none
Windows Server 2003 SP2 -- Event ID: 2000 -- Source: Srv -- The server's call to a system service failed unexpectedly -- c000010a 00bd0334

    Question

  • Hi there

    Yesterday our file server experienced what I believe is called an 'event storm'.

    The following event started to appear in the system log:

    --------------------------------------------------------------------------------------

    Event ID: 2000

    Source: Srv

    Description: The server's call to a system service failed unexpectedly

    Data:    0000: 00040000 00540001 00000000 c00007d0
                0010: 00000000 c000010a 00000000 00000000
                0020: 00000000 00000000 00bd0334
    --------------------------------------------------------------------------------------

    This event appears continually in the system log from mid-afternoon until the server was rebooted at 10pm.

    I have googled this, and haven't come up with anything firm yet. There is a Microsoft Kb article about the error http://support.microsoft.com/kb/288301/en-us but the cause listed in the article is an app (VERITAS Storage Replicator) which is not installed on our file server, so I have had to discount that. We do have Veritas Backup Exec 10.0, but the file listed in the Kb article isn't present on the server.

    Interestingly, this event storm appears to have over-loaded the local SCE service, which was gobbling up most of the CPU, no doubt by struggling to keep up with the alerts, which were running up to fifty times per second at times. The SCE service was disabled when the server came back up, though I am fairly certain the SCE service did not cause the fault, but was instead affected by it.

    There is a DAS attached to the server, a Dell PV220, which is reporting no errors.

    I know other people have experienced this issue, but I cannot find a definitive cause.

    If anyone has gotten to the bottom of this faukt, I'd be grateful to know the answer.

    Thanks in advance

    JHH

    Tuesday, February 10, 2009 1:59 PM

Answers

  • Hi,

     

    Thanks for the reply.

     

    For your further concern about analyzing a particular event ID to discover the root cause, I am sorry to say that currently there is no such kind of tool that is available from Microsoft Download website. Meanwhile, I will forward your request to the corresponding team. If there is any update, we will let you know as soon as possible.

     

    Currently, I find a website which might be helpful for you.

     

    http://www.eventid.net/

     

    Hope it helps.


    David Shen - MSFT
    Thursday, February 12, 2009 10:31 AM

All replies

  • Hi John,

     

    In order to narrow down the cause of the issue more efficiently, please us refer the following steps to reboot the computer with Clean Boot and restart the computer to perform the test on the problematic computer.

     

    Step: reboot with clean boot mode

     

    1. Click "Start", go to "Run", and type "msconfig" in the open box to start the System Configuration Utility.

    2. Click the "Services" tab, check the "Hide All Microsoft Services" box and click Disable All (if it is not gray).

    3. Click the "Startup" tab, click "Disable All" and click "OK".

    4. Restart your computer. When the "System Configuration Utility" window appears, please check the box and click "OK".

    5. Please check if the explorer.exe can be loaded normally in this mode.

     

    As the problematic server is a Windows Server 2003 SP2, please disable TCP Chimney on the box

     

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters

     

    Set EnableTCPChimney value to 0

     

    Meanwhile, please also check the following KB article is helpful for you.

     

    Performance may decrease on a server that is running the 64-bit edition of Windows Server 2003 and that has Symantec Notification Server 6.0 installed

    http://support.microsoft.com/default.aspx/kb/951031

     

    Hope it helps.


    David Shen - MSFT
    Wednesday, February 11, 2009 9:16 AM
  • Thank you for replying David, I appreciate it.

    Unfortunately, I cannot follow your advice, as after the server was rebooted on the day the event storm ocurred, the error went away and has not as yet returned (thankfully).

    What I was hoping to do is find a way of analyzing that particular event id to discover what the root cause was.

    Are there any tools available for download from MS which I can use to trace the root cause?

    Thanks

    JHH

     

    Thursday, February 12, 2009 8:30 AM
  • Hi,

     

    Thanks for the reply.

     

    For your further concern about analyzing a particular event ID to discover the root cause, I am sorry to say that currently there is no such kind of tool that is available from Microsoft Download website. Meanwhile, I will forward your request to the corresponding team. If there is any update, we will let you know as soon as possible.

     

    Currently, I find a website which might be helpful for you.

     

    http://www.eventid.net/

     

    Hope it helps.


    David Shen - MSFT
    Thursday, February 12, 2009 10:31 AM
  • Thank you again for replying David

    I hope very much to hear from the corresponding team you mentioned.

    I have visited the eventid.net website, alas though it explains the event, it does not explain the cause nor provide a way to diagnose the cause.

    Again, thanks for your support.

    JHH
    Thursday, February 12, 2009 10:56 AM
  • Hi David

    You mentioned previously that you would 'forward my request to the corresponding team'.

    Did you get a response?

    Cheers for now

     

    JHH

    Friday, February 20, 2009 3:30 PM
  • I'm having exactly same problem. Please help us. Thanks !
    MCSA 2000+2003 | MCSE 2000+2003
    Thursday, March 05, 2009 3:11 PM
  • add me to your list of solution seekers.
    happened a few times. in the past 3 months.
    no help on ms website
    Tuesday, March 31, 2009 8:15 AM
  • Hi all,

    Please see whether the following solution will be helpful.

    http://support.microsoft.com/kb/136150

    Thanks and regards,
    Scorprio
    MCTS: Windows Vista | Exchange Server 2007 MCITP: Enterpise Support Technician | Server & Enterprise Admin
    Tuesday, March 31, 2009 8:26 AM
  • nope, does not apply as mine does not match exactly. here is my event properties
    0000: 00040000 00540001 00000000 c00007d0
    0010: 00000000 c000010a 00000000 00000000
    0020: 00000000 00000000 00bd0334
    thx for your response
    Tuesday, March 31, 2009 8:37 AM
  • Any luck with this? Seeing the same exact error.
    Thursday, July 02, 2009 5:58 PM
  • Sigh - add me to the me too list. This time I'm getting the following -
    0000: 00040000 00580001 00000000 c00007d0
    0010: 00000000 c000010a 00000000 00000000
    0020: 00000000 00000000 00bd0334

    Windows 2003sp2, 64bit. Currently unable to logmein to the server or rdp. Rdp gives me a login prompt as usual and then just sits at a grey screen. logmein does something similar but it's the blue logmein screen.
    I'm getting hundreds of these in 1 second according to the event log.


    Monday, August 10, 2009 8:47 PM
  • Hi, we are getting the same error with same event ID properties. Server is getting very slow. Please help!!!
    Thursday, September 24, 2009 10:50 AM
  • Hi, we are getting the same error with same event ID properties. Server is getting very slow. Please help!!!

    Hi, I am faced the same error. Please help & alert me....
    Thursday, September 24, 2009 12:39 PM
  • I have recently encountered this issue with the  following error code:

    0000: 00040000 00580001 00000000 c00007d0
    0010: 00000000 c000009a 00000000 00000000
    0020: 00000000 00000000 05950339

    I noticed that on the Application Log, Symantec update ran at the same time when I got the error.
    I have W2K3 R2 x64 SP2 environment.

    I've been able to search to come up with this MS KB: http://support.microsoft.com/kb/951031 which states "This problem occurs because of a handle leak in the Altiris Client Agent Service (AeXNSAgent)." and that Symantec should be notified. I don't have AeXNSAgent installed.
    Monday, October 05, 2009 3:31 PM
  • And we have also exactly the same problem since yesterday.

    We did this (before the things we did we had no error):

    remove exchange 2003
    demoted the dc to member

    The we got the error:

    Eventid: 2000
    Source SRV
    The server's call to a system service failed unexpectedly.

    For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
    0000: 00040000 00540001 00000000 c00007d0
    0010: 00000000 c000010a 00000000 00000000
    0020: 00000000 00000000 00bd0334

    ---

    Today I did the following:

    - remove IIS
    - remove DHCP
    - remove DNS

    ----

    Rebooted and the error was away for 3 hours orso. Now it came back so I rebooted again... But I am afraid it will come back!?

    I see lots of people have this problem. So please o please help me!
    Wednesday, October 28, 2009 2:09 PM
  • Just experience this issue as well, last Friday (10/30). We ended up powering off the server to get it to reboot, and then noticed several shares had disappeared (fun Monday putting those back into place). We are connected to a Dell Equallogic iSCSI SAN.

    -Brian
    Tuesday, November 03, 2009 3:40 AM
  • Same here as well:

    0000: 00040000 00540001 00000000 c00007d0
    0010: 00000000 c000010a 00000000 00000000
    0020: 00000000 00000000 00bd0334

    I can't reboot right now as we have hundreds of user's connected to mapped drives and also running applications, but I can't log in via RDP as I get a blank screen; and we have the usual event storm so I can't see what happened.

    Has ANYONE managed to find another way round this other than just rebooting?

    Thanks
    Jacqui
    Wednesday, November 25, 2009 11:34 AM
  • Same here, we have the same problem on 7 Windows 2003 R2 SP2 x86 servers (running on VMware ESX 3.5 update 4)

    The server's call to a system service failed unexpectedly.

    0000: 00040000 00540001 00000000 c00007d0
    0010: 00000000 c000010a 00000000 00000000
    0020: 00000000 00000000 00bd0334

    thanks,

    Donald

    Tuesday, May 25, 2010 6:36 PM
  • One more me too....have rebooted several times and it goes away for a day or two.  Any solutions?!?

    I will be contacting MS hope they have an answer.

    -Randy

    Tuesday, June 29, 2010 5:54 PM
  • Please let us know if you have any update from MS.  I have the same issue on a Win2k3 Ent SP2 Server for the last one week. Server performance and health is fine till now but thousands of error being reported in system logs.

    0000: 00040000 00540001 00000000 c00007d0
    0010: 00000000 c000010a 00000000 00000000
    0020: 00000000 00000000 00bd0334

    Wednesday, July 07, 2010 11:16 PM
  • I have the same issue on a Win2k3 Std. SP2. Any solutions for this error?

    Please send it tom my e-mail.

    -Addy

    Monday, January 10, 2011 5:37 PM
  • I just started getting this error today. Event viewer is just full of errors.

    0000: 00040000 00540001 00000000 c00007d0
    0010: 00000000 c000010a 00000000 00000000
    0020: 00000000 00000000 00bd0334 
    Anyone figure this problem out yet?
    Tuesday, January 11, 2011 3:41 PM
  • I recently had this on a Server STD 2003-sp2 box

     

    Event Type: Error

    Event Source: Srv

    Event Category: None

    Event ID: 2000

    Date: 1/25/2011

    Time: 8:53:55 AM

    User: N/A

    Computer:

    Description:

    The server's call to a system service failed unexpectedly.

     

    For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

    Data:

    0000: 00040000 00540001 00000000 c00007d0

    0010: 00000000 c000010a 00000000 00000000

    0020: 00000000 00000000 00bd0334 



    Resolution for me on this box for this situation was to uninstall "Unlocker" 

    This was installed a while ago and got triggered when an admin was trying to manually delete a user profile - userClass.dat was locked by Srv and Unlocker tried to unlock the hook which failed, then tried to kill the proc which failed and started spamming eventlog.

    Tuesday, January 25, 2011 5:09 PM
  • Just ran into the same error with the same error codes and I don't see Unlocker as an installed program, has there been any progress on this issue?
    Tuesday, April 19, 2011 1:53 PM
  • Posible solution - I started having the exact same issue yesterday. Any time I would reboot the server everything would seem to be ok, but after 20 or 30 minutes (with more and more users accessing the server) I would get the srv 2000 errors in the event log and everything would slow to a crawl on the network and server. It would never stay up for more than 30 minutes while users were accessing it. Overnight, the server opperated fine with no errors, but as soon as the employees would get in, it would lock up by 8:15am.

    I ended up replacing the NIC in the server and so far have had no issues. It's only been a couple of hours, but I'll report back later for an update.

    Thursday, April 28, 2011 3:58 PM
  • Have you solve this issue by replacing the NIC?
    Thursday, June 09, 2011 8:15 AM
  • Dsreyes,i have met the same question with you,but how do you solve it?
    Monday, June 13, 2011 1:06 PM
  • I got same problem too, I replace the NIC, but few minutes later the error back again.

     

    Tuesday, July 05, 2011 3:01 AM
  • I have just experienced the same issue and found a resolution. Not saying it will work for everybody, but it worked for me!

    One of our clients has an ESXi virtual server cluster running a number of Windows servers, and also a physical backup server.

    All servers are running Windows Server 2003 SP2. The physical backup server runs Symantec Backup Exec 2010.

    Every day a USB drive is attached to the physical backup server and backup Exec performs backups of all the virtual servers to the USB disk.

    Additionally, one of the virtual Windows Servers also runs an older version of Backup Exec, and backs itself up to a share on the USB disk attached to the physical server.

    Today a reformatted drive was attached to the physical backup server, and when the external Backup Job job started I started seeing this eror (Event ID 2000: The server's call to a system service failed unexpectedly.) which was being reported every 2 minutes.

    In our case, the problem was caused by the shared folder not existing on the reformatted backup drive. I created the folder, deleted and recreated the share, and now the backup is working again and the flood of Event ID 2000 errors has stopped.

    Hope that helps somebody out there! :)


    • Edited by GregConway Wednesday, July 13, 2011 6:52 PM typo
    Wednesday, July 13, 2011 6:50 PM
  • We here have had *nearly* the same problem, as of today.  The event ID and source are the same (2000, srv, respectively), as is the description.  But the data is as follows:

    0000: 00040000 002C0001 00000000 C00007D0
    0008: 00000000 C000010A 00000000 00000000
    0010: 00000000 00000000 00C30334

     

    exact same "event storm", with decreased server performance and complete inability to log in (remotely or at the console).  Since this is a production server, we're reluctant to reboot, but may have to try that anyway.

    • Proposed as answer by Heavenkats Friday, October 14, 2011 12:30 AM
    • Unproposed as answer by Heavenkats Friday, October 14, 2011 12:30 AM
    Monday, August 22, 2011 1:59 PM
  • All,

     

    You may wanna try this option increase the IRPstacksize value  to 15 and Add the registry entry for Poolusage maximum and Pagedpool size. This worked for us on many servers with similar symptoms..

    ..

    Friday, October 14, 2011 12:32 AM
  • As stated in the thread, Unlocker was my issue.  Our off site backup software from time to time grabs hold of the file shares and does not release (users complain they can open files read only).  Unlocker does unlock the off site backup software, but in the instance today, brought the server to it's knees.  I needed to crash the server and brought it backup with no issues (with waiting eyes).  Unlocker has since been removed...
    Monday, March 05, 2012 10:30 PM
  • As stated in the thread, Unlocker was my issue.  Our off
    site backup software from time to time grabs hold of the file shares and
    does not release (users complain they can open files read only). 
    Unlocker does unlock the off site backup software,
    but in the instance today, brought the server to it's knees.  I needed
    to crash the server and brought it backup with no issues (with waiting
    eyes).  Unlocker has since been removed...

    I have possibly caused a similar problem today on my Win2k3 server
    Had
    a PST file a user was reporting issues with (locked) as well as the
    PST.TMP file, so I unlocked them - 3 or 4 hours later, big trouble.

    Event Type:    Error
    Event Source:    Srv
    Event Category:    None
    Event ID:    2000
    Date:        20/06/2012
    Time:        10:45:10 PM
    User:        N/A
    Computer:    SERVER
    Description:
    The server's call to a system service failed unexpectedly.

    For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
    Data:
    0000: 00 00 04 00 01 00 54 00   ......T.
    0008: 00 00 00 00 d0 07 00 c0   ....Ð..À
    0010: 00 00 00 00 0a 01 00 c0   .......À
    0018: 00 00 00 00 00 00 00 00   ........
    0020: 00 00 00 00 00 00 00 00   ........
    0028: 34 03 bd 00               4.½.    

    Thousands of entries, hundreds per second - totally cleared out the event log.
    I actually use Acronis to do my backups and it failed with the following error.

    Event Type:    Error
    Event Source:    Acronis True Image Enterprise Server
    Event Category:    (7)
    Event ID:    33
    Date:        20/06/2012
    Time:        6:30:12 PM
    User:        N/A
    Computer:    SERVER
    Description:
    The
    description for Event ID ( 33 ) in Source ( Acronis True Image
    Enterprise Server ) cannot be found. The local computer may not have the
    necessary registry information or message DLL files to display messages
    from a remote computer. You may be able to use the /AUXSOURCE= flag to
    retrieve this description; see Help and Support for details. The
    following information is part of the event: Cannot access drive.
    Cannot
    create the image of the logical drive C: because it is currently in use
    by running applications or the logical drive contains bad sectors.:
    None.

    I thought I had a faulty disk but it actually seems possible that's not the case now.

    Wednesday, June 20, 2012 1:25 PM
  • Im also Facing  the same issue...............

    Event Type:    Error
    Event Source:    Srv
    Event Category:    None
    Event ID:    2000
    Date:        1/17/2014
    Time:        9:14:23 AM
    User:        N/A
    Computer:   
    Description:
    The server's call to a system service failed unexpectedly.

    For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
    Data:
    0000: 00 00 04 00 01 00 54 00   ......T.
    0008: 00 00 00 00 d0 07 00 c0   ....Ð..À
    0010: 00 00 00 00 9a 00 00 c0   ....š..À
    0018: 00 00 00 00 00 00 00 00   ........
    0020: 00 00 00 00 00 00 00 00   ........
    0028: 37 03 4a 05               7.J.     
    .


    Friday, January 17, 2014 2:47 PM