post sp1 ntfrs error

[Mike Lloyd-Jones]

Hi
Since upgrading to SBS SP1 standard (with all the pre-requisite steps
followed as per
MS and smallbizserver) we are getting the following error in system event
log overnight

Error 7011
Timeout (30000 milliseconds) waiting for transaction response from NtFRS
service

This seems to happen between 12 and 2 am, but nothing obvious running at
same time. Has definitely only started since service pack install, domain is
single server setup (does file replication service even need to be started?)

TIA
Mike

[Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP]]

Have you reviewed http://www.eventid.net for that code?

I've not seen that error.

Mike Lloyd-Jones wrote:

--
An open letter to the Security Community::
http://msmvps.com/bradley/archive/2004/12/12/23540.aspx

[Mike Lloyd-Jones]

EventId gives no real clues, and I haven't seen this one before either
Can file replication be disabled in a single server environment ? (no point
fixing this issue if ntfrs not needed I guess)

"Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP]" <sbra...@pacbell.net>
wrote in message news:%23u%23HoEie...@tk2msftngp13.phx.gbl...

[Marina Roos [SBS-MVP]]

HI Mike,

What kind of hard disks do you have?

--
Regards,

Marina Roos
Microsoft SBS-MVP
One of the Magical M&M's
www.smallbizserver.net
Take part in SBS forum:
http://www.smallbizserver.net/Default.aspx?tabid=53

"Mike Lloyd-Jones" <m_...@hotmail.com> schreef in bericht
news:O6RzYii...@TK2MSFTNGP14.phx.gbl...

[wedor]

Here is a piece of an old thread from the sbs newsgroup as a response to
this message.

Here is the source message link,

http://groups-beta.google.com/group/microsoft.public.windows.server.sbs/browse_thread/thread/889c0838e11fe62f/5af558f6c561fc0e?q=event+7011+ntfrs&rnum=2&hl=en#5af558f6c561fc0e

Jack,

My timeouts were not caused by antivirus software. I stopped the errors by
changing the autodisconnect for the LAN setting in the registry.
HKEY_LOCAL_MACHINE under the subkey:
\System\CurrentControlSet\Serv­ices\LanmanServer\Parameters

I set my Autodisconnect to ffffffff.

138365 - How Autodisconnect Works in Windows NT and Windows 2000:
http://support.microsoft.com/d­efault.aspx?scid=kb;en-us;1383­65

I was getting the errors several times a day until I changed this setting. I
have not received an error for 9 days!

Bill

"Mike Lloyd-Jones" <m_...@hotmail.com> wrote in message
news:%23VjVx9h...@TK2MSFTNGP12.phx.gbl...

[wedor]

Here is another old thread link to that issue,

http://groups-beta.google.com/group/microsoft.public.windows.server.general/browse_thread/thread/aeba536c46b2152e/188139aea457dd1b?q=event+7011+ntfrs&rnum=6&hl=en#188139aea457dd1b

"Mike Lloyd-Jones" <m_...@hotmail.com> wrote in message
news:%23VjVx9h...@TK2MSFTNGP12.phx.gbl...

[Gregg Hill]

Mike,

I have had the same error with my newly built server. Sometimes when I
access the server, the hard drive light comes on for up to 75 seconds and
the server hangs for that time period. Once the hard drive light goes off,
everything is fast. Event Viewer shows the same error you get.

I could most easily duplicate the error by using Remote Desktop form my
workstation to access the server. It seemed to be OK unless I used "mstsc
/console" to connect. Then it would hang almost every time.

My setup is:
SBS 2003 Premium, no premium components installed yet, everything at SP1,
using the latest drivers from the manufacturers for NIC, video, modem, etc
Intel Pentium 4 3.0GHz CPU
MSI 865PE Neo3 motherboard, latest BIOS
3GB Apacer PC3200 DDR400 RAM
80GB Western Digital SATA hard drive WD800JD (I wanted to see if SATA would
be fast so I do not have to spend three times as much for SCSI)
D-Link 10/100 NIC on WAN side, connected to Netgear FR114P router/firewall
On-board Realtek 8110S 10/100/1000 NIC for LAN
NVIDIA GeForce4 MX420 AGP video card
MultiTech Systems MT5634ZPX-PCI modem
Adaptec 39160 SCSI for the tape drive (Sony AIT1)
Veritas Backup Exec 10 SP1
Symantec Antivirus Corporate Edition 9.0.3.1000
Symantec Mail Security for Exchange 4.6

Digging through Google came up with the two links mentioned in this thread.
The first one mentions "autodisconnect" being changed. That did not help my
system. The second resolved their problem by re-installing. I want to know
the root cause before I re-install.

I also found
http://groups-beta.google.com/group/microsoft.public.windows.server.sbs/browse_frm/thread/8392029c190ae290/54ed1588bb11ba3c?q=C:\WINDOWS\ntfrs\jet\ntfrs&rnum=4&hl=en#54ed1588bb11ba3c
which suggested stopping the NTFRS service, deleting the database file,
excluding the folder from AV scans, and restarting the service. I did that
yesterday morning and so far, so good, but it has only been a day.

Someone else suggested excluding the SYSVOL folder from antivirus scans. I
am holding off on that to see if the above steps fix the problem, just so I
know for sure what is the root cause.

The biggest difference between my current system and my previous system are
3GB of RAM vs. 1GB in the old one, and the new hard drive is an 80GB SATA,
while the old one was an 80GB EIDE, both Western Digital. The old system
never had this error.

Gregg Hill

"Mike Lloyd-Jones" <m_...@hotmail.com> wrote in message

news:O6RzYii...@TK2MSFTNGP14.phx.gbl...

[Gregg Hill]

Dang! I spoke too soon. I had connected to my server via "mstsc /console"
just fine so that I could copy/paste some stuff between windows on the
workstation and server. I logged off, hit the KVM switch to go directly to
server, tried to log on, and got the long delay with the hard drive light
on.

Event Viewer showed the "Timeout (30000 milliseconds) waiting for a
transaction response from the NtFrs service" error in the system log, but
also had an Event ID 508 warning in the Directory Service log stating:

NTDS (1280) NTDSA: A request to write to the file "C:\WINDOWS\NTDS\edb.log"
at offset 5213184 (0x00000000004f8c00) for 512 (0x00000200) bytes succeeded,
but took an abnormally long time (65 seconds) to be serviced by the OS. This
problem is likely due to faulty hardware. Please contact your hardware
vendor for further assistance diagnosing the problem.

I wonder if SBS 2003 does not like SATA hard drives? My antivirus is already
set to exclude files with the .LOG extension, so that should not have been a
problem.

Gregg Hill

"Gregg Hill" <bo...@nowhere.com> wrote in message
news:eEaai%23meFH...@TK2MSFTNGP12.phx.gbl...

[Mike Lloyd-Jones]

Hi
Server is a Dell Poweredge 1600SC with SCSI U320 drives (Seagate
ST3146807LW)
All I can say for sure is that this issue has only started since SP1, no
other config changes have been made (apart from Dell Openmanage 4.4 being
installed)
Events seem to happen overnight, but outside of AV scan and backup times

"Marina Roos [SBS-MVP]" <mar...@roos.nodontwantspam.nl.com> wrote in message
news:uVVjUnie...@TK2MSFTNGP14.phx.gbl...

[Mike Lloyd-Jones]

Thanks - I'd already read these but I don't understand why SP1 install would
cause this issue?. I'd prefer to disable ntfrs rather than rebuild server if
indeed it can be disabled

<wedor> wrote in message news:%23MCZrpl...@TK2MSFTNGP15.phx.gbl...

[wedor]

SATA is NOT an issue in this case.

"Gregg Hill" <bo...@nowhere.com> wrote in message

news:%23MyESWn...@TK2MSFTNGP14.phx.gbl...

[Mike Lloyd-Jones]

Hi
Still haven't been able to work out what's causing this - if you do find a
solution could you drop me a mail pls - I'll do the same
My server is SCSI based, so HDD type probably isn't a factor. The only thing
i do know is that this has only started since SP1 !

"Gregg Hill" <bo...@nowhere.com> wrote in message

news:%23MyESWn...@TK2MSFTNGP14.phx.gbl...

[wedor]

I had this pop-up on one of my servers last night for the first time (I had
never seen one prior to this) I have not yet done the SP1 update on this
system so I don't think it is necessarily related but I have done every
other MS update to the system so maybe it is linked to one of them.

This is also a SCSI based system.

My error corresponded with the nightly back-up.

"Mike Lloyd-Jones" <m_...@hotmail.com> wrote in message

news:eODPdEIf...@tk2msftngp13.phx.gbl...