none
Event ID 2012 srv

    Question

  • I'm running a Windows 2008 r2 x64 File server. Daily, i get a sucession of event id 2012 error messages which coincide with users calling and indicating they temporariliry lost access to the server or the document they are working on. I've disabled all advanced networking options using netsh (Chimney, Oflloading, etc) I've disabled IPv6 using Microsoft's own 'FixIt' solution, which i think disabled the stack. I've also, changed NIC's and updated drivers. I'm at wits end and really don't know what else I could possibly try and rid myself of this lingering issue?

     

    Any thoughts/suggestions/recommendations would be greatly appreciated.

     

    Regards,

    Phipps-IT

     

    PS. This is the entire event log entry registered.

    Log Name:      System

    Source:        srv

    Date:          10/7/2011 3:43:46 PM

    Event ID:      2012

    Task Category: None

    Level:         Warning

    Keywords:      Classic

    User:          N/A

    Computer:      PHVMDFS3.mydomain.org

    Description:

    While transmitting or receiving data, the server encountered a network error. Occassional errors are expected, but large amounts of these indicate a possible error in your network configuration.  The error status code is contained within the returned data (formatted as Words) and may point you towards the problem.

    Event Xml:

    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

      <System>

        <Provider Name="srv" />

        <EventID Qualifiers="32768">2012</EventID>

        <Level>3</Level>

        <Task>0</Task>

        <Keywords>0x80000000000000</Keywords>

        <TimeCreated SystemTime="2011-10-07T19:43:46.291340300Z" />

        <EventRecordID>10210</EventRecordID>

        <Channel>System</Channel>

        <Computer>PHVMDFS3.mydomain.org</Computer>

        <Security />

      </System>

      <EventData>

        <Data>\Device\LanmanServer</Data>

        <Binary>0000040001002C0000000000DC07008000000000840100C0000000000000000000000000000000008F050000</Binary>

      </EventData>

    </Event>

    Friday, October 07, 2011 7:51 PM

Answers

  • All -

     

     

    I found the problem and resolution! I'm no longer receiving event ID 2012. My VM acting as a windows 2008 R2 file server was sitting in a VLAN that's different than the connecting client network.Traffic was traversing a firewall to get across. Once i confirmed that Microsoft's SMB  protocol just doesn't work well over NAT'd connections or between firewalls, I changed the server's IP and VLAN to the same of the Clients, and voila, errors gone.

     

    Hope this could help others out there who are struggling with this issue.

    • Marked as answer by Phipps-MIS Thursday, November 03, 2011 2:21 PM
    Thursday, November 03, 2011 2:21 PM

All replies

  • Hello,

    Error 2012 in the Event Viewer, in general, indicated there is a connectivity problem. It is advised to go through the normal connectivity troubleshooting steps:

    1. If the client is receiving one of the above error messages, a quick test to rule out something on the client side causing the problem would be to pause the NetLogon service on a domain controller with the 2012 errors. If the client is able to log on to another domain controller successfully, then the problem has been isolated to the server.
    2. Check for the IPX protocol and the Btrieve applications on the server. For additional information, see the following article or articles in the Microsoft Knowledge Base:
      195641 (http://support.microsoft.com/kb/195641/EN-US/ ) Btrieve, IPX, and Event ID 2012
    3. Replace the network interface card (NIC) on the server with the Event ID 2012 errors. The faulty NIC may be any variety of Token Ring or Ethernet.
    4. Review the Windows NT Hardware Compatibility List (HCL) to ensure that the NIC in the computer is on the HCL. If the card is not on the HCL, replace it with an HCL-compatible NIC.
    5. Another known cause of connectivity problems is that the NIC driver may be outdated. Obtaining an updated driver from the manufacturer may resolve the issue.
    6. The problem has also been seen with network switch problems that may be preventing the connectivity on an intermittent basis. Resetting the network switch may resolve the issue. Contact the switch manufacturer for detailed information on resetting your network switch.
    For additional information, see the following article or articles in the Microsoft Knowledge Base:
    195641 (http://support.microsoft.com/kb/195641/EN-US/ ) Btrieve, IPX, and Event ID 2012
    125218 (http://support.microsoft.com/kb/125218/EN-US/ ) Madge Smart 16/4 AT Plus Ringnode Token Ring Adapter Fails

    Thanks and Regards
    Scorpio_Milo
    View my MCP Certifications
    HP Enterprise Service: Solution Architect
    Microsoft Storage Team - File Cabinet Blog
    My Blog
    Contact me
    Saturday, October 08, 2011 3:37 AM
  • Thanks for the reply Scorpio, however I'm not sure your suggestions are relavant to my platform, specifically the OS.

    1. This isn't a client machine, it's a File server. I suppose i can stop netlogon on this server, but don't see how that applies to this issue specifically.
    2. This is a Windows 2008 R2  server and I would imagine and hope that Windows no longer installs or supports IPX. I looked into that support document and it doesn't apply to Windows 2008 R2. Are you suggesting that this article is applicable to Windows 2008 R2?
    3. I see you reference Token Ring, which is nostalgic to say the least. But, I've changed the NIC card and updated drivers on several occastions. I also have other Windows 2008 R2 servers with the same NIC who are NOT experiencing this issue.
    4. The computer and all related hardware is most certainly on the HCL for Windows 2008 R2.
    5. As mentioned, the driver has been updated on several occasions.
    6. I've changed the port on the switch to 3 different switches and have tried 4 different ports and the issue still persists. Considering I have close to 100 servers and I don't have this problem on any other server, it would suggest something isn't quite right on this box.

    Again, Thank for your reply but it would appear your response needs some updating to account for Windows 2008.

    Any other suggestions would be greatly appreciated.

     

    Sunday, October 09, 2011 2:45 PM
  • The more i research the more this issue seems to point to the IPv6 and/or the Base Filtering Engine inherent in Windows 2008 R2. This is the EXACT same issue I'm having.

    http://forum.sysinternals.com/Event-id-2012-error-transmititing-and-recieving_topic19973_page6.html

    I've tried everything suggested but am still getting hammered with 2012 errors. 

     

     

    Thursday, October 13, 2011 2:36 PM
  • I've ran the following commands and am still receiving 2012 errors.

     

    Netsh int tcp set global RSS=Disabled
    Netsh int tcp set global chimney=Disabled
    Netsh int tcp set global autotuninglevel=Disabled
    Netsh int tcp set global congestionprovider=None
    Netsh int tcp set global ecncapability=Disabled
    Netsh int ip set global taskoffload=disabled
    Netsh int tcp set global timestamps=Disabled
    


    I've disabled the offload options from within the NIC's advanced settings page and still nothing.

     

    Monday, October 17, 2011 8:50 PM
  • Any suggestions? I'm trying to avoid  building a new machine and move the files, since this is a file server. That still doesn't guarantee this message won't pop up again either.
    Wednesday, October 19, 2011 1:50 PM
  • All -

     

     

    I found the problem and resolution! I'm no longer receiving event ID 2012. My VM acting as a windows 2008 R2 file server was sitting in a VLAN that's different than the connecting client network.Traffic was traversing a firewall to get across. Once i confirmed that Microsoft's SMB  protocol just doesn't work well over NAT'd connections or between firewalls, I changed the server's IP and VLAN to the same of the Clients, and voila, errors gone.

     

    Hope this could help others out there who are struggling with this issue.

    • Marked as answer by Phipps-MIS Thursday, November 03, 2011 2:21 PM
    Thursday, November 03, 2011 2:21 PM