Event ID 2012 on Server 2008

[pinkpanther56]

I keep seeing this event ID in my 2008 server logs with the following message.

While transmitting or receiving data, the server encountered a network error. Occasional errors are expected, but large amounts of these indicate a possible error in your network configuration. The error status code is contained within the returned data (formatted as Words) and may point you towards the problem.

I see about 20 of these per day but the error says "Occasional errors are expected, but large amounts of these indicate a possible error in your network configuration" how many should I consider "large amounts"?

Our servers we're recently updated to 2008 from 2003 but the hardware is the same, one server is a physical HP DL140G3 and two others that show the error are VM's running on Xenserver on a Sun X4150 server.

Can anyone tell me if I should be worried about this I'm not noticing any specific problems on the network.

All servers run 2008 SP2 and are connected to a HP 2910 al switch.

Thanks.

 

[kmcferrin]

I would be looking at the switch for errors. Can you get some sort of logging/reporting on that switch?

________________________________________
CompTIA A+, Network+, Server+, Security+
MCTS:Windows 7
MCTS:Hyper-V
MCTS:System Center Virtual Machine Manager
MCSE:Security 2003
MCITP:Enterprise Administrator

 

[kmcferrin]

One other thought, are the machines that are seeing this error related? For example, is one a DB server that supports the others as Web/App servers? Is there a reason that they would all be communicating with each other a lot? If they do communicate with each other (as in an App/DB relationship) then one of them could be causing the error with the other two. I'm not very familiar with Xen at all, but I'm assuming that there is some sort of virtual switch configured on the Sun box that could cause issues too, in addition to the HP switch. I'm assuming that the Xen-appropriate virtual device drivers are all loaded.

________________________________________
CompTIA A+, Network+, Server+, Security+
MCTS:Windows 7
MCTS:Hyper-V
MCTS:System Center Virtual Machine Manager
MCSE:Security 2003
MCITP:Enterprise Administrator

 

[pinkpanther56]

I would be looking at the switch for errors. Can you get some sort of logging/reporting on that switch?

I'll take a look at the switch logs again, I looked a while back and didn't see any errors.

I'm not very familiar with Xen at all, but I'm assuming that there is some sort of virtual switch configured on the Sun box that could cause issues too, in addition to the HP switch. I'm assuming that the Xen-appropriate virtual device drivers are all loaded.

I had a Xen consultant inspect our setup after the rollout and they said everything was in order.
The Xen box uses a bonded NIC but the HP is just a standard single onboard NIC.

As for common services two servers are DC's and one is a fileserver, none of them run SQL or any extra services.

Thanks for the ideas.

 

[people3]

HI,

Long shot but i'm sure i read somewere about this error when running a Symantec product.

Cheers

 

[pinkpanther56]

I'll take a look into that thanks, we do use a Backup Exec agent on each of these servers, I'm currently investigating an odd ICMP error that appears in the security log during backups. It's possible they're related but we get the network errors at random times and not always during backup.

I could try uninstalling the agent at some point to see if that changes anything.

 

[itsp1965]

Is it possible your NICs are configured with TCP Offload enabled. This has been known to cause slowdowns.

 

[pinkpanther56]

itsp1965 are you refering to this?

http://www.windowsreference.com/networking/enabledisable-tcp-task-offloading-to-nic-in-windows/

If so can I alter the setting while the server is in use or should i wait for a maintenance window?


I'm not actually noticing any slowdown as far as I can tell.

 

[kmcferrin]

Is it possible your NICs are configured with TCP Offload enabled. This has been known to cause slowdowns.

That's ironic, but I've seen the same thing with TCP chimney on TOE cards too.

________________________________________
CompTIA A+, Network+, Server+, Security+
MCTS:Windows 7
MCTS:Hyper-V
MCTS:System Center Virtual Machine Manager
MCSE:Security 2003
MCITP:Enterprise Administrator

 

[pinkpanther56]

So is this something I can turn off to test?