Windows 2008 has event id 2012

leiw324 · ‎09-25-2011

Hello,

Our Windows 2008 R2 SP1 has event id 2012 "srv warning", it casued network drives disconnect or very slow to browse.

I searched this forum http://communities.vmware.com/thread/228971?start=0&tstart=0 has soemone said VMware support SR# 1513101221

can fix this problem, we do not have VMware support, please help !

Thanks !

satanicsurfer · ‎10-03-2011

Hi!

I have the exact same problem here with a Windows 2008 R2 host on ESX 5 build on a HP Proliant ML350 G6.

VMWare support suggested me to change my network adapter from E1000 to VMXNET 3.

Also, someone told me to reserve resource for the system so I reserved 500 Mhz and 256Mb for the system.

The problem was gone for 3 days, but I got a new drop today. However, it's way better than dropping once an hour, but I whish we could find a final solution for that problem.

I'll keep posting in this thread if i have new events to talk about.

Francis

hboogz · ‎10-06-2011

I'm experiencing the same exact event ID on a Windows 2008 R2 File Server. I'm running ESX 4.1 U1 and have tried re-addming the NIC, disabled TCP Chimney and Offloading (using netsh) but to no avail. At random times, the users whose documents are hosted on this server, become unresponsive for a few seconds.

Are there any other suggestions out there I could try? I also switched the network the vNic to it's own physical pNic and I still have the issue.

I'll try the reservation but real curious to see if there are any other options out there.

satanicsurfer · ‎10-06-2011

Maybe you all red a forum where someone told he spoke with VMWare support and they told him to disable the Base Filtering Engine and IPV6 through the registry.

I tried that. Disable the Base Filtering Engine service and I unchecked the IPV6 option in the TCP/IP properties of the NIC.

I didn't pay attention to the "through the registry" part. Yesterday, I decided to check if the registry was showing the disabled setting for IPV6.

They value to change is there: [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters]

The DWORD entry "DisabledComponents" was not there so I created it and set the value to 0xFFFFFFFF.

I don't know how, but that may makes a difference.

Let's wait and see if I'll have the network cutoff today or not. I'll keep you informed of how it's going.

RParker · ‎10-06-2011

WIlson Kwok wrote:
I searched this forum http://communities.vmware.com/thread/228971?start=0&tstart=0 has soemone said VMware support SR# 1513101221
can fix this problem, we do not have VMware support, please help !
Thanks !

Well this should be obvious but this is a WINDOWS machine, therefore a Microsoft problem, NOT VM Ware, so you will get better support if you search and post on the Microsoft forums. It doesn't matter if you host this on VM Ware or not, it is still 100% a Windows related issue.

satanicsurfer · ‎10-06-2011

You're probably right Parker. I will take a look in that way.

I can't even remember when and why I began to think it was VMWare related.

Maybe because it's a common point between people who are experiencing the problem. The strongest point is that we are all running 2K8 also!

Thank's Parker for the cue. Sometimes we are diving so deep into a problem and potential solutions that we loose the focus on what's really hapenning.

satanicsurfer · ‎10-06-2011

Just wanted to let you know that the registry edit didn't fix the problem either...

hboogz · ‎10-06-2011

In my case, since we also have physical file servers which don't experience this problem, it's hard to single this out as purely a WINDOWS problem. There could be an issue with the driver specicially delivered to R2. It very well could be a windows specific problem, but considering other people running VMware have had this issue, it would suggest that all avenues should be explored for a possible resolution.

leiw324 · ‎10-09-2011

Hello,

Is this issue can't fix by VMware or Microsoft ? I have another Windows 2003 R2 VM with no problem, I think this issue by Windows 2008 R2 only.

Thanks !

hboogz · ‎10-09-2011

^ I understand your response and may be a workable solution in some environments. But, that's not going to work for me and reverting back to 2003 isn't something I feel should be necessary in order to get something to work the way it should. Not to mention, the countless amount of features you lose when you rollback the OS.

I wonder if anyone out there knows of an updated driver for the VNEXT3 NIC? I'm running vSphere 4.1 with U1, so the possibility of an updated driver might be circulating around VMware.

satanicsurfer · ‎10-17-2011

I recently tried to disable SMB2 from the registry, but the problem came back after 3 days.

Windows 7 and Vista users were not affected this time. Only XP users.

I'm still searching what's the cause...

RParker · ‎10-17-2011

satanicsurfer wrote:
You're probably right Parker. I will take a look in that way.
I can't even remember when and why I began to think it was VMWare related.
Maybe because it's a common point between people who are experiencing the problem. The strongest point is that we are all running 2K8 also!
Thank's Parker for the cue. Sometimes we are diving so deep into a problem and potential solutions that we loose the focus on what's really hapenning.

Hate to beat a dead horse, but this problem is identified on MS site..

http://technet.microsoft.com/en-us/library/dd315496(WS.10).aspx

So that means MS is aware this is an issue.. It may be exposed by VM Ware, but the problem lies in the OS itself.

RParker · ‎10-17-2011

satanicsurfer wrote:
I recently tried to disable SMB2 from the registry, but the problem came back after 3 days.
Windows 7 and Vista users were not affected this time. Only XP users.
I'm still searching what's the cause...

http://social.technet.microsoft.com/Forums/en/winserverfiles/thread/879f21f6-27a6-4be2-9120-a2dac925...

Narrrowed to 1 or all 3 culprits..

IPv6 (disable it)

base filtering engine (disable that)

OR

Anti-virus (can't disable it, but you should be able to diagnose it).

I also see MORE physical systems than virtual ones PROVING it's a Windows error not a VM problem..

RParker · ‎10-17-2011

satanicsurfer wrote:
I recently tried to disable SMB2 from the registry, but the problem came back after 3 days.
Windows 7 and Vista users were not affected this time. Only XP users.
I'm still searching what's the cause...

Try running this command:

just perform the following steps:

Disable RSS

Open an elevated command prompt (Run As Administrator)

Enter the following command: netsh int tcp set global rss=disabled

Hit Enter.

You will receive the simple response of Ok.

http://www.thehtpc.net/htpc-tips-and-tweaks/windows-2008-server-and-event-id-2012-warnings/

hboogz · ‎10-17-2011

I'm the actual author of that technet discussion RParker. I'm still experiencing the issue no matter what I tried. I have Vmware helping me and awaiting back from them, they have been nothing short of great so far.

I really don't know or where to find documentation on how to disable base filtering? Do you or anyone have instruction on how to do that? I've disabled IPv6, disabled SMB 2.0 and turned off real-time scanning from A/V. I'll uninstall the AV engine tonight, but doubt that's causing my issue.

hboogz · ‎10-17-2011

To be specific, I've ran the following commands and I'm STILL getting 2012 errors in sucession.

Netsh int tcp set global RSS=Disabled

Netsh int tcp set global chimney=Disabled

Netsh int tcp set global autotuninglevel=Disabled

Netsh int tcp set global congestionprovider=None

Netsh int tcp set global ecncapability=Disabled

Netsh int ip set global taskoffload=disabled

Netsh int tcp set global timestamps=Disabled

DoDo201110141 · ‎10-24-2011

I've got this problem too.

Dell T610, ESXi 4.1, E1000, 2008 R2 SP0

I have not tried any network tweaks, but I shouldn't need to!

Issue began occuring in Janurary 2011.

No idea if it's VMWare specific, I don't have any identical physical machines on the same network.

Can anyone out there pinpoint the issue?

My client software is firebird-based, and is not very tolerant of connection drop outs!

Michael.

hboogz · ‎11-03-2011

All -

I found the problem and resolution! I'm no longer receiving event ID 2012. My VM acting as a windows 2008 R2 file server was sitting in a VLAN that's different than the connecting client network.Traffic was traversing a firewall to get across. Once i confirmed that Microsoft's weak SMB protocol just doesn't work well over NAT'd connections or between firewalls, I changed the server's IP and VLAN to the same of the Clients, and voila, errors gone.

Hope this could help others out there who are struggling with this issue.

satanicsurfer · ‎11-23-2011

I was happy to heard you've solved your problem hboogz.

For me, that was not the same solution, but I don't have the problem anymore.

I don't explain why, but I added a secondary DNS server since my DC was the only DNS server on my network and rebooting the DC while looking for a solution was causing problem for some users using Outlook on Exchange looking for the Exchange server.

Since, I don't have the problem anymore. I guess it was a DNS issue, but I can't explain how just having a secondary DNS solved the problem.