Event ID 2012 on Win2K8 guest

[pelletierr]

This summer, we migrated a virtualized file server from Windows 2003 to Windows 2008. The load increased recently on this server, and we are viewing Event IDs 2012 from source SRV in the Event Log.

I tried to look through MS TechNet, Google, here, and I can't find any info on Windows 2008 and Event ID 2012. Anybody knows a way to solve our errors?

Thanks in advance

[vmroyale]

Hello.

Looks like a network error.

Good Luck!

[pelletierr]

I just migrated the VM to an other host, see if it would change something.

I know it can be driver and/or hardware related. We have no other issues with our cluster, so I wouldn't think it's hardware related.

[Troy_Clavell]

check this as well

http://technet.microsoft.com/en-us/library/dd315496%28WS.10%29.aspx

[pelletierr]

It is not coming from PerfOS, but from SRV

[pelletierr]

This issue is still unresolved. We tried to migrate our network card to the VMxNet driver. Different virtualized card, different driver, same problem.

[williamsfudge]

same event here just started happening. Machine was migrated 2k3 to 2k8. I'm running Trend Micro with the Trend Micro network firewall installed. Do you happen to have that also? I'm seeing a few other posts about that.

http://communities.vmware.com/thread/156614;jsessionid=BD903BC2C5315ECE5F0A3696117B19D8

[pelletierr]

We are using McAfee as anti-virus, the firewalling is done via our 6509 firewall module.

[pelletierr]

What we tried recently :

-Turn TSO off on the VMWare Ethernet Adapter

-Update the server to ESX 3.5U5, which includes new tg3 driver turning TSO off for those cards

Right now, the problem still exists but seams to happen less often.

[pelletierr]

Finally, it's as bad as it was

[funkmyer]

anybody with luk on this? still getting this issue after a year!!

"While transmitting or receiving data, the server encountered a network

error. Occassional errors are expected, but large amounts of these indicate

a possible error in your network configuration. The error status code is

contained within the returned data (formatted as Words) and may point you

towards the problem."

[Yps]

I got the same problem on our fileserver, we are running ESX 3.5u4 and Win2008 R2 with Intel E1000 nic.

Have someone solved it ?

Thanks, Magnus

[marktbreaux]

No Luck here. I have tried everything except rebuilding the server. Anyone else figure this out? It caused my users to disconnect from the shares and then it reconnects them which wouldn't be an issue if their programs weren't hosted on this server.

[BrennanB]

We are seeing the same thing on our Win2008 fileserver and we are running 4.0 now and still seeing it. I'll post more specs later today.

Seems to be a widespread issue.

[marktbreaux]

I called Vmware support and they helped me changing some of the settings. My case # was SR# 1513101221. It seems he disabled base filtering engine and IPv6 from the registry. I thought he also changed something on the host machine and then he restarted the host machine and it was fixed.

Hope this helps.

[jjoensson]

First of all. I do also have this issue on a Windows 2008 R2 x64 server running as a vm on my ESX v3.5 cluster.

To start with I had to reboot server every second day or so, because users lost connection to the server. After applying the 2194664 hotfix to the server i only suffer from this problem every 2 or 3 weeks.

It's not very wise to disable the base filtering engine on Windows 2008. Also IPv6 can be disabled by unticking it on the NIC, it should not be disabled in the registry.

Jens

[shanfitz]

According to the MSDN Library, the Base Filtering Engine is what reports the current state of the system, thus possibly the reason the events no longer appear? Notice the link here http://msdn.microsoft.com/en-us/library/aa363967(v=vs.85).aspx

I am having these same issues as everyone else on here....Windows 2008 R2 64-bit VM serving as a File Share server for our company (about 700 users). I am running a vSphere 4.1 cluster, and am running Trend Micro OfficeScan AV. My SAN is an EqualLogic ISCSI SAN.

I would be interested in seeing if someone has come up with a solution for this issue that doesn't involve turning off BFE.

Shannon

[jjoensson]

In the meantime I have found out that the Event ID 2012 is not related to the issue with the server loosing connections. For us it's our Riverbed (WAN optimization) causing the Event ID 2010 errors.

It seems that our problems have been solved regarding the clients loosing connection to the server by disabling everything on the NIC regarding Offload and Receive Side Scaling, and TCP chimney by running the following commands from an elevated commandprompt:

Netsh int tcp set global RSS=Disabled

Netsh int tcp set global chimney=Disabled

Netsh int tcp set global autotuninglevel=Disabled

Netsh int tcp set global congestionprovider=None

Netsh int tcp set global ecncapability=Disabled

Netsh int ip set global taskoffload=disabled

Netsh int tcp set global timestamps=Disabled

Not that I think it a good solution, but hopefully Microsoft will come up with the right solution some day....

Jens