Secondary DNS spitting multiple event ID 9999 and 6522 and after a while chokes DNS to a halt

I have Active Directory Integrated DNS servers (about 7 AD DNS) which are transfering there zones to Secondary DNS.  I noticed a trend where the secondady DNS servers chokes to a halt after every 12-13 days.  On the Secondary DNS servers DNS event log there are several informational event ID 6522 and 3150 before I get Event ID 3000.  After that I get multiple event ID 6522 and 9999 alternativley and continously for several days which then chokes DNS and hangs the DNS service.  I have to reboot the secondary DNS servers for it to resume work.  Anybody have an Idea what I can do to stop this trend from happening over and over.

Any input would be highly appreciated.
KMacakiageAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Erik BjersPrincipal Systems AdministratorCommented:
This is all coppied from eventid.net

Event ID 6522
This is a self-explanatory event. If your DNS server is of "Standard Secondary" type, it requests the new version of the authoritative zone from the Master DNS server. This can be inititated in two ways:
1. Your DNS server is checking periodically the version of the SOA record on the primary and if it is found larger than the last time, the server requests a zone transfer.
2. Instantly after a zone change, if you use DNS notify on the primary server.

Event ID 3150
See M181600 to find out how to configure a secondary DNS Server with Windows NT.

This event should be self-explanatory (and probably it is for most of the cases). However, we have received a report for this event occuring in the following conditions: "No symptoms other than event log entries in the DNS log file under Windows 2000 server (SP2 currently). This Information entry will occur 6 to 10 times and then a Warning Event Id 9999. The cycle repeats (3150s and then 9999 event IDs. The domain has only one server, thus no Active Directory transfers can occur. However, DNS is Active Directory Integrated and is set to deny any Zone Transfers.". We don't have any info about what would cause this

Event ID 3000
Casey C (Last update 10/7/2003):
In my case, I had accidentally deleted an Active Directory domain zone file for a test domain that was pointing to the server. See M249868 for more details.

Adrian Grigorof
The reason why this happens is that the DNS server is logging too many events and for this reason, it's stopping temporarily (so logging won't affect it's main duty, DNS resolution. One suggestion from newsgroups is to turn on verbose logging. From the server properties in the DNS console, turn on all loging.  

Event ID 9999
Description
DNS Server has encounters numerous run-time events. These are usually caused by the reception of bad or unexpected packets, or from problems with or excessive replication traffic. The data is the number of suppressed events encountered in the last 15 minute interval.  
English please! Request a translation of the event description in plain English! An example of "English please" is available here.  

Things to understand
What is a runtime?
What is the role of a DNS server?  

Comments
As per Microsoft: "The occurrence of these event error messages does not necessarily indicate a problem with the DNS service" This event  indicates that a number of events were blocked by DNS from being logged in Event Viewer (the number itself is in the "Data" section). After this event, the logging starts again.  

Links
http://support.microsoft.com/default.aspx?scid=kb;en-us;198757
http://support.microsoft.com/default.aspx?scid=kb;en-us;199792

I hope some of this helps out, and highley recomend a membership at eventid.net

eb


0
KMacakiageAuthor Commented:
True event ID 9999 refers to the number of suppressed events encountered in the last 15 minute interval..... and I have already turned on All loggings.  These logs would not been a problem, however like I said, after every 13 days I start getting  Error event ID 111 and DNS thinks that  the system is running low on resources .... "Close any applications not in use or reboot the computer to free memory.

I will try to run dnscmd /config /eventcontrolsuppression 1 and see what happens.
0
Erik BjersPrincipal Systems AdministratorCommented:
I did not see mention of eventid 111, I will research that one and get back to you.
eb
0
Erik BjersPrincipal Systems AdministratorCommented:
This is all I've found so far

You may also want to run some sort of performance monitoring soulution to track the actual usage of system resources, it may actualy be running low.

As per Microsoft: "To check the NetBIOS over TCP/IP configuration: 1. Open Control Panel, and double-click Network and Dial-up Connections . 2. Click the Protocols  tab, and click TCP/IP Protocol  in the Network Protocols list. 3. Click Properties , and then click the WINS Address  tab. 4. Verify that the IP addresses for both the primary and secondary WINS servers are correct, and that the Enable DNS for Windows Resolution  check box is selected. 5. Click the Bindings tab, and verify that the WINS (TCP/IP) protocol is bound to the network adapter. If you continue to receive this message, verify that the WINS reverse lookup record has been configured correctly by using DNS Manager or by opening the appropriate XXX.XXX.in-addr.arpa database file located in the Systemroot /System32/Dns folder. You can edit this database file using Notepad but you must stop DNS first".  

eb
0
KMacakiageAuthor Commented:
This problem was caused by DNS patch that was released in November 2007.  I cannot remember the KB number, but called MS and they confirmed that it is a known issue. .... solution was to uninstal the patch.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows 2000

From novice to tech pro — start learning today.