Receiving CI Service Event 4149 & App Popup Event 333 on Win2k3 SP

I have a Win2k3 SP2 server, which is receiving a CI Service Event ID 4149
error in the Application Log approx 15-30 minutes after a reboot, and also
NetLogon Event ID 5719 in the System Log at approx the same time, followed by
continual Application Popup Event ID 333 errors in the System Log for all
hard drives until the server is restarted.

I can ping, remotely manage and also sometimes RDP to the server (other
times I can get the RDP to the logon screen, but once credentials are
accepted it gives an error regarding RDP not being available, and
disconnects.)

The above CI Service error generally occurs approx 8 minutes after the CI
Service has started. No other Application Service entries are logged in the
Application Log between them. The only entries in the System log between the
start of the CI Service & the CI Service occuring is the NetLogon error
mentioned above, which is approx the same time the CI Service error occurs.

During logon (at the console normally) I then get UserEnv Event IDs 1508,
1502, 1515, 1511, 1109, 1058 & 1030.

The server has 2 CPU's, 3.6Gb RAM (its running on top of a VMware
virtualised environment with the vmdk's located on a SAN) and 3 drive volumes.

The server has MS SQL 2000 installed, although I cannot locate any direct
link between SQL and the issue occuring.

None of our other virtualised servers are experiencing this issue.

To date I have done the following in an attempt to resolve the issue:
Added /3GB to the boot.ini file
Followed and applied KB312362
Verified page file is approx 1.5 time physical (currently set to 5072Mb).

I know that the issue has been occuring since the 21st Dec 08, as our backup
software has been reporting VSS backup errors since that date, and are still
occuring today, I believe due to the . However, as the System & Application
logs are only lasting a couple of days due to the errors being logged, I
cannot determine what was done to the server on or just before the 21st Dec
(my company had a change freeze on all systems over Christmas, starting 2
weeks before Christmas), as I believe the VSS backup issue is associated to
the cause behind the Application Popup Event Id 333 that is being continually
reported.

If anyone has come across this issue before, or may have some suggestions I
would appreciate it.

I'd try searching those events at http://eventid.net/


--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect


"Wez" wrote:
>I have a Win2k3 SP2 server, which is receiving a CI Service Event ID 4149
> error in the Application Log approx 15-30 minutes after a reboot, and also
> NetLogon Event ID 5719 in the System Log at approx the same time, followed
> by
> continual Application Popup Event ID 333 errors in the System Log for all
> hard drives until the server is restarted.
>
> I can ping, remotely manage and also sometimes RDP to the server (other
> times I can get the RDP to the logon screen, but once credentials are
> accepted it gives an error regarding RDP not being available, and
> disconnects.)
>
> The above CI Service error generally occurs approx 8 minutes after the CI
> Service has started. No other Application Service entries are logged in
> the
> Application Log between them. The only entries in the System log between
> the
> start of the CI Service & the CI Service occuring is the NetLogon error
> mentioned above, which is approx the same time the CI Service error
> occurs.
>
> During logon (at the console normally) I then get UserEnv Event IDs 1508,
> 1502, 1515, 1511, 1109, 1058 & 1030.
>
> The server has 2 CPU's, 3.6Gb RAM (its running on top of a VMware
> virtualised environment with the vmdk's located on a SAN) and 3 drive
> volumes.
>
> The server has MS SQL 2000 installed, although I cannot locate any direct
> link between SQL and the issue occuring.
>
> None of our other virtualised servers are experiencing this issue.
>
> To date I have done the following in an attempt to resolve the issue:
> Added /3GB to the boot.ini file
> Followed and applied KB312362
> Verified page file is approx 1.5 time physical (currently set to 5072Mb).
>
> I know that the issue has been occuring since the 21st Dec 08, as our
> backup
> software has been reporting VSS backup errors since that date, and are
> still
> occuring today, I believe due to the . However, as the System &
> Application
> logs are only lasting a couple of days due to the errors being logged, I
> cannot determine what was done to the server on or just before the 21st
> Dec
> (my company had a change freeze on all systems over Christmas, starting 2
> weeks before Christmas), as I believe the VSS backup issue is associated
> to
> the cause behind the Application Popup Event Id 333 that is being
> continually
> reported.
>
> If anyone has come across this issue before, or may have some suggestions
> I
> would appreciate it.

Thanks Dave.

I've checked eventid.net for the App PopUp 333 error, and most answers to it
are not applicable, as they are in reference to TCPIP issues for SP1. The
server has SP2, and a newer version of the mentioned DLL then the update
linked from the page.

As for the other error codes, I honestly haven't dug as far on eventid.net
with them, which I'll go do now.

Regards,
Wez.

"Dave Patrick" wrote:

> I'd try searching those events at http://eventid.net/
>
>
> --
>
> Regards,
>
> Dave Patrick ....Please no email replies - reply in newsgroup.
> Microsoft Certified Professional
> Microsoft MVP [Windows]
> http://www.microsoft.com/protect

Might be an indexing catalog was created for some drive or directory that
the system account doesn't have access to.

Computer Management|Services|Indexing Service



--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect


"Wez" wrote:
> Thanks Dave.
>
> I've checked eventid.net for the App PopUp 333 error, and most answers to
> it
> are not applicable, as they are in reference to TCPIP issues for SP1. The
> server has SP2, and a newer version of the mentioned DLL then the update
> linked from the page.
>
> As for the other error codes, I honestly haven't dug as far on eventid.net
> with them, which I'll go do now.
>
> Regards,
> Wez.

Dave,

After re-reading the eventid.net notes on the Application Popup eventid
(333), I've done a temp test of changing the SQL Memory configuration
settings as per the recommendation from Eugen Munteanu.

After restarting the server, and waiting for 30 mins, we noted that the
errors didnt reoccur. We are going to wait overnight and see what happens.

Regards,
Wez

"Dave Patrick" wrote:

> Might be an indexing catalog was created for some drive or directory that
> the system account doesn't have access to.
>
> Computer Management|Services|Indexing Service
>
>
>
> --
>
> Regards,
>
> Dave Patrick ....Please no email replies - reply in newsgroup.
> Microsoft Certified Professional
> Microsoft MVP [Windows]
> http://www.microsoft.com/protect
>
>
> "Wez" wrote:
> > Thanks Dave.
> >
> > I've checked eventid.net for the App PopUp 333 error, and most answers to
> > it
> > are not applicable, as they are in reference to TCPIP issues for SP1. The
> > server has SP2, and a newer version of the mentioned DLL then the update
> > linked from the page.
> >
> > As for the other error codes, I honestly haven't dug as far on eventid.net
> > with them, which I'll go do now.
> >
> > Regards,
> > Wez.
>
>

Sounds good.



--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect


"Wez" wrote:
> Dave,
>
> After re-reading the eventid.net notes on the Application Popup eventid
> (333), I've done a temp test of changing the SQL Memory configuration
> settings as per the recommendation from Eugen Munteanu.
>
> After restarting the server, and waiting for 30 mins, we noted that the
> errors didnt reoccur. We are going to wait overnight and see what happens.
>
> Regards,
> Wez

Performing the SQL memory change definitely appears to have fixed it, as 18
hours later and still no errors, considering we were getting it within the
first 30 minutes...

I guess I'll be passing this back to my DBA's to investigate further as to
why their SQL memory config was causing the issue.

"Dave Patrick" wrote:

> Sounds good.
>
>
>
> --
>
> Regards,
>
> Dave Patrick ....Please no email replies - reply in newsgroup.
> Microsoft Certified Professional
> Microsoft MVP [Windows]
> http://www.microsoft.com/protect
>
>
> "Wez" wrote:
> > Dave,
> >
> > After re-reading the eventid.net notes on the Application Popup eventid
> > (333), I've done a temp test of changing the SQL Memory configuration
> > settings as per the recommendation from Eugen Munteanu.
> >
> > After restarting the server, and waiting for 30 mins, we noted that the
> > errors didnt reoccur. We are going to wait overnight and see what happens.
> >
> > Regards,
> > Wez
>
>

That's interesting. I wouldn't have guessed that. Thanks for letting us know
what worked.



--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect


"Wez" wrote:
> Dave,
>
> After re-reading the eventid.net notes on the Application Popup eventid
> (333), I've done a temp test of changing the SQL Memory configuration
> settings as per the recommendation from Eugen Munteanu.
>
> After restarting the server, and waiting for 30 mins, we noted that the
> errors didnt reoccur. We are going to wait overnight and see what happens.
>
> Regards,
> Wez