event log errors/warnings
in [IIS]
|
From: sonsie on 22 Jan 2006 23:26 Thank you, David, the analysis that you gave of the errors is what I was looking for. I said "I don't know what the problem is", meaning that I had numerous errors/warnings and didn't know why, not understanding that you were asking if I was having problems with it functioning. I guess I thought that sending them in was self-explanatory. I had sent similar emails to 3-4 different places and spent much time on working on finding answers, so I may have had tunnel vision by the time I wrote you which contributed to my assumption that my email was self-explanatory. I'm quite challenged when it comes to understanding the workings of a computer, and am trying hard to learn. That's why I take notice when an error or warning comes up - I don't *know* that it's insignificant. It's important to me to have explanations rather than a pat on the head and a 'don't worry'. I normally depend on the pop-up pages that come after I send in an error, but I haven't received one in days. Either MS doesn't have enough info in their databank to answer the errors I had, or most people are smart enough to know what they mean. btw, I can't contact MS by phone, chat or email because I bought my PC with Windows XP already installed and it says on the support page that they won't support those of us in that situation. So we have to depend on forums and people such as yourself. sonsie "David Wang [Msft]" wrote: > Please understand that this is a free peer-support forum. Answers are not > guaranteed. If you want guaranteed support, you can call Microsoft PSS. > > In general, people are not psychic, so the best way to get a helpful > response is to ask a helpful question. > > Which is what I tried to ask of you -- what is your question/problem -- and > you said "I don't know". Please understand that if I did not want to help > you, I would not have bothered asking you to clarify. So please don't just > insult me by saying that I "chose not to give a helpful response" -- you > gave me nothing to work with. > > Now, I already did my analysis of the events and none are "critical". > > Application Log: > - XP Home does not have IIS, which is what one of the warning references. > Benign > - WinMgmt events are all about WMI namespace registration made by > applications you have installed, which unless you are programming/scripting, > you can ignore. > > Security Log: > - You care about IPSec only in a Domain or Stand-alone configuration. Since > XP Home cannot join a domain, you only care about stand-alone configuration. > And if you run a firewall, this warning is irrelevant. You are probably > running a firewall from a security perspective, hence this warning is > benign. > > System Log: > - EventSystem is set to always auto-start but does not work in SafeMode > (which is ok because SafeMode is mostly for fixing driver issues). You > rebooted into SafeMode at some point, hence this event is expected and > benign. > - XP Home and XP Pro have built-in unalterable connection limits. The > warning just says that it's been reached, which is expected and hence > benign. > - Windows Messenger failed for some reason. If you are not using Windows > Messenger (MSN Messenger != Windows Messenger) then this is not interesting > > > So as you can see, all the events are benign and require no action from you. > > FYI: I suggest that you fix your incorrect assumption that any > warnings/errors in the Event Log mean that something is wrong and need to be > fixed. Not all errors show up in the event log, and not all errors in the > event log require action. Sorry, in general computing, there aren't > clear-cut answers - you just have to learn how to evaluate which events are > important and where the errors are logged. If you have a locked down and > fixed system, I would react differently, but not for general computers that > consumers maintain and use. > > -- > //David > IIS > http://blogs.msdn.com/David.Wang > This posting is provided "AS IS" with no warranties, and confers no rights. > // > > "sonsie" <nancyarnold(removethis)@hotmail.com> wrote in message > news:6D22115C-EDCA-4BAC-A4A4-BF573C02DE1C(a)microsoft.com... > >I don't know what the problem is either, that's why I turned to the > >experts. > > I don't know what any of those errors/warnings mean, but I know enough to > > take notice when a log tells me that "this can be a potential security > > hazard", or tells me to perform a task because something can't be > > installed. > > > > "None of them look critical" doesn't tell me much. I'm not just "trying to > > have no errors show up" - I figure if there are problems, which there are > > or > > it wouldn't give me errors and warnings, then I'd like to fix them, rather > > than wait and have them turn into something much worse in the future. > > > > Sorry, but that's twice in one day that Microsoft chose not to give a > > helpful response - the first time the person directed me to this forum. > > > > Thanks anyway > > > > "David Wang [Msft]" wrote: > > > >> I'm not certain what your actual problem is... > >> > >> Are you just trying to have no errors/warnings show up in the Event Log? > >> > >> None of them look critical. > >> > >> -- > >> //David > >> IIS > >> http://blogs.msdn.com/David.Wang > >> This posting is provided "AS IS" with no warranties, and confers no > >> rights. > >> // > >> > >> "sonsie" <nancyarnold(removethis)@hotmail.com> wrote in message > >> news:8F3FA611-9AC8-426D-959B-EE4F29630838(a)microsoft.com... > >> > Additional note: I'm sorry, forgot to mention that I'm using Windows XP > >> > home > >> > sp2 and my PC has 512MB ram, 2 HD. > >> > > >> > "sonsie" wrote: > >> > > >> >> After hitting a couple of dead ends with regard to help, I was > >> >> directed > >> >> here. > >> >> I have 10 errors/warnings on my event logs, one of which is about IIS. > >> >> I'm > >> >> going to post all of them here with the understanding that this forum > >> >> may > >> >> not > >> >> be able to help with all of them. Normally I click on the link to MS > >> >> that > >> >> reports the problem, but for the past 4-5 days I've gotten either a > >> >> blank > >> >> page or the message that they have no info on the problem. Whatever > >> >> help > >> >> you > >> >> can give would be greatly appreciated. > >> >> > >> >> sonsie > >> >> > >> >> Writing in double brackets indicates notes I've made about frequency. > >> >> > >> >> APPLICATION LOG > >> >> > >> >> Event Type: Warning > >> >> Event Source: WinMgmt > >> >> Event Category: None > >> >> Event ID: 63 > >> >> Date: 1/15/2006 > >> >> Time: 6:20:04 PM > >> >> User: NT AUTHORITY\SYSTEM > >> >> Computer: NL4-658OL-MJG > >> >> Description: > >> >> A provider, HiPerfCooker_v1, has been registered in the WMI namespace, > >> >> Root\WMI, to use the LocalSystem account. This account is privileged > >> >> and > >> >> the > >> >> provider may cause a security violation if it does not correctly > >> >> impersonate > >> >> user requests. > >> >> > >> >> For more information, see Help and Support Center at > >> >> http://go.microsoft.com/fwlink/events.asp. > >> >> > >> >> xxxxxxxx > >> >> > >> >> Event Type: Warning [[this one x2 on 1/18, x2 on 1/19]] > >> >> Event Source: WinMgmt > >> >> Event Category: None > >> >> Event ID: 5603 > >> >> Date: 1/18/2006 > >> >> Time: 2:26:15 PM > >> >> User: NT AUTHORITY\SYSTEM > >> >> Computer: NLA-65801-MJG > >> >> Description: > >> >> A provider, OffProv10, has been registered in the WMI namespace, > >> >> Root\MSAPPS10, but did not specify the HostingModel property. This > >> >> provider > >> >> will be run using the LocalSystem account. This account is privileged > >> >> and > >> >> the provider may cause a security violation if it does not correctly > >> >> impersonate user requests. Ensure that provider has been reviewed for > >> >> security behavior and update the HostingModel property of the provider > >> >> registration to an account with the least privileges possible for the > >> >> required functionality. > >> >> > >> >> For more information, see Help and Support Center at > >> >> http://go.microsoft.com/fwlink/events.asp. > >> >> > >> >> xxxxxxxxx > >> >> > >> >> Event Type: Warning > >> >> Event Source: ASP.NET 1.1.4322.0 > >> >> Event Category: Setup > >> >> Event ID: 1020 > >> >> Date: 1/19/2006 > >> >> Time: 4:44:58 AM > >> >> User: N/A > >> >> Computer: NLA-65801-MJG > >> >> Description: > >> >> Updates to the IIS metabase were aborted because IIS is either not > >> >> installed > >> >> or is disabled on this machine. To configure ASP.NET to run in IIS, > >> >> please > >> >> install or enable IIS and re-register ASP.NET using aspnet_regiis.exe > >> >> /i. > >> >> > >> >> For more information, see Help and Support Center at > >> >> http://go.microsoft.com/fwlink/events.asp. > >> >> > >> >> xxxxxxxxxx > >> >> > >> >> Event Type: Warning > >> >> Event Source: WinMgmt > >> >> Event Category: None > >> >> Event ID: 62 > >> >> Date: 1/19/2006 > >> >> Time: 4:46:36 AM > >> >> User: N/A > >> >> Computer: NLA-65801-MJG > >> >> Description: > >> >> WMI ADAP was unable to process the .NET CLR Data performance library > >> >> since > >> >> one of the data blobs reported to have classes but had zero size > >> >> > >> >> For more information, see Help and Support Center at > >> >> http://go.microsoft.com/fwlink/events.asp. > >> >> > >> >> xxxxxxxxxx > >> >> > >> >> Event Type: Warning > >> >> Event Source: WinMgmt > >> >> Event Category: None > >> >> Event ID: 62 > >> >> Date: 1/19/2006 > >> >> Time: 4:46:36 AM > >> >> User: N/A > >> >> Computer: NLA-65801-MJG > >> >> Description: > >> >> WMI ADAP was unable to process the .NET CLR Networking performance > >> >> library > >> >> since one of the data blobs reported to have classes but had zero size > >> >> > >> >> For more information, see Help and Support Center at > >> >> http://go.microsoft.com/fwlink/events.asp. > >> >> > >> >> > >> >> xxxxxxxxxxxx > >> >> > >> >> SECURITY LOG > >> >> > >> >> Event Type: Failure Audit [[several warnings since 1/16]] > >> >> Event Source: Security > >> >> Event Category: Policy Change > >> >> Event ID: 615 > >> >> Date: 1/18/2006 > >> >> Time: 1:06:04 PM > >> >> User: NT AUTHORITY\NETWORK SERVICE > >> >> Computer: NLA-65801-MJG > >> >> Description: > >> >> IPSec Services: IPSec Services failed to get the complete list of > >> >> network > >> >> interfaces on the machine. This can be a potential security hazard to > >> >> the > >> >> machine since some of the network interfaces may not get the > >> >> protection > >> >> as > >> >> desired by the applied IPSec filters. Please run IPSec monitor snap-in > >> >> to > >> >> further diagnose the problem. > >> >> > >> >> > >> >> > >> >> For more information, see Help and Support Center at > >> >> http://go.microsoft.com/fwlink/events.asp. > >> >> > >> >> xxxxxxxxxxx > >> >> > >> >> SYSTEM LOG > >> >> > >> >> Event Type: Error > >> >> Event Source: DCOM > >> >> Event Category: None > >> >> Event ID: 10005 > >> >> Date: 1/16/2006 > >> >> Time: 12:48:11 PM > >> >> User: NT AUTHORITY\SYSTEM > >> >> Computer: NLA-65801-MJG > >> >> Description: > >> >> DCOM got error "This service cannot be started in Safe Mode " > >> >> attempting > >> >> to > >> >> start the service EventSystem with arguments "" in order to run the > >> >> server: > >> >> {1BE1F766-5536-11D1-B726-00C04FB926AF} > >> >> > >> >> For more information, see Help and Support Center at > >> >> http://go.microsoft.com/fwlink/events.asp. > >> >> > >> >> xxxxxxxxx > >> >> > >> >> Event Type: Warning [[often get these a couple of times/day]] > >> >> Event Source: Tcpip > >> >> Event Category: None > >> >> Event ID: 4226 > >> >> Date: 1/17/2006 > >> >> Time: 11:59:35 PM > >> >> User: N/A > >> >> Computer: NLA-65801-MJG > >> >> Description: > >> >> TCP/IP has reached the security limit imposed on the number of > >> >> concurrent > >> >> TCP connect attempts. > >> >> > >> >> For more information, see Help and Support Center at > >> >> http://go.microsoft.com/fwlink/events.asp. > >> >> Data: > >> >> 0000: 00 00 00 00 01 00 54 00 ......T. > >> >> 0008: 00 00 00 00 82 10 00 80 ....?..?
From: David Wang [Msft] on 23 Jan 2006 09:01 I congratulate you and urge you to continue asking and learning. I encounter users like you infrequently. Most people just want answers without understanding how and why. I do suggest that you phrase your future questions by considering that the "experts" all have limited time/resources... so you either want to call out a specific question, or clearly say that you are trying to learn about X... And refrain from sending posts asking for someone to explain a dozen different event log messages. That will scare away most anyone and rarely garner significant responses. You want to have compact questions, maybe 1 or 2 related event log entries or other significant detail, and go from there. People *are* willing to help. Just be kind, understanding, and do not over-tax their generosity. -- //David IIS http://blogs.msdn.com/David.Wang This posting is provided "AS IS" with no warranties, and confers no rights. // "sonsie" <nancyarnold(removethis)@hotmail.com> wrote in message news:8D853011-1F84-4D62-A6FB-919ECF66AFC4(a)microsoft.com... > Thank you, David, the analysis that you gave of the errors is what I was > looking for. I said "I don't know what the problem is", meaning that I had > numerous errors/warnings and didn't know why, not understanding that you > were > asking if I was having problems with it functioning. I guess I thought > that > sending them in was self-explanatory. I had sent similar emails to 3-4 > different places and spent much time on working on finding answers, so I > may > have had tunnel vision by the time I wrote you which contributed to my > assumption that my email was self-explanatory. > > I'm quite challenged when it comes to understanding the workings of a > computer, and am trying hard to learn. That's why I take notice when an > error > or warning comes up - I don't *know* that it's insignificant. It's > important > to me to have explanations rather than a pat on the head and a 'don't > worry'. > I normally depend on the pop-up pages that come after I send in an error, > but > I haven't received one in days. Either MS doesn't have enough info in > their > databank to answer the errors I had, or most people are smart enough to > know > what they mean. > > btw, I can't contact MS by phone, chat or email because I bought my PC > with > Windows XP already installed and it says on the support page that they > won't > support those of us in that situation. So we have to depend on forums and > people such as yourself. > > sonsie > > "David Wang [Msft]" wrote: > >> Please understand that this is a free peer-support forum. Answers are not >> guaranteed. If you want guaranteed support, you can call Microsoft PSS. >> >> In general, people are not psychic, so the best way to get a helpful >> response is to ask a helpful question. >> >> Which is what I tried to ask of you -- what is your question/problem -- >> and >> you said "I don't know". Please understand that if I did not want to help >> you, I would not have bothered asking you to clarify. So please don't >> just >> insult me by saying that I "chose not to give a helpful response" -- you >> gave me nothing to work with. >> >> Now, I already did my analysis of the events and none are "critical". >> >> Application Log: >> - XP Home does not have IIS, which is what one of the warning references. >> Benign >> - WinMgmt events are all about WMI namespace registration made by >> applications you have installed, which unless you are >> programming/scripting, >> you can ignore. >> >> Security Log: >> - You care about IPSec only in a Domain or Stand-alone configuration. >> Since >> XP Home cannot join a domain, you only care about stand-alone >> configuration. >> And if you run a firewall, this warning is irrelevant. You are probably >> running a firewall from a security perspective, hence this warning is >> benign. >> >> System Log: >> - EventSystem is set to always auto-start but does not work in SafeMode >> (which is ok because SafeMode is mostly for fixing driver issues). You >> rebooted into SafeMode at some point, hence this event is expected and >> benign. >> - XP Home and XP Pro have built-in unalterable connection limits. The >> warning just says that it's been reached, which is expected and hence >> benign. >> - Windows Messenger failed for some reason. If you are not using Windows >> Messenger (MSN Messenger != Windows Messenger) then this is not >> interesting >> >> >> So as you can see, all the events are benign and require no action from >> you. >> >> FYI: I suggest that you fix your incorrect assumption that any >> warnings/errors in the Event Log mean that something is wrong and need to >> be >> fixed. Not all errors show up in the event log, and not all errors in the >> event log require action. Sorry, in general computing, there aren't >> clear-cut answers - you just have to learn how to evaluate which events >> are >> important and where the errors are logged. If you have a locked down and >> fixed system, I would react differently, but not for general computers >> that >> consumers maintain and use. >> >> -- >> //David >> IIS >> http://blogs.msdn.com/David.Wang >> This posting is provided "AS IS" with no warranties, and confers no >> rights. >> // >> >> "sonsie" <nancyarnold(removethis)@hotmail.com> wrote in message >> news:6D22115C-EDCA-4BAC-A4A4-BF573C02DE1C(a)microsoft.com... >> >I don't know what the problem is either, that's why I turned to the >> >experts. >> > I don't know what any of those errors/warnings mean, but I know enough >> > to >> > take notice when a log tells me that "this can be a potential security >> > hazard", or tells me to perform a task because something can't be >> > installed. >> > >> > "None of them look critical" doesn't tell me much. I'm not just "trying >> > to >> > have no errors show up" - I figure if there are problems, which there >> > are >> > or >> > it wouldn't give me errors and warnings, then I'd like to fix them, >> > rather >> > than wait and have them turn into something much worse in the future. >> > >> > Sorry, but that's twice in one day that Microsoft chose not to give a >> > helpful response - the first time the person directed me to this forum. >> > >> > Thanks anyway >> > >> > "David Wang [Msft]" wrote: >> > >> >> I'm not certain what your actual problem is... >> >> >> >> Are you just trying to have no errors/warnings show up in the Event >> >> Log? >> >> >> >> None of them look critical. >> >> >> >> -- >> >> //David >> >> IIS >> >> http://blogs.msdn.com/David.Wang >> >> This posting is provided "AS IS" with no warranties, and confers no >> >> rights. >> >> // >> >> >> >> "sonsie" <nancyarnold(removethis)@hotmail.com> wrote in message >> >> news:8F3FA611-9AC8-426D-959B-EE4F29630838(a)microsoft.com... >> >> > Additional note: I'm sorry, forgot to mention that I'm using Windows >> >> > XP >> >> > home >> >> > sp2 and my PC has 512MB ram, 2 HD. >> >> > >> >> > "sonsie" wrote: >> >> > >> >> >> After hitting a couple of dead ends with regard to help, I was >> >> >> directed >> >> >> here. >> >> >> I have 10 errors/warnings on my event logs, one of which is about >> >> >> IIS. >> >> >> I'm >> >> >> going to post all of them here with the understanding that this >> >> >> forum >> >> >> may >> >> >> not >> >> >> be able to help with all of them. Normally I click on the link to >> >> >> MS >> >> >> that >> >> >> reports the problem, but for the past 4-5 days I've gotten either a >> >> >> blank >> >> >> page or the message that they have no info on the problem. Whatever >> >> >> help >> >> >> you >> >> >> can give would be greatly appreciated. >> >> >> >> >> >> sonsie >> >> >> >> >> >> Writing in double brackets indicates notes I've made about >> >> >> frequency. >> >> >> >> >> >> APPLICATION LOG >> >> >> >> >> >> Event Type: Warning >> >> >> Event Source: WinMgmt >> >> >> Event Category: None >> >> >> Event ID: 63 >> >> >> Date: 1/15/2006 >> >> >> Time: 6:20:04 PM >> >> >> User: NT AUTHORITY\SYSTEM >> >> >> Computer: NL4-658OL-MJG >> >> >> Description: >> >> >> A provider, HiPerfCooker_v1, has been registered in the WMI >> >> >> namespace, >> >> >> Root\WMI, to use the LocalSystem account. This account is >> >> >> privileged >> >> >> and >> >> >> the >> >> >> provider may cause a security violation if it does not correctly >> >> >> impersonate >> >> >> user requests. >> >> >> >> >> >> For more information, see Help and Support Center at >> >> >> http://go.microsoft.com/fwlink/events.asp. >> >> >> >> >> >> xxxxxxxx >> >> >> >> >> >> Event Type: Warning [[this one x2 on 1/18, x2 on 1/19]] >> >> >> Event Source: WinMgmt >> >> >> Event Category: None >> >> >> Event ID: 5603 >> >> >> Date: 1/18/2006 >> >> >> Time: 2:26:15 PM >> >> >> User: NT AUTHORITY\SYSTEM >> >> >> Computer: NLA-65801-MJG >> >> >> Description: >> >> >> A provider, OffProv10, has been registered in the WMI namespace, >> >> >> Root\MSAPPS10, but did not specify the HostingModel property. This >> >> >> provider >> >> >> will be run using the LocalSystem account. This account is >> >> >> privileged >> >> >> and >> >> >> the provider may cause a security violation if it does not >> >> >> correctly >> >> >> impersonate user requests. Ensure that provider has been reviewed >> >> >> for >> >> >> security behavior and update the HostingModel property of the >> >> >> provider >> >> >> registration to an account with the least privileges possible for >> >> >> the >> >> >> required functionality. >> >> >> >> >> >> For more information, see Help and Support Center at >> >> >> http://go.microsoft.com/fwlink/events.asp. >> >> >> >> >> >> xxxxxxxxx >> >> >> >> >> >> Event Type: Warning >> >> >> Event Source: ASP.NET 1.1.4322.0 >> >> >> Event Category: Setup >> >> >> Event ID: 1020 >> >> >> Date: 1/19/2006 >> >> >> Time: 4:44:58 AM >> >> >> User: N/A >> >> >> Computer: NLA-65801-MJG >> >> >> Description: >> >> >> Updates to the IIS metabase were aborted because IIS is either not >> >> >> installed >> >> >> or is disabled on this machine. To configure ASP.NET to run in IIS, >> >> >> please >> >> >> install or enable IIS and re-register ASP.NET using >> >> >> aspnet_regiis.exe >> >> >> /i. >> >> >> >> >> >> For more information, see Help and Support Center at >> >> >> http://go.microsoft.com/fwlink/events.asp. >> >> >> >> >> >> xxxxxxxxxx >> >> >> >> >> >> Event Type: Warning >> >> >> Event Source: WinMgmt >> >> >> Event Category: None >> >> >> Event ID: 62 >> >> >> Date: 1/19/2006 >> >> >> Time: 4:46:36 AM >> >> >> User: N/A >> >> >> Computer: NLA-65801-MJG >> >> >> Description: >> >> >> WMI ADAP was unable to process the .NET CLR Data performance >> >> >> library >> >> >> since >> >> >> one of the data blobs reported to have classes but had zero size >> >> >> >> >> >> For more information, see Help and Support Center at >> >> >> http://go.microsoft.com/fwlink/events.asp. >> >> >> >> >> >> xxxxxxxxxx >> >> >> >> >> >> Event Type: Warning >> >> >> Event Source: WinMgmt >> >> >> Event Category: None >> >> >> Event ID: 62 >> >> >> Date: 1/19/2006 >> >> >> Time: 4:46:36 AM >> >> >> User: N/A >> >> >> Computer: NLA-65801-MJG >> >> >> Description: >> >> >> WMI ADAP was unable to process the .NET CLR Networking performance >> >> >> library >> >> >> since one of the data blobs reported to have classes but had zero >> >> >> size >> >> >> >> >> >> For more information, see Help and Support Center at >> >> >> http://go.microsoft.com/fwlink/events.asp. >> >> >> >> >> >> >> >> >> xxxxxxxxxxxx >> >> >> >> >> >> SECURITY LOG >> >> >> >> >> >> Event Type: Failure Audit [[several warnings since 1/16]] >> >> >> Event Source: Security >> >> >> Event Category: Policy Change >> >> >> Event ID: 615 >> >> >> Date: 1/18/2006 >> >> >> Time: 1:06:04 PM >> >> >> User: NT AUTHORITY\NETWORK SERVICE >> >> >> Computer: NLA-65801-MJG >> >> >> Description: >> >> >> IPSec Services: IPSec Services failed to get the complete list of >> >> >> network >> >> >> interfaces on the machine. This can be a potential security hazard >> >> >> to >> >> >> the >> >> >> machine since some of the network interfaces may not get the >> >> >> protection >> >> >> as >> >> >> desired by the applied IPSec filters. Please run IPSec monitor >> >> >> snap-in >> >> >> to >> >> >> further diagnose the problem. >> >> >> >> >> >> >> >> >> >> >> >> For more information, see Help and Support Center at >> >> >> http://go.microsoft.com/fwlink/events.asp. >> >> >> >> >> >> xxxxxxxxxxx >> >> >> >> >> >> SYSTEM LOG >> >> >> >> >> >> Event Type: Error >> >> >> Event Source: DCOM >> >> >> Event Category: None >> >> >> Event ID: 10005 >> >> >> Date: 1/16/2006 >> >> >> Time: 12:48:11 PM >> >> >> User: NT AUTHORITY\SYSTEM >> >> >> Computer: NLA-65801-MJG >> >> >> Description: >> >> >> DCOM got error "This service cannot be started in Safe Mode " >> >> >> attempting >> >> >> to >> >> >> start the service EventSystem with arguments "" in order to run the >> >> >> server: >> >> >> {1BE1F766-5536-11D1-B726-00C04FB926AF} >> >> >> >> >> >> For more information, see Help and Support Center at >> >> >> http://go.microsoft.com/fwlink/events.asp. >> >> >> >> >> >> xxxxxxxxx >> >> >> >> >> >> Event Type: Warning [[often get these a couple of times/day]] >> >> >> Event Source: Tcpip >> >> >> Event Category: None >> >> >> Event ID: 4226 >> >> >> Date: 1/17/2006 >> >> >> Time: 11:59:35 PM >> >> >> User: N/A >> >> >> Computer: NLA-65801-MJG >> >> >> Description: >> >> >> TCP/IP has reached the security limit imposed on the number of >> >> >> concurrent >> >> >> TCP connect attempts. >> >> >> >> >> >> For more information, see Help and Support Center at >> >> >> http://go.microsoft.com/fwlink/events.asp. >> >> >> Data: >> >> >> 0000: 00 00 00 00 01 00 54 00 ......T. >> >> >> 0008: 00 00 00 00 82 10 00 80 ....?..?
From: sonsie on 24 Jan 2006 02:17 Thank you for the tips David. I wouldn't have dreamt of sending all of those errors, except the tech in the previous MS forum had told me to send them in. When I did, he referred me to this forum. ; ) Take care sonsie "David Wang [Msft]" wrote: > I congratulate you and urge you to continue asking and learning. I encounter > users like you infrequently. Most people just want answers without > understanding how and why. > > I do suggest that you phrase your future questions by considering that the > "experts" all have limited time/resources... so you either want to call out > a specific question, or clearly say that you are trying to learn about X... > > And refrain from sending posts asking for someone to explain a dozen > different event log messages. That will scare away most anyone and rarely > garner significant responses. > > You want to have compact questions, maybe 1 or 2 related event log entries > or other significant detail, and go from there. > > People *are* willing to help. Just be kind, understanding, and do not > over-tax their generosity. > > -- > //David > IIS > http://blogs.msdn.com/David.Wang > This posting is provided "AS IS" with no warranties, and confers no rights. > // > > "sonsie" <nancyarnold(removethis)@hotmail.com> wrote in message > news:8D853011-1F84-4D62-A6FB-919ECF66AFC4(a)microsoft.com... > > Thank you, David, the analysis that you gave of the errors is what I was > > looking for. I said "I don't know what the problem is", meaning that I had > > numerous errors/warnings and didn't know why, not understanding that you > > were > > asking if I was having problems with it functioning. I guess I thought > > that > > sending them in was self-explanatory. I had sent similar emails to 3-4 > > different places and spent much time on working on finding answers, so I > > may > > have had tunnel vision by the time I wrote you which contributed to my > > assumption that my email was self-explanatory. > > > > I'm quite challenged when it comes to understanding the workings of a > > computer, and am trying hard to learn. That's why I take notice when an > > error > > or warning comes up - I don't *know* that it's insignificant. It's > > important > > to me to have explanations rather than a pat on the head and a 'don't > > worry'. > > I normally depend on the pop-up pages that come after I send in an error, > > but > > I haven't received one in days. Either MS doesn't have enough info in > > their > > databank to answer the errors I had, or most people are smart enough to > > know > > what they mean. > > > > btw, I can't contact MS by phone, chat or email because I bought my PC > > with > > Windows XP already installed and it says on the support page that they > > won't > > support those of us in that situation. So we have to depend on forums and > > people such as yourself. > > > > sonsie > > > > "David Wang [Msft]" wrote: > > > >> Please understand that this is a free peer-support forum. Answers are not > >> guaranteed. If you want guaranteed support, you can call Microsoft PSS. > >> > >> In general, people are not psychic, so the best way to get a helpful > >> response is to ask a helpful question. > >> > >> Which is what I tried to ask of you -- what is your question/problem -- > >> and > >> you said "I don't know". Please understand that if I did not want to help > >> you, I would not have bothered asking you to clarify. So please don't > >> just > >> insult me by saying that I "chose not to give a helpful response" -- you > >> gave me nothing to work with. > >> > >> Now, I already did my analysis of the events and none are "critical". > >> > >> Application Log: > >> - XP Home does not have IIS, which is what one of the warning references. > >> Benign > >> - WinMgmt events are all about WMI namespace registration made by > >> applications you have installed, which unless you are > >> programming/scripting, > >> you can ignore. > >> > >> Security Log: > >> - You care about IPSec only in a Domain or Stand-alone configuration. > >> Since > >> XP Home cannot join a domain, you only care about stand-alone > >> configuration. > >> And if you run a firewall, this warning is irrelevant. You are probably > >> running a firewall from a security perspective, hence this warning is > >> benign. > >> > >> System Log: > >> - EventSystem is set to always auto-start but does not work in SafeMode > >> (which is ok because SafeMode is mostly for fixing driver issues). You > >> rebooted into SafeMode at some point, hence this event is expected and > >> benign. > >> - XP Home and XP Pro have built-in unalterable connection limits. The > >> warning just says that it's been reached, which is expected and hence > >> benign. > >> - Windows Messenger failed for some reason. If you are not using Windows > >> Messenger (MSN Messenger != Windows Messenger) then this is not > >> interesting > >> > >> > >> So as you can see, all the events are benign and require no action from > >> you. > >> > >> FYI: I suggest that you fix your incorrect assumption that any > >> warnings/errors in the Event Log mean that something is wrong and need to > >> be > >> fixed. Not all errors show up in the event log, and not all errors in the > >> event log require action. Sorry, in general computing, there aren't > >> clear-cut answers - you just have to learn how to evaluate which events > >> are > >> important and where the errors are logged. If you have a locked down and > >> fixed system, I would react differently, but not for general computers > >> that > >> consumers maintain and use. > >> > >> -- > >> //David > >> IIS > >> http://blogs.msdn.com/David.Wang > >> This posting is provided "AS IS" with no warranties, and confers no > >> rights. > >> // > >> > >> "sonsie" <nancyarnold(removethis)@hotmail.com> wrote in message > >> news:6D22115C-EDCA-4BAC-A4A4-BF573C02DE1C(a)microsoft.com... > >> >I don't know what the problem is either, that's why I turned to the > >> >experts. > >> > I don't know what any of those errors/warnings mean, but I know enough > >> > to > >> > take notice when a log tells me that "this can be a potential security > >> > hazard", or tells me to perform a task because something can't be > >> > installed. > >> > > >> > "None of them look critical" doesn't tell me much. I'm not just "trying > >> > to > >> > have no errors show up" - I figure if there are problems, which there > >> > are > >> > or > >> > it wouldn't give me errors and warnings, then I'd like to fix them, > >> > rather > >> > than wait and have them turn into something much worse in the future. > >> > > >> > Sorry, but that's twice in one day that Microsoft chose not to give a > >> > helpful response - the first time the person directed me to this forum. > >> > > >> > Thanks anyway > >> > > >> > "David Wang [Msft]" wrote: > >> > > >> >> I'm not certain what your actual problem is... > >> >> > >> >> Are you just trying to have no errors/warnings show up in the Event > >> >> Log? > >> >> > >> >> None of them look critical. > >> >> > >> >> -- > >> >> //David > >> >> IIS > >> >> http://blogs.msdn.com/David.Wang > >> >> This posting is provided "AS IS" with no warranties, and confers no > >> >> rights. > >> >> // > >> >> > >> >> "sonsie" <nancyarnold(removethis)@hotmail.com> wrote in message > >> >> news:8F3FA611-9AC8-426D-959B-EE4F29630838(a)microsoft.com... > >> >> > Additional note: I'm sorry, forgot to mention that I'm using Windows > >> >> > XP > >> >> > home > >> >> > sp2 and my PC has 512MB ram, 2 HD. > >> >> > > >> >> > "sonsie" wrote: > >> >> > > >> >> >> After hitting a couple of dead ends with regard to help, I was > >> >> >> directed > >> >> >> here. > >> >> >> I have 10 errors/warnings on my event logs, one of which is about > >> >> >> IIS. > >> >> >> I'm > >> >> >> going to post all of them here with the understanding that this > >> >> >> forum > >> >> >> may > >> >> >> not > >> >> >> be able to help with all of them. Normally I click on the link to > >> >> >> MS > >> >> >> that > >> >> >> reports the problem, but for the past 4-5 days I've gotten either a > >> >> >> blank > >> >> >> page or the message that they have no info on the problem. Whatever > >> >> >> help > >> >> >> you > >> >> >> can give would be greatly appreciated. > >> >> >> > >> >> >> sonsie > >> >> >> > >> >> >> Writing in double brackets indicates notes I've made about > >> >> >> frequency. > >> >> >> > >> >> >> APPLICATION LOG > >> >> >> > >> >> >> Event Type: Warning > >> >> >> Event Source: WinMgmt > >> >> >> Event Category: None > >> >> >> Event ID: 63 > >> >> >> Date: 1/15/2006 > >> >> >> Time: 6:20:04 PM > >> >> >> User: NT AUTHORITY\SYSTEM > >> >> >> Computer: NL4-658OL-MJG > >> >> >> Description: > >> >> >> A provider, HiPerfCooker_v1, has been registered in the WMI > >> >> >> namespace, > >> >> >> Root\WMI, to use the LocalSystem account. This account is > >> >> >> privileged > >> >> >> and > >> >> >> the > >> >> >> provider may cause a security violation if it does not correctly > >> >> >> impersonate > >> >> >> user requests. > >> >> >> > >> >> >> For more information, see Help and Support Center at > >> >> >> http://go.microsoft.com/fwlink/events.asp. > >> >> >> > >> >> >> xxxxxxxx > >> >> >> > >> >> >> Event Type: Warning [[this one x2 on 1/18, x2 on 1/19]] > >> >> >> Event Source: WinMgmt > >> >> >> Event Category: None > >> >> >> Event ID: 5603 > >> >> >> Date: 1/18/2006 > >> >> >> Time: 2:26:15 PM > >> >> >> User: NT AUTHORITY\SYSTEM > >> >> >> Computer: NLA-65801-MJG > >> >> >> Description: > >> >> >> A provider, OffProv10, has been registered in the WMI namespace, > >> >> >> Root\MSAPPS10, but did not specify the HostingModel property. This > >> >> >> provider > >> >> >> will be run using the LocalSystem account. This account is > >> >> >> privileged > >> >> >> and > >> >> >> the provider may cause a security violation if it does not > >> >> >> correctly > >> >> >> impersonate user requests. Ensure that provider has been reviewed > >> >> >> for > >> >> >> security behavior and update the HostingModel property of the > >> >> >> provider > >> >> >> registration to an account with the least privileges possible for > >> >> >> the > >> >> >> required functionality. > >> >> >> > >> >> >> For more information, see Help and Support Center at > >> >> >> http://go.microsoft.com/fwlink/events.asp. > >> >> >> > >> >> >> xxxxxxxxx > >> >> >> > >> >> >> Event Type: Warning > >> >> >> Event Source: ASP.NET 1.1.4322.0 > >> >> >> Event Category: Setup > >> >> >> Event ID: 1020 > >> >> >> Date: 1/19/2006 > >> >> >> Time: 4:44:58 AM > >> >> >> User: N/A > >> >> >> Computer: NLA-65801-MJG > >> >> >> Description: > >> >> >> Updates to the IIS metabase were aborted because IIS is either not > >> >> >> installed > >> >> >> or is disabled on this machine. To configure ASP.NET to run in IIS, > >> >> >> please > >> >> >> install or enable IIS and re-register ASP.NET using > >> >> >> aspnet_regiis.exe > >> >> >> /i. > >> >> >> > >> >> >> For more information, see Help and Support Center at > >> >> >> http://go.microsoft.com/fwlink/events.asp. > >> >> >> > >> >> >> xxxxxxxxxx > >> >> >> > >> >> >> Event Type: Warning > >> >> >> Event Source: WinMgmt > >> >> >> Event Category: None > >> >> >> Event ID: 62 > >> >> >> Date: 1/19/2006 > >> >> >> Time: 4:46:36 AM > >> >> >> User: N/A > >> >> >> Computer: NLA-65801-MJG > >> >> >> Description: > >> >> >> WMI ADAP was unable to process the .NET CLR Data performance > >> >> >> library > >> >> >> since > >> >> >> one of the data blobs reported to have classes but had zero size
First
|
Prev
|
Pages: 1 2 Prev: Could not start the HTTP SSL service on local computer Next: Upload files to Server |