N
news.microsoft.com
Guest
Hi all,
I have a seemingly untraceable issue on a Windows 2003 server -- every few
seconds, an entry is being written into the system event log that reads:
Source: Srv
Event ID: 2000
Category: None
Description: The server's call to a system service failed unexpectedly
Data:
0000: 00040000 00540001 00000000 c00007d0
0010: 00000000 c000010a 00000000 00000000
0020: 00000000 00000000 00bd0334
My event log only goes back to the start of today, but there's 87000 entries
exactly like this. So it's becoming rather a nuisance. Now I've done a lot
of googling on this, but it seems to be unresolved; EventID.net doesn't list
it in it's summary[1] and comments. However I've got a bit further with
other searches. The key error code apparently is c000010a, which maps to
some STATUS_ code. According to a number of places, this is
STATUS_PROCESS_IS_TERMINATING, which doesn't help me too much, apart from
give a number a name.
Unfortunatly, this has led me to a dead-end. Various suggestions I've seen
include DNS Server (server doesn't have the DNS server service installed),
NAS storage (none attached), anti-virus (all disabled and we're still
getting errors). So it's a loss.
What I'm looking for is a way to trace the process that's raising this and
work from there. However I've not found the right incantation for google (if
there is one) to find a way to trap writes to the event log so I can map an
entry back to a running executable. Is anyone aware of a way this could be
performed? I suspect process monitor could do it, but that's not working on
this server (no matter what I do to the filters, it doesn't capture any
events: display stays resolutely blank).
Any other suggestions for a line of enquiry also welcome.
Cheers,
Chris
[1]
http://www.eventid.net/display.asp?eventid=2000&eventno=1067&source=Srv&phase=1
I have a seemingly untraceable issue on a Windows 2003 server -- every few
seconds, an entry is being written into the system event log that reads:
Source: Srv
Event ID: 2000
Category: None
Description: The server's call to a system service failed unexpectedly
Data:
0000: 00040000 00540001 00000000 c00007d0
0010: 00000000 c000010a 00000000 00000000
0020: 00000000 00000000 00bd0334
My event log only goes back to the start of today, but there's 87000 entries
exactly like this. So it's becoming rather a nuisance. Now I've done a lot
of googling on this, but it seems to be unresolved; EventID.net doesn't list
it in it's summary[1] and comments. However I've got a bit further with
other searches. The key error code apparently is c000010a, which maps to
some STATUS_ code. According to a number of places, this is
STATUS_PROCESS_IS_TERMINATING, which doesn't help me too much, apart from
give a number a name.
Unfortunatly, this has led me to a dead-end. Various suggestions I've seen
include DNS Server (server doesn't have the DNS server service installed),
NAS storage (none attached), anti-virus (all disabled and we're still
getting errors). So it's a loss.
What I'm looking for is a way to trace the process that's raising this and
work from there. However I've not found the right incantation for google (if
there is one) to find a way to trap writes to the event log so I can map an
entry back to a running executable. Is anyone aware of a way this could be
performed? I suspect process monitor could do it, but that's not working on
this server (no matter what I do to the filters, it doesn't capture any
events: display stays resolutely blank).
Any other suggestions for a line of enquiry also welcome.
Cheers,
Chris
[1]
http://www.eventid.net/display.asp?eventid=2000&eventno=1067&source=Srv&phase=1