.sys (Alpha)

/lsa2-fix

   04/28/98  03:00p               562,536 Lsa2fixi.exe
   04/27/98  09:48a               154,896 Lsasrv.dll (x86)
   04/25/98  04:45p                18,704 Msaudite.dll (x86)
   04/27/98  09:48a                40,208 Msv1_0.dll (x86)
   04/25/98  04:45p               169,232 Samsrv.dll (x86)
   04/27/98  09:49a               130,832 Services.exe (x86)

   04/28/98  03:00p               618,304 Lsa2fixa.exe
   04/15/98  09:37a               253,200 Lsasrv.dll (Alpha)
   04/02/98  03:24p                22,800 Msaudite.dll (Alpha)
   04/15/98  09:37a                66,832 Msv1_0.dll (Alpha)
   04/21/98  11:20a               288,528 Samsrv.dll (Alpha)
   04/24/98  02:55p               241,936 Services.exe (Alpha)


-----------------------------------------------------------------------------------------------------------------------------

i don't know if any of them address your specific problem, but as I eluded to earlier,
several of them were meant to stop network flooding attacks, ping attacks, and other
attacks based on people bombarding your system from either inside or outside..

the simptcp, and teardrop2 fixes seem to ring a bell as being related to lockups and these types of attacks..


good luck



0
 
LVL 2

Expert Comment

by:gantriis
ID: 1794259
Hi tall.

A couple of additional questions that might help us troubleshoot this problem (sorry if any of the questions bave been covered earlier - it was a very long story to read through):

1. Did you check for and uninstall any virus check software that you might be running on the server as mujeeb suggested? Any difference?

2. What kind of network topology do you have? Usual Ethernet, Token-ring or FDDI or ATM? In any case it would be a good idea to check for updates to the network adapter driver. In case of FDDI or ATM you should consider moving the server to a usual Ethernet segment using a proven network adapter/driver while troubleshooting.

3. Setup Performance logging (to a file). Log at least the objects Memory, Process, Processor and not the least Server.

4. Setup another system on the same network segment with Network Monitor and log all traffic sent by the server. Once the server is in the problem-state you will be able to examine the latest traffic sent (if any) by the server. As it looks like the Windows NT Server service is having a resource problem it might even tell the clients (as an error code in the SMB response to a client request) what problem it ran into.

Cheers
Gantriis
0
 
LVL 1

Expert Comment

by:dtavassoli
ID: 1794260
So many points, so many answers... Are we experts all so vain ?? ;-))

Anyway, here's my meager contribution :

- we had a few SW tools that needed specific socket numbers in the install script or in the FlexLM license file, and at one point we tried giving the same socket number to different tools. I can't remember having that error message though, but it might be worth a check...

D
0
 

Author Comment

by:tall
ID: 1794261
Yesterday, I applied srv-fix as suggested by tfabian.
I re-enabled the McAfee Netshield scanner, and it hasn't happened since.
I'll let you know if that was it.

0
 

Expert Comment

by:rburrows
ID: 1794262
I had exactly the same problem -  and yes... it was McAfee that was doing it.
0
 
LVL 1

Accepted Solution

by:
klute earned 1000 total points
ID: 1794263
Here are a couple of things that you can do.

1) Remove any non crucial system services or TSR's from the system (Such as Mcafee ) You can do a work around as far as mcafee goes by installing only the Mcafee scan product (not the v-shield thing)and scheduling a nightly scan one or two times a day through the AT command in the shell.

2) Upgrade to service pack 4 ftp.microsoft.com/bussys/
3) Increase the swap file sizes, and in you have multiple Hd spread the swap accross all of the drives
4) Make sure that the system has a good couple hundred megs of free space.

0
 
LVL 5

Expert Comment

by:tfabian
ID: 1794264
the service pack 4 idea isn't bad but it comes with a few caveats..

when I applied SP4 to a running system it messed up the disk that it was being unpacked to.. the file allocation table (for lack of a better description) went heywire..

I ended up losing the entire disk and having to low level reformat it...  it was NTFS..

when I rebuilt the machine, and reinstalled SP4 directly on top of NT (instead of ontop of SP3) it worked fine...

be careful..

btw, SP4 contains all the SP3 hotfixes I wrote about earlier..


 
0
 

Expert Comment

by:plierop
ID: 2663865
Hello Tall,

I have at this moment the same problems as you described.
It is a NT 4.0 Server with Service Pack 5.
On this machine is also running Mc Afee NetShield.
When we disable the Mc Afee Services the Server is stable.
When we start the Services from Mc Afee, after a period of time it generate Event 2022 "The Server was unable to ....", then the server crashes.
When you applied the srv-fix your problem was solved. We have SP5 installed. I thought that a new SP always contained the post fixes from a previous SP.
Did you changed something else except the fix?
0

Featured Post

Want to promote your upcoming event?

Are you going to an event? Are you going to be exhibiting at a tradeshow? Talking at a conference? Using a promotional banner in your email signature ensures that your organization’s most important contacts stay in the know and can potentially spread the word about the event.

Join & Write a Comment

Suggested Solutions

Today, still in the boom of Apple, PC's and products, nearly 50% of the computer users use Windows as graphical operating systems. If you are among those users who love windows, but are grappling to keep the system's hard drive optimized, then you s…
Possible fixes for Windows 7 and Windows Server 2008 updating problem. Solutions mentioned are from Microsoft themselves. I started a case with them from our Microsoft Silver Partner option to open a case and get direct support from Microsoft. If s…
This video Micro Tutorial explains how to clone a hard drive using a commercial software product for Windows systems called Casper from Future Systems Solutions (FSS). Cloning makes an exact, complete copy of one hard disk drive (HDD) onto another d…
The viewer will learn how to successfully create a multiboot device using the SARDU utility on Windows 7. Start the SARDU utility: Change the image directory to wherever you store your ISOs, this will prevent you from having 2 copies of an ISO wit…

760 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

18 Experts available now in Live!

Get 1:1 Help Now