Hemant's Blogs

Wednesday, June 26, 2013

Faulting application name: CcmExec.exe, version: 4.0.6221.1000, timestamp: 0x 339 6 Faulting module name: ntdll.dll, version:6.1.7601.17725, time stamp: 0x c4 8f

Ccmexec.exe refers to CCM Executive and operates as a component of the Microsoft SMS Agent Host for Microsoft Systems Management Server which handles Change and Configuration Management utility.

The error I was getting :


Log Name: Application
Source: Application Error
Date: x/xx/xxx xx:xx:xx xM
Event ID: 1000
Task Category: (100)
Level: Error
Keywords: Classic
User: N/A
Computer: xxxxxxx
Description:
Faulting application name: CcmExec.exe, version: 4.0.6221.1000, time stamp: 0x 339 6
Faulting module name: ntdll.dll, version: 6.1.7601.17725, time stamp: 0x c4 8f
Exception code: 0xc0000005
Fault offset: 0x0009ce74
Faulting process id: 0xbf8
Faulting application start time: 0x01 5e9 49 2bc
Faulting application path: C:\Windows\SysWOW64\CCM\CcmExec.exe
Faulting module path: C:\Windows\SysWOW64\ntdll.dll
Report Id: 59e021fb-dd92-11e2-bf93-0050568d00ab
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Application Error" />
<EventID Qualifiers="0">1000</EventID>
<Level>2</Level>
<Task>100</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2013-06-25T12:25:42.000000000Z" />
<EventRecordID>2732038</EventRecordID>
<Channel>Application</Channel>
<Computer>MIA32132WWW004.managed.cln</Computer>
<Security />
</System>
<EventData>
<Data>CcmExec.exe</Data>
<Data>4.0.6221.1000</Data>
<Data>48339246</Data>
<Data>ntdll.dll</Data>
<Data>6.1.7601.17725</Data>
<Data>4ec49b8f</Data>
<Data>c0000005</Data>
<Data>0009ce74</Data>
<Data>bf8</Data>
<Data>01ce5e9fb49ec2bc</Data>
<Data>C:\Windows\SysWOW64\CCM\CcmExec.exe</Data>
<Data>C:\Windows\SysWOW64\ntdll.dll</Data>
<Data>59e021fb-dd92-11e2-bf93-0050568d00ab</Data>
</EventData>
</Event>

Tuesday, June 25, 2013

Monitor traffic b/w SQL server and front end

I want to monitor SQL traffic b/w Front End and SQL server. What could be the best approach for this ?

Reason :

In our uls logs , we are getting message :

Process : OWSTIMER.EXE (_x-_-_)
Thread ID : _x-_-_
Area : SharePoint Foundation
Category : Database
Event ID : f-_-
Level : Monitorable

Message :

A large block of literal text was sent to sql. This can result in blocking in sql and excessive memory use on the front end. Verify that no binary parameters are being passed as literals, and consider breaking up batches into smaller components. If this request is for a SharePoint list or list item, you may be able to resolve this by reducing the number of fields.

QL Profiler:

Question : Thread was being aborted : PerfmonInstanceIncrement

In our uls logs , we are getting message :

Process : w3wp.exe (_x-_-_)
Thread ID : _x_-_-
Area : SharePoint Server
Category : General
Event ID : 7-_-
Level : Warning

Message :

A runtime exception was detected. Details follow. Message: Thread was being aborted. Technical Details: System.Threading.ThreadAbortException: Thread was being aborted. at Microsoft.Office.Server.Diagnostics.ULS.NativeMethods.DoPerfmonInstance(Int32 instanceHandle, UInt32 pcid, Int64 lValue, PerfmonAction pcvo) at Microsoft.Office.Server.Diagnostics.ULS.PerfmonInstanceIncrement(Int32 instanceHandle, PCIDBase pcid, Int64 value)

Please help us identify the root cause and resolution for this .

We have also updated SPWebService.CollectSPRequestAllocationCallStacks property

You may also like:

Question : Memory Leak : Microsoft.SharePoint.SPRequestManager.GetContextRequest(SPRequestAuthenticationMode authenticationMode)

Question: The backing-file for the real-time session “WDC.BE95A9B1-DE15-4B78-B923-A12AB70BE951” has reached…

MOSS 2007 Troubleshooting Guide

Question : what is arpirowupdater.hxx ?

Question : what is merge.cxx ?

Monday, June 24, 2013

The COM+ System Application service entered the running state.

The COM+ System Application service manages the configuration and tracking of COM+ based components. If this service stops, most COM+ based components do not function properly. The Volume Shadow Copy Service, which is needed for Windows Backup and backup applications that rely on the Windows Backup API, requires this service.
This service is installed and enabled by default.


Log Name: System
Source: Service Control Manager
Date: x/xx/xxx xx:xx:xx xM
Event ID: 7036
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: xxxxxxx
Description:
The COM+ System Application service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Service Control Manager" Guid=”{xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx12f4}" EventSourceName="Service Control Manager" />
<EventID Qualifiers="16384">7036</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8080000000000000</Keywords>
<TimeCreated SystemTime=”xxxx-xx-xxTxx:xx:xx.xxxxxxxxxZ” />
<EventRecordID>xxxxxx1</EventRecordID>
<Correlation />
<Execution ProcessID="508" ThreadID="7864" />
<Channel>System</Channel>
<Computer>xxxx</Computer>
<Security />
</System>
<EventData>
<Data Name="param1">COM+ System Application</Data>
<Data Name="param2">running</Data>
<Binary>xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx</Binary>
</EventData>
</Event>

References :
Consequences of having Com+ System Application Disabled <http://communities.vmware.com/thread/238146?start=0&tstart=0>
http://technet.microsoft.com/en-us/library/dd349799(v=ws.10).aspx
http://technet.microsoft.com/en-us/library/cc781785(v=ws.10).aspx
http://social.technet.microsoft.com/Forums/windowsserver/en-US/107c8ab2-3057-4034-acf9-0179804b5aab/com-system-application-service-will-not-start-server-2008-r2

When COM+ System Application Service Start on my machine , the system becomes faster . Do you have some idea why this happens ?

You may also like:

MOSS 2007 Troubleshooting Guide

Question : Memory Leak : Microsoft.SharePoint.SPRequestManager.GetContextRequest(SPRequestAuthenticationMode authenticationMode)

The service did not respond to the start or control…

Include specific folder content in BlobCache SharePoint

Search – One or more property databases have fragmented indices.

Best practices for Blob cache

Question: The backing-file for the real-time session “WDC.BE95A9B1-DE15-4B78-B923-A12AB70BE951” has reached…

Sunday, June 23, 2013

The application-specific permission settings do not grant Local Launchpermission for the COM Server application with CLSID

The Network Access Protection (NAP) Agent is the primary service that allows a computer to function as a NAP client. The NAP Agent service is responsible for gathering client health data from the installed system health agents (SHAs) and forwarding that information to NAP enforcement clients for evaluation.

Network Access Protection (NAP) Agent error I am getting :


Log Name: System
Source: Microsoft-Windows-DistributedCOM
Date: x/xx/xxx xx:xx:xx xM
Event ID: 10016
Task Category: None
Level: Error
Keywords: Classic
User: SYSTEM
Computer: xxxxxxx
Description:
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID
{xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxFF48}
and APPID
{xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx9BA1} NAP Agent Service ( Component Services > Computers > My Computer > DCOM Config > NAP Agent Service )
to the user NT AUTHORITY\SYSTEM SID (x-x-x-xx) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-DistributedCOM" Guid="{xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx407E}" EventSourceName="DCOM" />
<EventID Qualifiers="49152">10016</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime=”xxxx-xx-xxTxx:xx:xx.xxxxxxxxxZ” />
<EventRecordID>2304965</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>System</Channel>
<Computer>xxxx</Computer>
<Security UserID="x-x-x-xx" />
</System>
<EventData>
<Data Name="param1">application-specific</Data>
<Data Name="param2">Local</Data>
<Data Name="param3">Launch</Data>
<Data Name="param4">{xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxFF48}</Data>
<Data Name="param5">{xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx9BA1}</Data>
<Data Name="param6">NT AUTHORITY</Data>
<Data Name="param7">SYSTEM</Data>
<Data Name="param8">x-x-x-xx</Data>
<Data Name="param9">LocalHost (Using LRPC)</Data>
</EventData>
</Event>

References :
http://technet.microsoft.com/en-us/library/cc735503(v=ws.10).aspx
http://social.technet.microsoft.com/Forums/systemcenter/en-US/dfc465bc-7bbd-483e-b98b-2ba56fa98313/the-applicationspecific-permission-settings-do-not-grant-local-launch-permission-for-the-com-server

You may also like:

MOSS 2007 Troubleshooting Guide

The COM+ System Application service entered the running state.

The following fatal alert was generated: 10. The internal error state is 1203.

Log Name: System
Source: Schannel
Date: x/xx/xxx xx:xx:xx xM
Event ID: 36888
Task Category: None
Level: Error
Keywords:
User: SYSTEM
Computer: xxxxxxx
Description:
The following fatal alert was generated: 10. The internal error state is 1203.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Schannel" Guid="{xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx5C85}" />
<EventID>36888</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="xxxx-xx-xxTxx:xx:xx.xxxxxxxxxZ" />
<EventRecordID>xxxxxx9</EventRecordID>
<Correlation />
<Execution ProcessID="xxx" ThreadID="xxxx" />
<Channel>System</Channel>
<Computer>xxxx</Computer>
<Security UserID="Sx-x-x-xx" />
</System>
<EventData>
<Data Name="AlertDesc">10</Data>
<Data Name="ErrorState">1203</Data>
</EventData>
</Event>
Resolution : How to enable Schannel event logging in IIS < http://support.microsoft.com/kb/260729 >

Related :

What's New in TLS/SSL (Schannel SSP) <http://technet.microsoft.com/en-us/library/hh831771.aspx>
SSL/TLS communication problems after you install KB 931125<http://support.microsoft.com/kb/2801679>

Saturday, June 22, 2013

Question: The backing-file for the real-time session "WDC.BE95A9B1-DE15-4B78-B923-A12AB70BE951" has reached its maximum size.

Under eventvwr we are getting this message. Please help.

The backing-file for the real-time session "WDC.BE95A9B1-DE15-4B78-B923-A12AB70BE951" has reached its maximum size.