Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

The following event floods the log pretty harshly, pushing out other important events from the record. Is there any way to determine from the data which service is failing?

Event Type: Error
Event Source:   Srv
Event Category: None
Event ID:   2000
Date:       7/28/2010
Time:       4:17:43 PM
User:       N/A
Computer:   COMPUTERNAME
Description:
The server's call to a system service failed unexpectedly.

For more information, see Help and Support Center 
at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00040000 00540001 00000000 c00007d0
0010: 00000000 c000010a 00000000 00000000
0020: 00000000 00000000 00bd0334
share|improve this question

2 Answers 2

This is typically a sign of kernel memory exhaustion (that link is from an Exchange-related support article, but the error you're referencing and that is mentioned in the article isn't actually Exchange-specific).

If the server runs for awhile after a reboot w/o generating this error then you've probably got a memory leak scenario occurring. I'd consider using PoolMon.exe to attempt to determine where your kernel memory is going if it appears to be leaking.

Do your users have exceptionally large numbers of group memberships? You could be exhausting kernel memory with large security tokens if they do.

share|improve this answer
    
No, we do have an exceptionally large number of local users though. –  jldugger Jul 29 '10 at 18:24

The server service is reporting that it couldn't respond to an application request: line 0010, byte 2 ( in this case c000010a) is the first error code- in this case "STATUS_PROCESS_IS_TERMINATING" means that a program tried to terminate a process but the process was already being terminated.

This could be any number of things that could have this including an SMB attack. Make sure that you are at least on SP1 for 2003

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.