Link to home
Create AccountLog in
Avatar of kastro
kastroFlag for New Zealand

asked on

DCOM error

Event 10009 Distributed Com

I am running win server 2008 re enterprise
my system log file is generating lot of entries like DCOM is unable to communicate with the computer ip(xxx.xxx.xxx) using any of the configured protocol.

every time it gives the error with different ip.its an urgent
Avatar of kastro
kastro
Flag of New Zealand image

ASKER

I need an urgent solution plzzz
You can pretty much ignore these errors
They are nothing serious
They simply state decom is suppressed on the clientside
The most common cause of this are Dns entries pointing to devices with an ip that is no longer on the network
Avatar of kastro

ASKER

Actually its creating so much logs that my system is going out of space
Ok Can you post an error event including its binary code

Also have a look at this - may help ?


https://www.experts-exchange.com/questions/26562416/Frustrated-with-Event-10009-DistributedCOM-Errors.html
Avatar of kastro

ASKER

Binary data:


In Words

0000: 6365523C 2364726F 43203A31 75706D6F
0008: 3D726574 6C756E28 503B296C 373D6469
0010: 333B3034 2F34322F 33313032 313A3620
0018: 3A343A39 533B3039 75746174 37313D73
0020: 473B3232 6F636E65 323D706D 7465443B
0028: 3D636F6C 30313731 616C463B 303D7367
0030: 7261503B 3D736D61 507B3B31 6D617261
0038: 303A3023 523C3E7D 726F6365 3A322364
0040: 6D6F4320 65747570 6E283D72 296C6C75
0048: 6469503B 3034373D 322F333B 30322F34
0050: 36203331 3A39313A 30393A34 6174533B
0058: 3D737574 32323731 6E65473B 706D6F63
0060: 3B38313D 6C746544 333D636F 463B3331
0068: 7367616C 503B303D 6D617261 3B303D73
0070: 65523C3E 64726F63 203A3323 706D6F43
0078: 72657475 756E283D 3B296C6C 3D646950
0080: 3B303437 34322F33 3130322F 3A362033
0088: 343A3931 3B30393A 74617453 313D7375
0090: 31363030 6E65473B 706D6F63 3B38313D
0098: 6C746544 333D636F 463B3131 7367616C
00a0: 503B303D 6D617261 3B333D73 7261507B
00a8: 30236D61 3533313A 61507B7D 236D6172
00b0: 7D303A31 7261507B 32236D61 3778303A
00b8: 31303063 30636130 30303030 7D303030
00c0: 65523C3E 64726F63 203A3423 706D6F43
00c8: 72657475 756E283D 3B296C6C 3D646950
00d0: 3B303437 34322F33 3130322F 3A362033
00d8: 343A3931 3B30393A 74617453 313D7375
00e0: 31363030 6E65473B 706D6F63 3B38313D
00e8: 6C746544 333D636F 463B3831 7367616C
00f0: 503B303D 6D617261 3B303D73 3E


In Bytes

0000: 3C 52 65 63 6F 72 64 23   <Record#
0008: 31 3A 20 43 6F 6D 70 75   1: Compu
0010: 74 65 72 3D 28 6E 75 6C   ter=(nul
0018: 6C 29 3B 50 69 64 3D 37   l);Pid=7
0020: 34 30 3B 33 2F 32 34 2F   40;3/24/
0028: 32 30 31 33 20 36 3A 31   2013 6:1
0030: 39 3A 34 3A 39 30 3B 53   9:4:90;S
0038: 74 61 74 75 73 3D 31 37   tatus=17
0040: 32 32 3B 47 65 6E 63 6F   22;Genco
0048: 6D 70 3D 32 3B 44 65 74   mp=2;Det
0050: 6C 6F 63 3D 31 37 31 30   loc=1710
0058: 3B 46 6C 61 67 73 3D 30   ;Flags=0
0060: 3B 50 61 72 61 6D 73 3D   ;Params=
0068: 31 3B 7B 50 61 72 61 6D   1;{Param
0070: 23 30 3A 30 7D 3E 3C 52   #0:0}><R
0078: 65 63 6F 72 64 23 32 3A   ecord#2:
0080: 20 43 6F 6D 70 75 74 65    Compute
0088: 72 3D 28 6E 75 6C 6C 29   r=(null)
0090: 3B 50 69 64 3D 37 34 30   ;Pid=740
0098: 3B 33 2F 32 34 2F 32 30   ;3/24/20
00a0: 31 33 20 36 3A 31 39 3A   13 6:19:
00a8: 34 3A 39 30 3B 53 74 61   4:90;Sta
00b0: 74 75 73 3D 31 37 32 32   tus=1722
00b8: 3B 47 65 6E 63 6F 6D 70   ;Gencomp
00c0: 3D 31 38 3B 44 65 74 6C   =18;Detl
00c8: 6F 63 3D 33 31 33 3B 46   oc=313;F
00d0: 6C 61 67 73 3D 30 3B 50   lags=0;P
00d8: 61 72 61 6D 73 3D 30 3B   arams=0;
00e0: 3E 3C 52 65 63 6F 72 64   ><Record
00e8: 23 33 3A 20 43 6F 6D 70   #3: Comp
00f0: 75 74 65 72 3D 28 6E 75   uter=(nu
00f8: 6C 6C 29 3B 50 69 64 3D   ll);Pid=
0100: 37 34 30 3B 33 2F 32 34   740;3/24
0108: 2F 32 30 31 33 20 36 3A   /2013 6:
0110: 31 39 3A 34 3A 39 30 3B   19:4:90;
0118: 53 74 61 74 75 73 3D 31   Status=1
0120: 30 30 36 31 3B 47 65 6E   0061;Gen
0128: 63 6F 6D 70 3D 31 38 3B   comp=18;
0130: 44 65 74 6C 6F 63 3D 33   Detloc=3
0138: 31 31 3B 46 6C 61 67 73   11;Flags
0140: 3D 30 3B 50 61 72 61 6D   =0;Param
0148: 73 3D 33 3B 7B 50 61 72   s=3;{Par
0150: 61 6D 23 30 3A 31 33 35   am#0:135
0158: 7D 7B 50 61 72 61 6D 23   }{Param#
0160: 31 3A 30 7D 7B 50 61 72   1:0}{Par
0168: 61 6D 23 32 3A 30 78 37   am#2:0x7
0170: 63 30 30 31 30 61 63 30   c0010ac0
0178: 30 30 30 30 30 30 30 7D   0000000}
0180: 3E 3C 52 65 63 6F 72 64   ><Record
0188: 23 34 3A 20 43 6F 6D 70   #4: Comp
0190: 75 74 65 72 3D 28 6E 75   uter=(nu
0198: 6C 6C 29 3B 50 69 64 3D   ll);Pid=
01a0: 37 34 30 3B 33 2F 32 34   740;3/24
01a8: 2F 32 30 31 33 20 36 3A   /2013 6:
01b0: 31 39 3A 34 3A 39 30 3B   19:4:90;
01b8: 53 74 61 74 75 73 3D 31   Status=1
01c0: 30 30 36 31 3B 47 65 6E   0061;Gen
01c8: 63 6F 6D 70 3D 31 38 3B   comp=18;
01d0: 44 65 74 6C 6F 63 3D 33   Detloc=3
01d8: 31 38 3B 46 6C 61 67 73   18;Flags
01e0: 3D 30 3B 50 61 72 61 6D   =0;Param
01e8: 73 3D 30 3B 3E            s=0;>
Seems the "offending process" is 740

I noted this from a google article

 There is a problem accessing the COM Service on a remote computer. To resolve this problem:
 •Ensure that the remote computer is online.
•This problem may be the result of a firewall blocking the connection. For security, COM+ network access is not enabled by default. Check the system to determine whether the firewall is blocking the remote connection.

I have checked a server that logs these errors "pretty much every sbs2011/2008 server does" I have never really worried about it as it does not appear to affect their performance and I do not see the log growth you are experiencing

On the servers I am looking at the com+ components are not enabled in the general firewall settings
However, I am not sure what security implications would occur if you were to try enabling them - will wait for another expert to advise?

Do the computers reported in the errors actually exist at the IP's indicated and are they online?
Avatar of kastro

ASKER

some of them exist but some are not. Moreover firewall on the system is disabled.Kaspersky Antivirus is running and symentic backupexec is running on this machine.
Thanks Modulus_Twelve

Think we need a bit more firepower on this than i can give on my own :-)
No you misunderstand, I geniunely want some further assistance with this - running out of ideas
Avatar of kastro

ASKER

appreciate your efforts but this Dcom error now making me crazy.I have stopped the Backupexec service then stop the antivirus services running on this server but this error did not stop.now i m looking at the NIC Teaming .Please if you have some other idea let me know.
Avatar of Member_2_6515809
Member_2_6515809

Hi ayazabbasi, I'm reluctant to just post a link, but cpmcomputers has it right - it's normally a benign non-ideal networking condition.  It's one of the things that happens when you network windows computers, it doesn't necessarily mean that there's a problem with your server configuration.

http://blogs.msdn.com/b/asiatech/archive/2010/03/16/how-to-troubleshoot-dcom-10009-error-logged-in-system-event.aspx
ASKER CERTIFIED SOLUTION
Avatar of cpmcomputers
cpmcomputers
Flag of United Kingdom of Great Britain and Northern Ireland image

Link to home
membership
Create a free account to see this answer
Signing up is free and takes 30 seconds. No credit card required.
See answer
Avatar of kastro

ASKER

Thanx