System Event Log error messages regarding Windows SharePoint Services 3
-
Thursday, June 14, 2012 8:06 PM
I am getting dozens of these error messages within an hour, I clear the log, and getting dozens more within an hour again.
All of this since I did an extensive Microsoft server update Tuesday.
Error 6/14/2012 4:02:11 PM Windows SharePoint Services 3 5586 Database
Unknown SQL Exception 2 occured. Additional error information from SQL Server is included below.
A network-related or instance-specific error occurred while establishing a connection to SQL Server. The server was not found or was not accessible. Verify that the instance name is correct and that SQL Server is configured to allow remote connections. (provider: Named Pipes Provider, error: 40 - Could not open a connection to SQL Server)
Any thoughts or possible solutions?
thanks.....
All Replies
-
Thursday, June 14, 2012 8:45 PM
Is the Windows Internal Database service started in the Services Console.
-
Thursday, June 14, 2012 8:48 PM
I am not a network guy by any means......so....how do I tell?
thanks
-
Thursday, June 14, 2012 8:57 PM
You can go to the Services Console, by
Click on Start => Click on run => Type Services.msc
and check for Windows Internal Database Service.
If it is not started, you can start that manually and then check if you still get the errors.
-
Thursday, June 14, 2012 8:58 PMI will try that right now.....
-
Thursday, June 14, 2012 9:03 PM
ok....looking at services, and I do not see "Internal Database" or "Windows Internal Database" even listed.....
what next?
btw....thank you so far....
-
Thursday, June 14, 2012 9:06 PM
Wanted to confirm if it was a SBS2008 Server as we have errors for Sharpeoint Services 3.0.
-
Thursday, June 14, 2012 9:08 PM
why....yes it is.
I've seen other SEL errors with SBS 2008 on the forum as well...
-
Thursday, June 14, 2012 9:23 PM
If we do not have Windows Internal Database Service then your Windows Update Services would also be busted as Sharepoint and WSUS require the Windows Internal Database Service.
You may try to install the Windows Internal Database from the ServerManager Console.
By Clicking Start => Administrative Tools => ServerManager.
=> Click on Features => Right Click on it and say Add Feature.
=> Check if Windows Internal Database say (installed) if not check the box and click on Next and it would install it.
=> But still you might face some underlying issues.
=> This is a bit unusual behaviour if Windows Internal Database is not present, as it is a part of the Server Installation.
=> Let us know with the update of the above outcome.
-
Thursday, June 14, 2012 9:34 PM
Windows Internal Database was available, not checked in the box, so I am assuming not installed.
I checked the box, and got another dialogue box saying it cannot be installed by itself, and needs some other services as well.
I went ahead and clicked install and is installing as I type.
The hourglass is rotating slowly, so it looks like it will take awhile....
-
Thursday, June 14, 2012 9:36 PM
ok...installation is now complete.
as soon as installation was complete, I got a Windows notice of updates for the following:
""Windows Internal Database Service Pack 4 for x64 Edition (KB2463332)
Download size: 42.4 MB
You may need to restart your computer for this update to take effect.
Update type: Important
Windows Internal Database Service Pack 4 (KB2463332) upgrades the Windows Internal Database (WYukon) used by Windows components namely Windows SharePoint Services, Windows Server Update Services, Active Directory Rights Management Services, Windows System Resource Manager and UDDI Services. After you install this item, you may have to restart your computer.
More information:
http://support.microsoft.com/kb/2463332Help and Support:
http://support.microsoft.com ""am downloading updates now....
-
Thursday, June 14, 2012 10:10 PM
Once you complete the installation of the updates, you can reboot the box and then check if you still receive the Sharepoint errors.
-
Friday, June 15, 2012 1:23 PM
Masked Man.......I had already left by the time you responded.
I will shut the server off and reboot at the end of business today and see if it works.
I will let you know Monday if it worked....
thanks for your help so far...
-
Monday, June 18, 2012 7:26 PM
Hello and help !
In just one hour this afternoon, I got 153 Application event logs; 4,055 Security event logs; and 51 System event logs.
All of this started after Microsoft download updates last Tuesday.
The Application event logs include the following 3 errors:
SQL database login failed. Additional error information from SQL Server is included below.
Login failed for user 'NT AUTHORITY\NETWORK SERVICE'.
And………………
The description for Event ID 18456 from source MSSQL$MICROSOFT##SSEE cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.
If the event originated on another computer, the display information had to be saved with the event.
The following information was included with the event:
NT AUTHORITY\NETWORK SERVICE
[CLIENT: <named pipe>]
The specified resource type cannot be found in the image file.
And………………
Process MAD.EXE (PID=3176). Exchange Active Directory Provider has discovered the following servers with the following characteristics:
(Server name | Roles | Enabled | Reachability | Synchronized | GC capable | PDC | SACL right | Critical Data | Netlogon | OS Version)
In-site:
MTC-01.mtc.local CDG 1 7 7 1 0 1 1 7 1
Out-of-site:
The Security event logs consist of the following:
An account was logged off.
Subject:
Security ID: MTC\MTC-PC08-ASHLEY$
Account Name: MTC-PC08-ASHLEY$
Account Domain: MTC
Logon ID: 0x1e711788
Logon Type: 3
This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
And………………
New Logon:
Security ID: MTC\MTC-PC08-ASHLEY$
Account Name: MTC-PC08-ASHLEY$
Account Domain: MTC
Logon ID: 0x1e712334
Logon GUID: {46504bc0-3d6c-153a-53a8-6b0571647ed8}
Process Information:
Process ID: 0x0
Process Name: -
Network Information:
Workstation Name:
Source Network Address: 192.168.1.11
Source Port: 55423
Detailed Authentication Information:
Logon Process: Kerberos
Authentication Package: Kerberos
Transited Services: -
Package Name (NTLM only): -
Key Length: 0
This event is generated when a logon session is created. It is generated on the computer that was accessed.
The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.
The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).
The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.
The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.
The authentication information fields provide detailed information about this specific logon request.
- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
- Transited services indicate which intermediate services have participated in this logon request.
- Package name indicates which sub-protocol was used among the NTLM protocols.
- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
And………………
A Kerberos service ticket was requested.
Account Information:
Account Name: MTC-PC08-ASHLEY$@MTC.LOCAL
Account Domain: MTC.LOCAL
Logon GUID: {0467faa4-69ad-48f9-8b7b-705eae69a7c1}
Service Information:
Service Name: MTC-01$
Service ID: MTC\MTC-01$
Network Information:
Client Address: ::ffff:192.168.1.11
Client Port: 55420
Additional Information:
Ticket Options: 0x40810000
Ticket Encryption Type: 0x12
Failure Code: 0x0
Transited Services: -
This event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.
This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.
Ticket options, encryption types, and failure codes are defined in RFC 4120.
And………………
Special privileges assigned to new logon.
Subject:
Security ID: SYSTEM
Account Name: MTC-01$
Account Domain: MTC
Logon ID: 0x1e70eecd
Privileges: SeSecurityPrivilege
SeBackupPrivilege
SeRestorePrivilege
SeTakeOwnershipPrivilege
SeDebugPrivilege
SeSystemEnvironmentPrivilege
SeLoadDriverPrivilege
SeImpersonatePrivilege
SeEnableDelegationPrivilege
And the System event log errors consist of the following:
The Volume Shadow Copy service entered the running state.
And………………..
The Volume Shadow Copy service entered the stopped state.
And………………
The time service detected a time difference of greater than 5000 milliseconds for 900 seconds. The time difference might be caused by synchronization with low-accuracy time sources or by suboptimal network conditions. The time service is no longer synchronized and cannot provide the time to other clients or update the system clock. When a valid time stamp is received from a time service provider, the time service will correct itself.
And……………….
DCOM was unable to communicate with the computer Warehouse2.mtc.local using any of the configured protocols.
And……………..
The Kerberos client received a KRB_AP_ERR_MODIFIED error from the server MTC-PC11$. The target name used was RPCSS/Warehouse2.mtc.local. This indicates that the target server failed to decrypt the ticket provided by the client. This can occur when the target server principal name (SPN) is registered on an account other than the account the target service is using. Please ensure that the target SPN is registered on, and only registered on, the account used by the server. This error can also happen when the target service is using a different password for the target service account than what the Kerberos Key Distribution Center (KDC) has for the target service account. Please ensure that the service on the server and the KDC are both updated to use the current password. If the server name is not fully qualified, and the target domain (MTC.LOCAL) is different from the client domain (MTC.LOCAL), check if there are identically named server accounts in these two domains, or use the fully-qualified name to identify the server.
All of this corresponds to the download of over a dozen Microsoft updates last week..
Help !!!!
-
Monday, June 18, 2012 9:15 PMModeratorOn the server go to http://companywebDoes it work?==============What exactly did you install? What patches?=============I seriously doubt that all of this corresponds to the downloads ofupdates because most of those events are normal.Warehouse2.mtc.local << is that computer online?
-
Monday, June 18, 2012 9:27 PM
Hi Susan,
First, I tried to go to the website http://companyweb while logged into the server, from Internet Explorere, and I got the message "Cannot connect to the configuration database".
Second, if you would like, I can retrieve, and list for you, the updates that I installed last Tuesday and Wednesday.
Third, I got an error on the LCD display showing the SEL log was full.....had never seen that error before. Logical (or illogicial) conclusion was to associate this situation with the most recent downloads.
Fourth, the Warehouse@.mtc.local is a workstation located in our warehouse to log-in received materials.
thank you for responding and look forward to an effective resolution.
btw.....I am putting together the list of downloads and will supply that in the next post......
-
Monday, June 18, 2012 9:31 PMModerator
SEL is hardware not software, you are jumping to a lot of conclusions.
So step one, give me a list of the updates you installed last week.
-
Monday, June 18, 2012 9:34 PM
June 14 kb2463332
June 13 kb2699988, 2656368, 2677070, 890830, 2686827, 2686833, 2709162, 2656374, 2685939.
June 12 kb2720211
June 05 Windows Update Agent, 7.6.7600.256
Here is the list of the most recent updates.
thanks....
-
Monday, June 18, 2012 9:43 PM
Susan,
I am in EST zone, and the business shuts down at 6pm (20 mins).
Are you available, and can we continue, tomorrow?
I greatly appreciate it if you can.
thanks.......
-
Monday, June 18, 2012 9:44 PMModerator
Here's what I want you to do.
This is not something easily fixed over an email/forum with me trying to second guess what's going on that server. I'm guessing that the real cause of issues is that KB2720211 (aka WSUS update) freaked out and didn't complete which in turn impacts SharePoint. Windows Internal database should have been installed on this SBS 2008 from the get go. Because I don't know what condition this box is now with it reinstalled, I'm guessing that KB2720211 did you in, I'm going to strongly recommend that you call 1-800-Microsoft and tell them that security patch 2720211 messed up your server and that you want a free support call.
If you have any issues setting up a case, let me know.
Bottom line this is too nasty and too unknown to be doing this in a forum.
-
Monday, June 18, 2012 9:49 PM
Susan,
Thank you so much for the direction. This is way beyond my capabilities, and I greatly appreciate your expert advice.
I will call Microsoft tomorrow.
I will let you know how it turns out.......
thank you again.....
-
Tuesday, June 19, 2012 1:07 PM
Good morning Susan,
Just a quick question......what would happen if KB2720211 was uninstalled?
Would that fix the situation, or make it worse?
May be a dumb question, but generally, the only dumb questions are those that are not asked.
thanks again for sharing your wisdom.......:)
-
Tuesday, June 19, 2012 1:56 PMModerator
Given that you had to manual install the windows internal database, it appears that 2720211 mangled more than what an uninstall can fix.
A restore would be a better option.
Besides you need to get 2720211 on your box.
-
Tuesday, June 19, 2012 2:32 PM
btw......I did get ahold of MS this morning and have a case established.
The agent also said that since this is the result of an update, it will be at no charge.
thanks again....
-
Tuesday, June 19, 2012 2:36 PMSo did you finally opened up a incident with microsoft ?
-
Wednesday, June 20, 2012 4:49 AMModeratorHow's it going?
-
Wednesday, June 20, 2012 3:48 PM
Yes. Had a MS engineer on the phone for close to 4 hours yesterday, reprogramming lines and re-establishing connections to databases and internal websites. These all got messed-up with the update from last week.
Seems to be working for now.....constantly monitoring the server.
-
Wednesday, June 20, 2012 3:59 PM
Hi Susan,
Had a MS engineer on the phone for close to 4 hours yesterday, reprogramming lines and re-establishing connections to databases and internal websites. You were correct in that these all got messed-up with the update from last week, as you suspected.
In the Event Log viewer, still get a lot of events, but not as many as before, and only a handfull of "errors" as well.
Seems to be working for now.....I am constantly monitoring the server.
Thank you again for your assistance and direction.
If I have issues in the future, I know who to reach out to.
- Marked As Answer by Sean Zhu -Moderator Thursday, June 21, 2012 7:51 AM
.png)
