Jump to content

Welcome to MSFN Forum
Register now to gain access to all of our features. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more. This message will be removed once you have signed in.
Login to Account Create an Account


Srv Event ID 2012 (network errors)

- - - - -

  • Please log in to reply
1 reply to this topic



    Kwisatz Haderach

  • Member
  • PipPip
  • 137 posts
  • Joined 26-July 06
  • OS:Windows 7 x64
Dear all,

I have one server environment which seems to be generating quite a lot of these events, mostly from Win2k3 SP2 machines:

Event Type:	Warning
Event Source:	Srv
Event Category:	None
Event ID:	2012
Date:		27/08/2011
Time:		07:05:25
User:		N/A
Computer:	WIN2K3WEB
While transmitting or receiving data, the server encountered a network error. Occassional errors are expected, but large amounts of these indicate a possible error in your network configuration.  The error status code is contained within the returned data (formatted as Words) and may point you towards the problem.

0000: 00040000 00540001 00000000 800007dc
0010: 00000000 c0000184 00000000 00000000
0020: 00000000 00000000 0000097b

I'm 99% sure this is down to some Riverbed CIFS devices, which are making it appear that a connection is still open for business when it has in fact already been closed at the remote end.

Anyhow - I know that the c0000184 signified STATUS_INVALID_DEVICE_STATE, and I've worked out that 800007dc actually just means 'this is event ID 2012'.

What I'm wondering about is what the 00040000 00540001, and the 0000097b mean. Sometimes, instead of 0000097b, it is 0000097a. This doesn't appear to be a Win32 error code, and it looks nothing like an HRESULT or NTSTATUS value.

Any pointers on what these values mean?



How to remove advertisement from MSFN



    Gustatus similis pullus

  • Supervisor
  • 11,252 posts
  • Joined 09-September 01
  • OS:Windows 8.1 x64
  • Country: Country Flag
The eventcode for this error is c0000184 as per your output, which you've already seen. This generally means that the driver has responded to the requesting IRP that a send request has been made on a pre-existing request built that is either not ready to send, or has already passed a state that it can be in to send. Note the other codes don't actually mean anything useful in this particular instance, so you don't have to continue to bang your head against the wall for those.

Generally you see 2012s due to antivirus software that contains a network filter driver, a bad network driver (or teaming software driver), or external acceleration hardware. Assuming you can reproduce this on other switch ports with other machines making the same sorts of requests for the same data, you can at least rule out the machines and software on them (hopefully you can do this - if not, you might want to consider it in troubleshooting). Next, assuming you have forced speed and duplex on the NICs in your servers or clients seeing these 2012s to match the switch ports, that generally rules out the cabling and the autosense fabric. That leaves switch backplane or WAN accelerators.
MCTS Windows Internals, MCITP Server 2008 EA, MCTS MDT/BDD, MCSE/MCSA Server 2003, Server 2012, Windows 8
Please read the rules before posting!
Please consider donating to MSFN to keep it up and running!

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users