WINS could not come up due to missing/corrupt database. - Consolidate events

WINS_could_not_come_up_due_to_missing_corrupt_database.___Consolidate_events_1_Rule (Rule)

Knowledge Base article:

Management Pack
Summary
This event can occur if the WINS database is not running because of a corrupt, missing, or renamed Wins.mdb file.

The file should be located in the %SystemRoot%\System32\Wins folder.

If there is insufficient privilege to the WINS directory or files, this event may also occur at service startup. See Microsoft Knowledge Base Article Q158865 for more details.

 
Resolutions
If the database is determined to be corrupt, you will probably need to restore from your most recent backup. To do so, use the WINS Manager. Detailed instruction are given in Microsoft Knowledge Base article Q205100.
 
External Knowledge Sources
Microsoft Knowledge Base Article: Q162778
WINS May Report Database Corruption w/ More Than 100 Owners

Microsoft Knowledge Base Article Q158865
WINS Fails to Start After Changing File Permissions

Microsoft Knowledge Base
Search for articles about WINS event 4224

Microsoft Knowledge Base
Search for articles about WINS events in general

 
Sample Event
Windows 2000 message text:
WINS could not start due to a missing or corrupt database. Restore the database using WINS Manager (or winscl.exe found in the Windows 2000 Resource Kit) and restart WINS. If WINS still does not start, begin with a fresh copy of the database. To do this: 1) Delete all the files in the %%SystemRoot%%\system32\WINS directory. NOTE: If the WINS database file (typically named wins.mdb) is not in the above directory, check the registry for the full filepath. Delete the .mdb file. NOTE: If jet*.log are not in the above directory, check the registry for the directory path. Delete all log files 2) Restart WINS.

Windows NT 4.0 message text:
WINS could not come up due to missing/corrupt database. Restore the database using WINS Manager or winscl.exe (in the res kit) and then restart WINS. If WINS still does not come up, start with a fresh copy of the database. To do this: 1) delete all the files in the %%SystemRoot%%\system32\wins directory Note: if wins database file (typically named wins.mdb) is not in the above directory, check the registry for the full filepath. Delete the .mdb file. Note: if jet*.log are not in the above directory, check the registry for the directory path. Delete all log files 2) net start wins Please click on OK to terminate WINS.

 
Related Events
WINS event 4224
 
Other Information
This particular event can cause an "event flood" because whenever the WINS database is not available, it potentially affects a large number of machines, each of which generates an event indicating that it, along with all the others, cannot communicate with the WINS DB.

Under these circumstances, getting an alert from each machine having a WINS communication problem is probably not productive. Therefore this rule consolidates all these events. It counts how many events occur in the specified period of time (default is 3600 seconds (1 hour)). If the "threshold" (default is 5000 events) specified in the associated alert rule for this event is reached, a single alert will be sent.

You can adjust the period of time over which these events are consolidated. Increasing the number of seconds makes it more likely that the threshold configured in the associated alert rule will be met. Decreasing the number makes it less likely. Adjust both values to tune this alert to your network.

 
© 1995-2001 Microsoft Corporation, all rights reserved.

Element properties:

TargetMicrosoft.Windows.Server.InternetNamingService.Windows_2000_and_2003_WINS_Servers_Installation
CategoryEventCollection
EnabledTrue
Event_ID4318
Event SourceWINS
Alert GenerateFalse
RemotableTrue
Event LogSystem
CommentMom2005ID='{C38A3C24-9B9F-11D3-8816-0090270D4908}';MOM2005ComputerGroupID={ADC4E3A5-6D50-11D3-8803-0090270D4908}

Member Modules:

ID Module Type TypeId RunAs 
_907D4578_146C_11D3_AB21_00A0C98620CE_ DataSource Microsoft.Windows.EventProvider Default
ConsolidatedEventWriteAction WriteAction System.Mom.BackwardCompatibility.ConsolidatedEventResponse Default

Source Code:

<Rule ID="WINS_could_not_come_up_due_to_missing_corrupt_database.___Consolidate_events_1_Rule" Target="Microsoft.Windows.Server.InternetNamingService.Windows_2000_and_2003_WINS_Servers_Installation" Enabled="true" ConfirmDelivery="true" Comment="Mom2005ID='{C38A3C24-9B9F-11D3-8816-0090270D4908}';MOM2005ComputerGroupID={ADC4E3A5-6D50-11D3-8803-0090270D4908}">
<Category>EventCollection</Category>
<DataSources>
<DataSource ID="_907D4578_146C_11D3_AB21_00A0C98620CE_" Comment="{907D4578-146C-11D3-AB21-00A0C98620CE}" TypeID="WindowsLibrary!Microsoft.Windows.EventProvider">
<ComputerName>$Target/Host/Property[Type="WindowsLibrary!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>
<LogName>System</LogName>
<Expression>
<And>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="Integer">EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>4318</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="String">PublisherName</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>WINS</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="String">Channel</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>System</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</And>
</Expression>
</DataSource>
</DataSources>
<WriteActions>
<WriteAction ID="ConsolidatedEventWriteAction" TypeID="MomBackwardCompatibility!System.Mom.BackwardCompatibility.ConsolidatedEventResponse">
<ConsolidationProperties>
<PropertyXPathQuery>EventDisplayNumber</PropertyXPathQuery>
<PropertyXPathQuery>PublisherName</PropertyXPathQuery>
<PropertyXPathQuery>$Target/Host/Property[Type="WindowsLibrary!Microsoft.Windows.Computer"]/NetbiosComputerName$</PropertyXPathQuery>
<PropertyXPathQuery>$Target/Host/Property[Type="WindowsLibrary!Microsoft.Windows.Computer"]/NetbiosDomainName$</PropertyXPathQuery>
</ConsolidationProperties>
<Interval>3600</Interval>
</WriteAction>
</WriteActions>
</Rule>