An existing connection was forcibly closed by the remote host


  • all of a sudden on 11/17 around 10pm, all of our existing fcs clients began reporting the following error in their application event log:

    Event Type: Error
    Event Source: Microsoft Operations Manager
    Event Category: None
    Event ID: 21293
    Description: The agent was unable to send data to the MOM Server at FCS. The error code is 10054. An existing connection was forcibly closed by the remote host.

    i've already tried increasing the connection time-out value on the fcs server running mom 2005 sp1:

    reg add "HKLM\SOFTWARE\Mission Critical Software\OnePoint\Configurations\ForefrontClientSecurity\Operations\Consolidator" /v "ServerIOTimeoutMS" /t REG_DWORD /d 0x1d4c0 /f

    on 11/18, i also upgraded the nic drivers and disabled the tcp chimney offload feature:

    netsh int ip set chimney disabled

    unfortunately, all the fcs clients continue to repeatedly record (a few times every minute) the event id 21293 error.

    2009년 12월 3일 목요일 오후 4:45

모든 응답

  • Hi,


    Thank you for the post.


    As far as I know, there are two possible solutions to this error.


    1.Try the most common solution first which is to install the latest MOM 2005 Service Pack:


    2.If the application of the SP fails to resolve, which is rare, perform the next solution:
    1) Modify the packet send size within the MOM Admin Console / Global Settings:
    Admin Console | Administration | Global Settings | AGENTS | Communications <tab> | ~ Set the communication packet size to 50 KB ~
    2) Download the latest Resource Kit for MOM 2K5:
    3) Use the MOM Information Utility from the Resource Kit, you can use the MOM Information Utility to clear the queues on an agent.
    4) Run the following command, MOMInfo.exe /clearqueue



    2009년 12월 4일 금요일 오전 3:28
  • ugh... tried sp1, no change. verified packet size = 50 kb. tried clearing agent queues, no change. i'm now looking into database growth as possible cause.
    2009년 12월 15일 화요일 오후 7:52
  • ok, so if i enable autogrowth on db files, the agent errors quit. i don't believe this is best practice, so how do i purge old data from the big db files (repdata & eeadata)?
    2009년 12월 15일 화요일 오후 7:58
  • hey nick, i'm still having trouble, so that's why i unmarked your post as the answer... sorry. nothing i do seems to make these errors go away... i've bumped the timeout value to 5 minutes, and still they persist.
    2009년 12월 28일 월요일 오후 7:55
  • ok, so found clive's blog posting http://blogs.technet.com/cliveeastwood/archive/2006/06/27/439109.aspx that indicates we could set a max of 30 minutes for the timeout. tried that on the fcs server (running mom 2005 sp1), but the 21293 errors continue to be recorded a few times each minute in the application event log on all fcs clients. there must be some broken mom rule that has gotten hung up on all the clients... is there some diagnostic utility such as mominfo.exe that we could use to see what's happening?
    2009년 12월 30일 수요일 오후 4:47
  • Hi,


    Unfortunately, due to the complexity of this issue we are unable to effectively assist with this request in the forum.


    I would like to suggest that you contact Microsoft Product Support Services via telephone so that a dedicated Support Professional can assist with this request.


    To obtain the phone numbers for specific technology request please take a look at the web site listed below.




    If you are outside the US please see http://support.microsoft.com for regional support phone numbers.


    Thank you for your patience and understanding.



    Nick Gu - MSFT
    2010년 1월 6일 수요일 오전 8:30
  • Hi csp122

    Did you ever get to the bottom of your issue? I've had the exact same thing start a few days ago.
    2010년 3월 16일 화요일 오전 10:36
  • Check your db sizes if they are full and your DTS job in task scheduler has been failing then you need to work on that.  Typically this is because you need to size your db's appropriately for your environment.

    CSS Security Support Engineer (FCS/MBSA/WUA/Incident Response) Check out my blog http://blogs.technet.com/kfalde
    2010년 3월 16일 화요일 오후 5:27