.NET Questions and Solutions

Symptoms
Consider the following scenario: A printer is shared on a computer that is running one of the following:Windows XPWindows Server 2003Windows VistaWindows Server 2008 The “Keep printed documents” option is enabled in the Properties dialog box of the shared printer.Some print jobs stay in the print queue after they are printed.You right-click one of the print jobs and then click Restart to resubmit the print job.In this scenario, the handle count of the print spooler service increases by 1. If the print queue is under heavy stress, the handle count of the print spooler service keeps increasing. Finally, the system may stop responding or crash. Or, another unexpected behavior may occur becausethe resources are exhausted.
Resolution
When a print job is restarted in a print queue, the print spooler service has to create a new EVENT object forsynchronization purposes. However, the print spooler service cannot release a previously created EVENT object before the service creates the new EVENT object. Therefore, a handle leak occurs in the print spooler service.

Symptoms
When an unhandled exception is thrown in a Microsoft ASP.NET-based application that is built on the Microsoft .NET Framework 2.0, the application unexpectedly quits. When this problem occurs, no exception information that you must have to understanding the issue is logged in the Application log.
However, an event message that is similar to the following may be logged in the System log:
Event Type: Warning
Event Source: W3SVC
Event Category: None
Event ID: 1009
Date: 9/28/2005
Time: 3:18:11
PM User: N/A
Computer: IIS-SERVER
Description:
A process serving application pool ‘DefaultAppPool’ terminated unexpectedly. The process id was ‘2548’. The process exit code was ‘0xe0434f4d’. Additionally, an event message that is similar to the following may be logged in the Application log:
Event Type: Error
Event Source: .NET Runtime 2.0 Error Reporting
Event Category: None
Event ID: 5000
Date: 9/28/2005
Time: 3:18:02 PM
User: N/A
Computer: IIS-SERVER
Description:
EventType clr20r3, P1 w3wp.exe, P2 6.0.3790.1830, P3 42435be1, P4 app_web_7437ep-9, P5 0.0.0.0, P6 433b1670, P7 9, P8 a, P9 system.exception, P10 NIL.
Resolution
This problem occurs because the default policy for unhandled exceptions has changed in the .NET Framework 2.0. By default, the policy for unhandled exceptions is to end the worker process.
In the Microsoft .NET Framework 1.1 and in the Microsoft .NET Framework 1.0, unhandled exceptions on managed threads were ignored. Unless you attached a debugger to catch the exception, you would not realize that anything was wrong.
ASP.NET uses the default policy for unhandled exceptions in the .NET Framework 2.0. When an unhandled exception is thrown, the ASP.NET-based application unexpectedly quits.
This behavior does not apply to exceptions that occur in the context of a request. These kinds of exceptions are still handled and wrapped by an HttpException object. Exceptions that occur in the context of a request do not cause the worker process to end. However, unhandled exceptions outside the context of a request, such as exceptions on a timer thread or in a callback function, cause the worker process to end.

Symptoms
An application exception (trap) may occur on the SNA Server computer when you use the Rumba 5.2 TN5250 client to connect to the TN5250 Service. If you have Dr. Watson (Drwtsn32.exe) configured as the default debugger, a Drwtsn32.log file is created in the [NTROOT] directory. The following events are created in the Application event log of the Event Viewer:

Event ID: 5
Source : SNA TN5250 ServerDescription:
The SNA TN5250 Service detected an internal error.
File = ..\shared\tn5tnspm.c
Line = 3477
Fail = ((NB_IPS *)dsi5_data)->buf_size >= ((NB_IPS *)dsi5_data)->ips_length
Parm = 0×0
Event ID: 4097
Source: DrWatson
The application, exe\tn5250.dbg, generated an application error The error occurred on1/25/2000 @ 20:58: 3.406.
The exception generated was 80000003 at address 77f76274 (DbgBreakPoint).The following is an example of the exception in DbgBreakPoint:

Application exception occurred:App: exe\tn5250.dbg (pid=326)When: 1/25/2000 @ 20:58:3.406Exception number: 80000003 (hardcoded breakpoint)function: DbgBreakPointFAULT ->77f76274 ccint377f76275 c3ret77f76276 8bc0moveax,eax
Resolution
To resolve this problem, obtain the latest service pack for SNA Server 4.0. For additional information, click the following article number to view the article in theMicrosoft Knowledge Base:
215838?(http://support.microsoft.com/kb/215838/EN-US/) How to Obtain the Latest SNA Server Version 4.0 Service Pack

Symptoms
When you use Event Viewer to view the System log on a Microsoft Windows Server 2003-based computer, you may see event messages that are similar to the following:
Event ID: 107
Source:WMIxWDM
Description: Machine check event reported is a fatal error.
Event ID: 106
Source: WMIxWDM
Description:Machine check event reported is a corrected error.
MessageId=0×0078 Facility=Mca Severity=Error
SymbolicName=MCA_MEMORYHIERARCHY_ERROR
Language=English
Machine Check Event reported is a fatal memory hierarchy error.%r
Trasaction Type: %1%r
Memory Hierarchy Level: %2%r
Request Type: %3%r
Address: %4
MessageId=0×0079 Facility=Mca Severity=Error
SymbolicName=MCA_TLB_ERROR
Language=English
Machine Check Event reported is a fatal TLB error.%r
Transaction Type: %1%r
Memory Hierarchy Level: %2%r
Address: %3
MessageId=0×007a Facility=Mca Severity=Error
SymbolicName=MCA_BUS_ERROR
Language=English
Machine Check Event reported is a fatal Bus or Interconnect error.%r
Memory Hierarchy Level: %1%r
Participation: %2%r
Request Type: %3%r
Memory/IO: %4%r
Address: %5
MessageId=0×007b Facility=Mca Severity=Error
SymbolicName=MCA_BUS_TIMEOUT_ERROR
Language=English
Machine Check Event reported is a fatal Bus or Interconnect timeout error.%r
Memory Hierarchy Level: %1%r
Participation: %2%r
Request Type: %3%r
Memory/IO: %4%r
Address: %5
MessageId=0×007c Facility=Mca Severity=Error
SymbolicName=MCA_INTERNALTIMER_ERROR
Language=English
Machine Check Event reported is a fatal internal watchdog timer error.
MessageId=0×007e Facility=Mca Severity=Error
SymbolicName=MCA_MICROCODE_ROM_PARITY_ERROR
Language=English
Machine Check Event reported is a fatal microsoft ROM parity error.
MessageId=0×007f Facility=Mca Severity=Error
SymbolicName=MCA_EXTERNAL_ERROR
Language=English
Machine Check Event reported is a fatal condition. A processor received an external signal that an unrecoverable error has occurred.
MessageId=0×0080 Facility=Mca Severity=Error
SymbolicName=MCA_FRC_ERROR
Language=English
Machine Check Event reported is a fatal functional redundancy check error.
Resolution
These event messages may be logged in the System log in response to a Machine Check Architecture exception. A Machine Check Architecture exception is sent by the CPU in the computer in response to a computer error. The computer error may cause the computer to restart. After the computer has restarted, the CPU reports the Machine Check Architecture exception to the hardware abstraction layer (HAL). The HAL uses Windows Management Instrumentation (WMI) to report the Machine Check Architecture exception to the operating system.The operating system then logs the Machine Check Architecture exception in the System log as an event ID.

Symptoms
After you configure a Collect Specific Events (Collection) rule in Microsoft Operations Manager (MOM) 2005, the following symptoms occur:The MOM service (MOMservice.exe) stops unexpectedly. If you try to start the MOM service, you receive the following error message:

Could not start the MOM service on Local Computer.Error 1067:The process terminated unexpectedly. The following events are logged in the Application log:
Event Type:Error
Event Source:Microsoft Operations Manager
Event Category: None
Event ID:9014
Date:date
Time:time
User:N/A
Computer: ComputerName
Description: The Microsoft Operations Manager service (MOMService.exe) terminated due to an unhandled exception.Itwill attempt to restart itself.
For more information, see Help and Support Center at<http://go.microsoft.com/fwlink/events.asp>.
Event Type:Error
Event Source:Microsoft Operations Manager
Event Category: None
Event ID:9015
Date:date
Time:time
User:N/A
Computer: ComputerName
Description: The Microsoft Operations Manager service (MOMService.exe) received an unexpected exception.
Thread Id: 0xf40
Thread Name: MSB3904
Exception code: 0×00000000c0000005
Exception description: Access Violation
Exception address: 025EB79C
Exception flags: 0×0
For more information, see Help and Support Center at<http://go.microsoft.com/fwlink/events.asp>.
Resolution
This problem may occur if the Collect Specific Events (Collection) rule is configured to collect security event parameters. In this scenario, the Collect Specific Events (Collection) rule may occasionally collect more parameters than requested. This behavior may cause the MOM service to stop.

Symptoms
The Exchange IMAP4 worker process crashes intermittently on a computer that is running Microsoft Exchange Server 2007. When this problem occurs, an event is logged that resembles the following:

Event Type: Error
Event Source: .NET Runtime 2.0 Error Reporting
Event Category: None
Event ID: 5000
Description: EventType clr20r3, P1 microsoft.exchange.imap4.exe, P2 8.1.278.2, P3 481f7feb, P4 microsoft.exchange.imap4, P5 8.0.0.0, P6 481f7feb, P7 a6, P8 17, P9 system.nullreferenceexception, P10 NIL.
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Resolution
To resolve this problem, install Update Rollup 4 for Exchange Server 2007 Service Pack 1 (SP1) on the Exchange server.For more information about Update Rollup 4 for Exchange Server 2007 Service Pack 1, see the following Exchange Help topic:
Description of Update Rollup 4 for Exchange Server 2007 Service Pack 1 (http://go.microsoft.com/fwlink/?LinkId=152556)For more information about how to obtain the latest Exchange service pack or update rollup, see the following Exchange Help topic:
How to Obtain the Latest Service Pack or Update Rollup for Exchange 2007(http://go.microsoft.com/fwlink/?LinkId=152570)