Socket operation failure

Socket_operation_failure_2_1_Rule (Rule)

Knowledge Base article:

Management Pack

Summary

One of the components of the Network Address Translation (NAT) protocol encountered an error in a socket operation.

 

Causes

The most common reasons for this warning are:

1.     The connection has been dropped, because of a network failure or because the system on the other end is not responding.

2.     The network subsystem has failed.

3.     The Windows Socket Implementation was unable to allocate the needed resources for its internal operation.

 

Resolutions

1.     If the server is low on memory, take appropriate action to increase the available memory. See Help and Support Center for information on low memory.

2.     Verify network connectivity between the peer routers, and confirm that the remote router is operating normally.

3.     Stop and restart the Routing and Remote Access service.

4.     If the problem persists, restart the computer.

 

Sample Event

Sample Event#1: The DHCP allocator encountered a network error while attempting to detect existing DHCP servers on the network of the interface with IP address %1.The data is the error code.
Sample Event#2: The DHCP allocator encountered a network error while attempting to receive messages on the interface with IP address %1.The data is the error code.
Sample Event#3: The DNS proxy agent encountered a network error while attempting to receive messages on the interface with IP address %1.The data is the error code.
Sample Event#4: The DNS proxy agent encountered a network error while attempting to forward a response to a client from a name-resolution server on the interface with IP address %1.The data is the error code.
Sample Event#5: The DNS proxy agent encountered a network error while attempting to forward a query from the client %1 to the server %2on the interface with IP address %3.The data is the error code.

 

© 2004 Microsoft Corporation, all rights reserved.

 

Element properties:

TargetMicrosoft.Windows.Server.RRAS.2008.Server
CategoryEventCollection
EnabledTrue
Alert GenerateFalse
RemotableTrue
Event LogSystem

Member Modules:

ID Module Type TypeId RunAs 
DS DataSource Microsoft.Windows.EventProvider Default
WriteToDB WriteAction Microsoft.SystemCenter.CollectEvent Default

Source Code:

<Rule ID="Socket_operation_failure_2_1_Rule" Enabled="true" Target="Microsoft.Windows.Server.RRAS.2008.Server" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">
<Category>EventCollection</Category>
<DataSources>
<DataSource ID="DS" TypeID="Windows!Microsoft.Windows.EventProvider">
<ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>
<LogName>System</LogName>
<Expression>
<And>
<Expression>
<RegExExpression>
<ValueExpression>
<XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>MatchesRegularExpression</Operator>
<Pattern>^(30006|30011|31003|31005|31006)$</Pattern>
</RegExExpression>
</Expression>
<Expression>
<RegExExpression>
<ValueExpression>
<XPathQuery Type="String">PublisherName</XPathQuery>
</ValueExpression>
<Operator>MatchesRegularExpression</Operator>
<Pattern>SharedAccess_NAT|ipnathlp</Pattern>
</RegExExpression>
</Expression>
</And>
</Expression>
</DataSource>
</DataSources>
<WriteActions>
<WriteAction ID="WriteToDB" TypeID="SC!Microsoft.SystemCenter.CollectEvent"/>
</WriteActions>
</Rule>