RE: [ActiveDir] Any oppinions about LDAP warning 1216 - error situation 995

[joe]

Title: Any oppinions about LDAP warning 1216 - error situation 995

Well the description for error 995 is

 

"The I/O operation has been aborted because of either a thread exit or an application request."

 

The c06028b tells MS where in the source code the failure is occurring at in case they need to chase source code to figure it out. You actually should specify the OS and SP level for that to really be useful as line numbers can change in the various versions of the OS. I would start with a guess this is W2K SP3/4. If that is the case this error is being thrown from the section of code used for reading/writing to TCP/IP connections. You could pretty much probably figure that from the error message above. At a guess it would seem the connection between the client and DC has broken, whether intentional or not I don't know if, nor think, that can be ascertained from the message. I expect the second part of the internal code is the internal client ID that the connection was broken for.

 

I would tend to wonder how "bad" this is based on the fact that you had to crank up your logging level. If they were very serious, I expect they would show up at lower levels. I guess it could, if you have a lot of them - like hundreds or thousands, mean you have some network connectivity issues.

 

I am sure ~Eric will be along with some more in depth info.

 

  joe

---

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Pete Procenko
Sent: Sunday, January 09, 2005 6:20 AM
To: ActiveDir@mail.activedir.org
Subject: [ActiveDir] Any oppinions about LDAP warning 1216 - error situation 995

Hello!

After turning on AD LDAP events logging to level 5 got a bunch of LDAP warnings 1216 like this

Тип события:    Предупреждение
Источник события:       NTDS LDAP
Категория события:      (16)
Код события:    1216
Дата:           09.01.2005
Время:          14:02:21
Пользователь:           Нет данных
Компьютер:      MAINDC
Описание:
Сервер LDAP закрыл сокет для клиента из-за ошибочной ситуации, 995.  (внутренний код c06028b::9085).

(Decription in english - The LDAP server has closed socket for client because of error situation 995 (internal code c06028b::9085)

The right part of internal code - 9085 in this case - may differ, but the left one always the same - c06028b.

This events are logged about 8-15 times per hour, there are successfully connection attempts too.

Found some references about  LDAP warning with id 1216 at microsoft 's site, but the error situation was different.
There is an assumption, that it is related to exchange2000 ldap requests, about a year ago we had a main forest DC crush, but since then we did not get any exchange issues. This event is logged after connection attempt from our exchange server, but on exchange's side we dont have any errors. Any oppinions are welcome

     Pete. 

List info : http://www.activedir.org/mail_list.htm List FAQ : http://www.activedir.org/list_faq.htm List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/