none
Installation Clean-up

    Question

  • After several months of working on a functional SharePoint 2010 installation, I have a few Event Items that I cannot get cleaned up and hope someone can help.  The environment is a WFE/Application server running Windows 2008 R2 and a SQL Server running SQL 2008 R2 on a Windows 2008 R2 server.

    The first Event ID is 7939 Critical.  I made a post about this 6 months ago with no responses so I am reposting it here:

    - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    - <System>
    <Provider Name="Microsoft-SharePoint Products-Document Management Server" Guid="{F78D66EC-09A9-42A2-AC7A-5EE2062DE7E4}" />
    <EventID>7939</EventID>
    <Version>14</Version>
    <Level>1</Level>
    <Task>8</Task>
    <Opcode>0</Opcode>
    <Keywords>0x4000000000000000</Keywords>
    <TimeCreated SystemTime="2012-03-21T21:37:16.160000000Z" />
    <EventRecordID>39979</EventRecordID>
    <Correlation />
    <Execution ProcessID="1632" ThreadID="2360" />
    <Channel>Application</Channel>
    <Computer>Server.Domain.com</Computer>
    <Security UserID="S-1-5-21-1757981266-1303643608-682003330-3803" />
    </System>
    - <EventData>
    <Data Name="string0">Failed to create the protected output directory</Data>
    </EventData>
    </Event>

    The next one is a Warning, Event ID 4356 Firing Agent:

    - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    - <System>
    <Provider Name="Microsoft-Windows-EventSystem" Guid="{899daace-4868-4295-afcd-9eb8fb497561}" EventSourceName="EventSystem" />
    <EventID Qualifiers="32768">4356</EventID>
    <Version>0</Version>
    <Level>3</Level>
    <Task>18</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2012-03-21T21:36:04.000000000Z" />
    <EventRecordID>39959</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>Server.Domain.com</Computer>
    <Security />
    </System>
    - <EventData>
    <Data Name="param1">80040154</Data>
    <Data Name="param2">{1CCB96F4-B8AD-4B43-9688-B273F58E0910}</Data>
    <Data Name="param3">StandardCreateInstance</Data>
    </EventData>
    </Event>

    This ID "1CCB96F4-B8AD-4B43-9688-B273F58E0910"  does not exist in the Component Services COM+ as instructed by various sites.

    The next one is another Warning, Event ID 14 Gatherer.  This has to do with the 3 sites that I have in SharePoint and cannot be crawled.

    - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    - <System>
    <Provider Name="Microsoft-SharePoint Products-SharePoint Server Search" Guid="{C8263AFE-83A5-448C-878C-1E5F5D1C4252}" />
    <EventID>14</EventID>
    <Version>14</Version>
    <Level>3</Level>
    <Task>137</Task>
    <Opcode>0</Opcode>
    <Keywords>0x4000000000000000</Keywords>
    <TimeCreated SystemTime="2012-03-21T21:56:22.178988700Z" />
    <EventRecordID>39995</EventRecordID>
    <Correlation />
    <Execution ProcessID="1088" ThreadID="5060" />
    <Channel>Application</Channel>
    <Computer>Server.Domain.com</Computer>
    <Security UserID="S-1-5-21-1757981266-1303643608-682003330-3901" />
    </System>
    - <EventData>
    <Data Name="string0">http://server:8080</Data>
    <Data Name="string1">Context: Application 'Search_Service_Application', Catalog 'Portal_Content' Details: Access is denied. Verify that either the Default Content Access Account has access to this repository, or add a crawl rule to crawl this repository. If the repository being crawled is a SharePoint repository, verify that the account you are using has "Full Read" permissions on the SharePoint Web Application being crawled. (0x80041205)</Data>
    </EventData>
    </Event>

    The posts that I have read tell to make sure that the search account is in the Web Application with Full Read permissions which it does.  Another post tells to add the DisableLoopback to the Registry, which has been done.  At a loss what else to do.  I have tried deleting and re-creating the Search Service but the same results.

    The servers being crawled are listed as:

    http://server

    http://server:8080

    http://server:8081

    The last one is also a Warning, Event ID 8088 Taxonomy:

    - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    - <System>
    <Provider Name="Microsoft-SharePoint Products-SharePoint Server" Guid="{C33B4F2A-64E9-4B39-BD72-F0C2F27A619A}" />
    <EventID>8088</EventID>
    <Version>14</Version>
    <Level>3</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x4000000000000000</Keywords>
    <TimeCreated SystemTime="2012-03-21T21:39:58.625993300Z" />
    <EventRecordID>39987</EventRecordID>
    <Correlation ActivityID="{756D5435-DE3C-4B79-889A-BEE07D77429D}" />
    <Execution ProcessID="2236" ThreadID="3916" />
    <Channel>Application</Channel>
    <Computer>Server.Domain.com</Computer>
    <Security UserID="S-1-5-21-1757981266-1303643608-682003330-3804" />
    </System>
    - <EventData>
    <Data Name="string0">Managed Metadata Service</Data>
    </EventData>
    </Event>

    The post i read stated to add the service account to the Permissions of the SSA with full control (Local Farm account is already there so I added the SA)

    I would appreciate your feedback to get theses cleaned up.

    Thanks.




    • Edited by Bill Fry Wednesday, March 21, 2012 10:57 PM
    Wednesday, March 21, 2012 10:53 PM

Answers

  • Bill,

    When I do a search with 7939, your first post appears as the first entry as the search engine. Quite possibly there is not too much shared knowledge in the internet and you may be in the best position to find a resolution to this.

    When we get repititive errors in the event log but there is no obvious functional error in the SharePoint application, we may need a lot of troubleshooting time to find out the reason.

    Do you see this error consistently appearing in multiple environments (like DEV, TEST, Staging etc.) or is it isolated in only one environment? If you turn verbose logging on and take a look at the ULS logs, do you see a corresponding error in the ULS log? If so, does it provide any additional information than what you already have from the event log viewer.

    Also does this 7939 error repeats in a certain frequency. Like every 5 minutes or 15 minutes. That may suggest that a timer job is responsible and I will try to find that timer job and dig more about checking the health of that timer job.

    If you are associated with a Microsoft Partner (which seems to be the case), you can also go to the exclusive partner forum (you can find it at partner.microsoft.com) and repost your question there. Usually a Microsoft tech rep picks up your question and works with you. There are usually a certain number of calls MS partners are entitled too. You may take a look at that while you wait on someone to get back in this msdn forum.

    I know this does not help directly resolve your issue, but hopefully from one of these route will provide additional information which will help troubleshoot further.


    Thanks, Soumya | MCITP, SharePoint 2010


    Thursday, March 22, 2012 2:55 AM