Event ID 1 — Volume Shadow Copy Service Initialization

Event ID 1 — Volume Shadow Copy Service Initialization

Updated: January 27, 2011

Applies To: Windows Server 2008 R2

The Volume Shadow Copy Service (VSS) provides the ability to create a point in time image (shadow copy) of one or more volumes that can be used to perform backups. The service is also used during restores of applications. After the VSS service is initialized, VSS requester applications can perform backups and restores in cooperation with VSS writers that manage application data to be backed up and VSS providers that create and manage shadow copies.

Event Details

Product: Windows Operating System
ID: 1
Source: VSS
Version: 6.1
Symbolic Name: VSS_ERROR_STARTING_SERVICE_CTRL_DISPATCHER
Message: Volume Shadow Copy Service initialization error: the control dispatcher cannot be started [%1]. %2

Resolve
Review Service Control Manager events in Event Viewer and take appropriate action

This event indicates that the Volume Shadow Copy Service (VSS) could not register its dispatcher function with the Service Control Manager during VSS service initialization.

To perform this procedure, you must have membership in Administrators, or you must have been delegated the appropriate authority.

To view the VSS events in the Windows System event log:

  1. Open Event Viewer. Click Start, click Run, type eventvwr.msc, and then click OK. If the User Account Control dialog box appears, ensure that the action it displays is what you want, and then click Continue.
  2. In Event Viewer, expand Windows Logs, and then click System.
  3. To create a filtered view of just the Service Control Manager events, click Action, click Create Custom View, choose By source, and in the Event sources drop-down list, select Service Control Manager, and then click OK.
  4. In Save Filter to Custom View, provide a name and description.
  5. In the left pane, expand Custom View, right-click the name of the custom view that you created, and then click Find.
  6. To find all the Service Control Manager Eventlog Provider events for VSS, in Find what, type: Shadow Copy.
  7. To examine an event, double-click the event, and then click Event Log Online Help for more information about how to resolve the issue.
  8. If you cannot resolve the issue, contact Microsoft Customer Service and Support. For more information, see http://go.microsoft.com/fwlink/?LinkId=102491. You should provide the entire event log message as it appears in the Event Viewer.

Verify

To verify that the Volume Shadow Copy Service (VSS service) is available, perform the following procedure, and then retry the previous Volume Shadow Copy Service (VSS) operation.

To perform this procedure, you must have membership in Administrators, or you must have been delegated the appropriate authority.

To verify that the VSS service is available:

  1. Open an elevated Command Prompt window by clicking Start, pointing to All Programs, clicking Accessories, right-clicking Command Prompt, and then clicking Run as administrator.
  2. At the prompt, type: net start vss.
  3. View the text message to verify that the service starts or is already started.

Related Management Information

Volume Shadow Copy Service Initialization

File Services

Related:

Event ID 9011 — TCP/IP Network Connectivity

Event ID 9011 — TCP/IP Network Connectivity

Updated: April 17, 2008

Applies To: Windows Server 2008

Network connectivity allows your computer to communicate with other hosts on your network and the Internet. Connectivity might be full (Internet and intranet), partial (local subnet only), or non-existent.

Event Details

Product: Windows Operating System
ID: 9011
Source: tcpip
Version: 6.0
Symbolic Name: EVENT_TRANSPORT_BAD_PROTOCOL
Message: %2 received an unexpected %3 packet from a remote computer.

Resolve
Initialize TCP/IP

Refresh the protocol configuration on the network interface by disabling it and then enabling it again.

To perform this procedure, you must have membership in Administrators, or you must have been delegated the appropriate authority.

To disable and then re-enable the network interface:

  1. Click Control Panel, double-click Network and Sharing Center, and then click Manage network connections.
  2. Right-click the network interface you want to disable, and then click Disable.
  3. Right-click the network interface again, and then click Enable.

Verify

To perform this procedure, you must have membership in Administrators, or you must have been delegated the appropriate authority.

To verify TCP/IP connectivity:

  1. Click Start, point to All Programs, click Accessories, right-click Command Prompt, and then click Run as administrator.
  2. Click Continue when prompted by User Account Control, and then provide the administrator password, if requested.
  3. Type ping followed by an IP address of another host on the network.
  4. If the ping command succeeds, connectivity is established.

Note:   Windows Firewall might prevent a succesful ping operation. You might need to configure a port exception for the ping to succeed.

Related Management Information

TCP/IP Network Connectivity

Networking

Related:

Event ID 9010 — TCP/IP Configuration

Event ID 9010 — TCP/IP Configuration

Updated: January 7, 2009

Applies To: Windows Server 2008 R2

TCP/IP configuration encompasses network settings, default gateway, and IP address (static or dynamic).

 

 

Event Details

Product: Windows Operating System
ID: 9010
Source: tcpip
Version: 6.1
Symbolic Name: EVENT_TRANSPORT_TOO_MANY_LINKS
Message: %2 could not create a link to a remote computer. Your computer has exceeded the number of connections it can make to that remote computer.

Resolve
Reduce load on the remote computer

If the connection to the remote computer cannot be established because of connection limit has been exceeded, wait for connections on the remote computer to close before establishing new ones.

Verify

To perform this procedure, you must have membership in Administrators, or you must have been delegated the appropriate authority.

To verify that the an IP address is assigned:

  1. Click Start, click Run, type cmd, and then press ENTER.
  2. Type ipconfig /all to view the IP address configuration of the server.
  3. Examine the output of the ipconfig command. If there is no IP address listed, then the server has not been assigned a static IP address.

Related Management Information

TCP/IP Configuration

Networking

Related:

Event ID 9009 — TCP/IP Network Performance

Event ID 9009 — TCP/IP Network Performance

Updated: April 17, 2008

Applies To: Windows Server 2008

Network performance encompasses all aspects of data transfer performance, such as download and upload speeds, number of packets dropped versus packets delivered, and the round-trip time of connections.

These aspects of network performance might be affected by congestion in the network. In the case of wireless networks, signal attenuation, electromagnetic interference, and the mobility of the host also affect network performance.

Event Details

Product: Windows Operating System
ID: 9009
Source: tcpip
Version: 6.0
Symbolic Name: EVENT_TRANSPORT_TRANSFER_DATA
Message: %2 could not transfer a packet from the network adapter. The packet was dropped.

Resolve
Reduce the load on the remote computer

If the packets are dropped because of network congestion and poor network performance, reduce the load on, or increase the capacity of, the computer.

 

Verify

To perform this procedure, you must have membership in Administrators, or you must have been delegated the appropriate authority.

To measure network performance, run Performance Monitor:

  1. Click Start, click All Programs, click Accessories, right-click Command Prompt, and then click Run as administrator.
  2. Click Continue when prompted by User Account Control, and then provide the administrator password, if requested.
  3. In the Performance Monitor console tree, click Reliability and Performance.
  4. Network, CPU, and memory utilization data are available in the details pane.

If you have recorded Performance Monitor counters in the past, compare the current load to your average loads over time. If you do not have any baseline readings from past performance monitoring, continue to monitor network, CPU, and memory utilization by looking for large fluctuations in performance that might indicate a heavy traffic load or an attack.

Related Management Information

TCP/IP Network Performance

Networking

Related:

Event ID 9008 — TCP/IP Network Interface Configuration

Event ID 9008 — TCP/IP Network Interface Configuration

Updated: April 17, 2008

Applies To: Windows Server 2008

The network configuration interface settings of your computer determine the way in which it communicates with other computers and devices on the network.

Event Details

Product: Windows Operating System
ID: 9008
Source: tcpip
Version: 6.0
Symbolic Name: EVENT_TRANSPORT_QUERY_OID_FAILED
Message: %2 failed while querying OID %3 on network adapter %4.

Resolve
Remove and add TCP/IP protocol or reset Winsock catalog

The TCP/IP protocol is not properly installed on the network interface.

To perform this procedure, you must have membership in Administrators, or you must have been delegated the appropriate authority.

To remove the protocol from the network interface and add it again:

  1. Click Control Panel, double-click Network and Sharing Center, and then click Manage network connections.
  2. Right-click the network interface you want to repair, click Properties, clear the Internet Protocol Version 4 (TCP/IPv4) check box, and then click OK.
  3. Right-click the same network interface, click Properties, select the Internet Protocol Version 4 (TCP/IPv4) check box, and then click OK.

If the problem persists, reset the Winsock catalog:

  1. Click Start, click All Programs, click Accessories, right-click Command Prompt, and then click Run as administrator.
  2. Click Continue when prompted by User Account Control, and then provide the administrator password, if requested.
  3. At the command prompt, type netsh winsock reset, and then press ENTER.
  4. The output of the netsh winsock reset command should indicate a successful reset.
  5. Restart the computer to complete the reset of the Winsock catalog.

Verify

To verify that an IP address is assigned:

  1. At the DHCP-enabled client computer, click Start, click Run, and then type cmd.
  2. Type ipconfig /all to view lease-status information.
  3. The output of the ipconfig command should show an IPv4 or IPv6 address marked “preferred.”

Related Management Information

TCP/IP Network Interface Configuration

Networking

Related:

Event ID 9006 — TCP/IP Network Interface Configuration

Event ID 9006 — TCP/IP Network Interface Configuration

Updated: April 17, 2008

Applies To: Windows Server 2008

The network configuration interface settings of your computer determine the way in which it communicates with other computers and devices on the network.

Event Details

Product: Windows Operating System
ID: 9006
Source: tcpip
Version: 6.0
Symbolic Name: EVENT_TRANSPORT_ADAPTER_NOT_FOUND
Message: %2 could not find network adapter %3.

Resolve
Remove and add TCP/IP protocol or reset Winsock catalog

The TCP/IP protocol is not properly installed on the network interface.

To perform this procedure, you must have membership in Administrators, or you must have been delegated the appropriate authority.

To remove the protocol from the network interface and add it again:

  1. Click Control Panel, double-click Network and Sharing Center, and then click Manage network connections.
  2. Right-click the network interface you want to repair, click Properties, clear the Internet Protocol Version 4 (TCP/IPv4) check box, and then click OK.
  3. Right-click the same network interface, click Properties, select the Internet Protocol Version 4 (TCP/IPv4) check box, and then click OK.

If the problem persists, reset the Winsock catalog:

  1. Click Start, click All Programs, click Accessories, right-click Command Prompt, and then click Run as administrator.
  2. Click Continue when prompted by User Account Control, and then provide the administrator password, if requested.
  3. At the command prompt, type netsh winsock reset, and then press ENTER.
  4. The output of the netsh winsock reset command should indicate a successful reset.
  5. Restart the computer to complete the reset of the Winsock catalog.

Verify

To verify that an IP address is assigned:

  1. At the DHCP-enabled client computer, click Start, click Run, and then type cmd.
  2. Type ipconfig /all to view lease-status information.
  3. The output of the ipconfig command should show an IPv4 or IPv6 address marked “preferred.”

Related Management Information

TCP/IP Network Interface Configuration

Networking

Related:

Event ID 9003 — TCP/IP Configuration

Event ID 9003 — TCP/IP Configuration

Updated: January 7, 2009

Applies To: Windows Server 2008 R2

TCP/IP configuration encompasses network settings, default gateway, and IP address (static or dynamic).

 

 

Event Details

Product: Windows Operating System
ID: 9003
Source: tcpip
Version: 6.1
Symbolic Name: EVENT_TRANSPORT_RESOURCE_SPECIFIC
Message: %2 could not allocate a resource of type %3 due to a specifically configured limit of %4.

Resolve
Initialize TCP/IP

Refresh the protocol configuration on the network interface by disabling it and then enabling it again.

To perform this procedure, you must have membership in Administrators, or you must have been delegated the appropriate authority.

To disable and then re-enable the network interface:

  1. Click Control Panel, double-click Network and Sharing Center, and then click Manage network connections.
  2. Right-click the network interface you want to disable, and then click Disable.
  3. Right-click the network interface again, and then click Enable.

Verify

To perform this procedure, you must have membership in Administrators, or you must have been delegated the appropriate authority.

To verify that the an IP address is assigned:

  1. Click Start, click Run, type cmd, and then press ENTER.
  2. Type ipconfig /all to view the IP address configuration of the server.
  3. Examine the output of the ipconfig command. If there is no IP address listed, then the server has not been assigned a static IP address.

Related Management Information

TCP/IP Configuration

Networking

Related:

Event ID 9002 — TCP/IP Network Connectivity

Event ID 9002 — TCP/IP Network Connectivity

Updated: January 7, 2009

Applies To: Windows Server 2008 R2

Network connectivity allows your computer to communicate with other hosts on your network and the Internet. Connectivity might be full (Internet and intranet), partial (local subnet only), or non-existent.

Event Details

Product: Windows Operating System
ID: 9002
Source: tcpip
Version: 6.1
Symbolic Name: EVENT_TRANSPORT_RESOURCE_LIMIT
Message: %2 could not allocate a resource of type %3 due to its configured size of %4.

Resolve
Initialize TCP/IP

Refresh the protocol configuration on the network interface by disabling it and then enabling it again.

To perform this procedure, you must have membership in Administrators, or you must have been delegated the appropriate authority.

To disable and then re-enable the network interface:

  1. Click Control Panel, double-click Network and Sharing Center, and then click Manage network connections.
  2. Right-click the network interface you want to disable, and then click Disable.
  3. Right-click the network interface again, and then click Enable.

Verify

To perform this procedure, you must have membership in Administrators, or you must have been delegated the appropriate authority.

To verify TCP/IP connectivity:

  1. Click Start, point to All Programs, click Accessories, right-click Command Prompt, and then click Run as administrator.
  2. Click Continue when prompted by User Account Control, and then provide the administrator password, if requested.
  3. Type ping followed by an IP address of another host on the network.
  4. If the ping command succeeds, connectivity is established.

Note:   Windows Firewall might prevent a succesful ping operation. You might need to configure a port exception for the ping to succeed.

Related Management Information

TCP/IP Network Connectivity

Networking

Related:

Event ID 9001 — TCP/IP Network Connectivity

Event ID 9001 — TCP/IP Network Connectivity

Updated: April 17, 2008

Applies To: Windows Server 2008

Network connectivity allows your computer to communicate with other hosts on your network and the Internet. Connectivity might be full (Internet and intranet), partial (local subnet only), or non-existent.

Event Details

Product: Windows Operating System
ID: 9001
Source: tcpip
Version: 6.0
Symbolic Name: EVENT_TRANSPORT_RESOURCE_POOL
Message: %2 could not allocate a resource of type %3 due to system resource problems.

Resolve
Initialize TCP/IP

Refresh the protocol configuration on the network interface by disabling it and then enabling it again.

To perform this procedure, you must have membership in Administrators, or you must have been delegated the appropriate authority.

To disable and then re-enable the network interface:

  1. Click Control Panel, double-click Network and Sharing Center, and then click Manage network connections.
  2. Right-click the network interface you want to disable, and then click Disable.
  3. Right-click the network interface again, and then click Enable.

Verify

To perform this procedure, you must have membership in Administrators, or you must have been delegated the appropriate authority.

To verify TCP/IP connectivity:

  1. Click Start, point to All Programs, click Accessories, right-click Command Prompt, and then click Run as administrator.
  2. Click Continue when prompted by User Account Control, and then provide the administrator password, if requested.
  3. Type ping followed by an IP address of another host on the network.
  4. If the ping command succeeds, connectivity is established.

Note:   Windows Firewall might prevent a succesful ping operation. You might need to configure a port exception for the ping to succeed.

Related Management Information

TCP/IP Network Connectivity

Networking

Related:

Event ID 16384 — Jobs

Event ID 16384 — Jobs

Updated: December 13, 2007

Applies To: Windows Server 2008

A BITS job represents one application’s request to transfer a set of files from a server or to a server. A job contains one or more files to transfer, and properties that specify how BITS transfers the files and interacts with an application (such as the priority of the job, the number of files allowed, and the network credentials used to authenticate to a server).

Event Details

Product: Windows Operating System
ID: 16384
Source: Microsoft-Windows-Bits-Client
Version: 7.0
Symbolic Name: BITS_EV_JOB_CANCELLED
Message: The administrator %4 canceled job “%2” on behalf of %3. The job ID was %1.

Resolve

This is a normal condition. No further action is required.

Related Management Information

Jobs

BITS Infrastructure

Related: