Event 9009 – Intelligent Systems Monitoring

Event ID 9009 — TCP/IP Network Performance

June 1, 2017June 1, 2017 PCIS Support Team Leave a comment

Event ID 9009 — TCP/IP Network Performance

Updated: April 17, 2008

Applies To: Windows Server 2008

Network performance encompasses all aspects of data transfer performance, such as download and upload speeds, number of packets dropped versus packets delivered, and the round-trip time of connections.

These aspects of network performance might be affected by congestion in the network. In the case of wireless networks, signal attenuation, electromagnetic interference, and the mobility of the host also affect network performance.

Event Details

Product:	Windows Operating System
ID:	9009
Source:	tcpip
Version:	6.0
Symbolic Name:	EVENT_TRANSPORT_TRANSFER_DATA
Message:	%2 could not transfer a packet from the network adapter. The packet was dropped.

Resolve
Reduce the load on the remote computer

If the packets are dropped because of network congestion and poor network performance, reduce the load on, or increase the capacity of, the computer.

Verify

To perform this procedure, you must have membership in Administrators, or you must have been delegated the appropriate authority.

To measure network performance, run Performance Monitor:

Click Start, click All Programs, click Accessories, right-click Command Prompt, and then click Run as administrator.
Click Continue when prompted by User Account Control, and then provide the administrator password, if requested.
In the Performance Monitor console tree, click Reliability and Performance.
Network, CPU, and memory utilization data are available in the details pane.

If you have recorded Performance Monitor counters in the past, compare the current load to your average loads over time. If you do not have any baseline readings from past performance monitoring, continue to monitor network, CPU, and memory utilization by looking for large fluctuations in performance that might indicate a heavy traffic load or an attack.

Related Management Information

TCP/IP Network Performance

Networking

Event ID 9009 — IIS Application Host History Configuration

June 1, 2017June 1, 2017 PCIS Support Team Leave a comment

Event ID 9009 — IIS Application Host History Configuration

Updated: January 20, 2010

Applies To: Windows Server 2008

The ApplicationHost Helper Service (AppHostSvc) maintains a history of Internet Information Services (IIS) configuration by saving the ApplicationHost.config file to separate configuration history subdirectories. If you make a mistake when you modify the ApplicationHost.config file, you can restore an earlier version of the file from a configuration history subdirectory by copying the earlier version into the %Windir%\system32\inetsrv\config directory. You can specify the frequency with which AppHostSvc checks for configuration changes, the path of the directory that contains the subdirectories, and how many subdirectories to keep.

By default, the Application Host Helper Service checks for changes in the ApplicationHost.config file every two minutes. If it detects that the configuration has changed, it creates a backup. The default location for the configuration history files is %SystemDrive%\inetpub\history. AppHostSvc creates one subdirectory under this directory for each configuration file backup. By default, the maximum number of history subdirectories is 10. If the number of configuration history subdirectories reaches the maximum specified, the oldest subdirectory is deleted.

AppHostSvc is a runtime-independent service that does not require the Windows Process Activation Service (WAS) or the World Wide Web Publishing Service (W3SVC) to operate. AppHostSvc does not depend on any other service and its startup type is Automatic. If the ApplicationHost Helper Service is stopped, the configuration history feature will not work.

Event Details

Product:	Internet Information Services
ID:	9009
Source:	Microsoft-Windows-IIS-APPHOSTSVC
Version:	7.0
Symbolic Name:	APPHOSTSVC_HISTORY_CANT_DELETE_DIRECTORY_WARNING
Message:	The Application Host Helper Service encountered an error trying to delete the history directory ‘%1’. The directory will be skipped and ignored. Note that the directory may still get deleted in the future if the service restarts. The data field contains the error number.

Resolve
Stop and restart AppHostSvc

If the Application Host Helper Service (AppHostSvc) cannot delete a history directory, it will try to do so the next time that the service starts. Normally you do not have to take any action when this occurs. However, if the problem persists, you can stop and restart the service manually.

To perform this procedure, you must have membership in Administrators, or you must have been delegated the appropriate authority.

To stop and restart the Application Host Helper Service:

Open an elevated Command Prompt window. Click Start, point to All Programs, click Accessories, right-click Command Prompt, and then click Run as administrator.
At the command prompt, type net stop apphostsvc.
At the command prompt, type net start apphostsvc.

Verify

To verify the configuration of the AppHostSvc configuration history backup feature, you can do the following:

Use notepad to examine the current configHistory section settings in the ApplicationHost.config file.
Use the Appcmd.exe command-line administration utility to view the configHistory section in the ApplicationHost.config file.

To perform these procedures, you must have membership in Administrators, or you must have been delegated the appropriate authority.

View the configHistory section by using notepad

To view the configHistory section by using notepad:

Open an elevated Command Prompt window. Click Start, point to All Programs, click Accessories, right-click Command Prompt, and then click Run as administrator.
Type cd %Windir%\system32\inetsrv\config.
Type notepad ApplicationHost.config.
In notepad, search for the configHistory section under system.applicationHost. The contents should resemble the following:
<system.applicationHost>

<configHistory enabled=”true” path=”%SystemDrive%\inetpub\history” maxHistories=”10″ period=”00:02:00″ />

</system.applicationHost>

View the configHistory section by using Appcmd.exe

To view the configHistory section by using Appcmd.exe:

Open an elevated Command Prompt window. Click Start, point to All Programs, click Accessories, right-click Command Prompt, and then click Run as administrator.
Type cd %Windir%\system32\inetsrv.
Type appcmd list config “Default Web Site” /section:configHistory /config:*. (This example uses the default Web site; replace the site name as necessary.)

The Pickup directory doesn’t have permissions to write the pickup location to registry (%1). Please make sure Network Service has Full Control to the registry location. The error was %2.

January 16, 2017January 16, 2017 PCIS Support Team Leave a comment

Details
Product:	Exchange
Event ID:	9009
Source:	MSExchangeTransport
Version:	8.0
Symbolic Name:	AccessErrorModifyingPickupRegkey
Message:	The Pickup directory doesn’t have permissions to write the pickup location to registry (%1). Please make sure Network Service has Full Control to the registry location. The error was %2.

Explanation
This Error event indicates that the Network Service user account on the Hub Transport server or Edge Transport server does not have the correct registry permissions assigned to it at the location in the registry where the Pickup directory location in stored. By default, the Pickup directory location is stored in the registry at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Exchange\Pickup. By default, the Network Services user account has the Full Control permission assigned to it at this registry location. The Pickup directory location is controlled by the PickupDirectoryPath parameter on the Set-TransportServer cmdlet. By default, the Pickup directory is located at C:\Program Files\Microsoft\Exchange Server\TransportRoles\Pickup. When you modify the location of the Pickup directory by using the PickupDirectoryPath parameter on the Set-TransportServer cmdlet, the change is also made at the specified location in the registry. If you want to change the location of the Pickup directory, you should always use the PickupDirectoryPath parameter on the Set-TransportServer cmdlet.

User Action
To resolve this error, follow these steps: Identify the registry location shown in the event description. Make sure that the Network Services user account has the Full Control permission assigned to it at the specified registry location. If you are not already doing so, consider running the tools that Microsoft Exchange offers to help administrators analyze and troubleshoot their Exchange environment. These tools can help you make sure that your configuration is in line with Microsoft best practices. They can also help you identify and resolve performance issues, improve mail flow, and better manage disaster recovery scenarios. Go to the Toolbox node of the Exchange Management Console to run these tools now. For more information about these tools, see Toolbox in the Exchange Server 2007 Help.

Tag: Event 9009

Event ID 9009 — TCP/IP Network Performance

Related:

Event ID 9009 — IIS Application Host History Configuration

Related:

The Pickup directory doesn’t have permissions to write the pickup location to registry (%1). Please make sure Network Service has Full Control to the registry location. The error was %2.

Related:

Links