EventID 1055 (Cluster File Share resource 'name' has failed a statuscheck) after applying ConFlicker Worm Fix (KB958644)

Hi List,

we have applied the KB958644 Fix against the Conflicker Worm on a 2 node
File Cluster (win2003 SP2).

After that, i get the EventID 1055 randomly for a few minutes:

Cluster File Share resource 'name' has failed a status check. The error
code is 64.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


This resource depends on a seperate Networkname, IP Adress and File
resource. there are 28 shares belonging to that Resource Group. There
isn't running any Veritas Product, defrag tool or something else of this
stuff. The only change is this Security Patch.
The cluster runs without problems for round about three months.

thx for help in advance

Andreas

Hi, Andreas!

Andreas Wahlert schrieb:
> Hi List,
>
> we have applied the KB958644 Fix against the Conflicker Worm on a 2 node
> File Cluster (win2003 SP2).
>
> After that, i get the EventID 1055 randomly for a few minutes:
>
> Cluster File Share resource 'name' has failed a status check. The error
> code is 64.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
>
> This resource depends on a seperate Networkname, IP Adress and File
> resource. there are 28 shares belonging to that Resource Group. There
> isn't running any Veritas Product, defrag tool or something else of this
> stuff. The only change is this Security Patch.
> The cluster runs without problems for round about three months.

Sorry, that I can't help right now - but we got the same events before
Christmas, after applying the regular Windows updates (KB956097 and
KB955069). 1 hour after the patches have been installed, I got the same
error messages on the node with the updates. But KB958644 has already
been installed for one month, so I don't know, if it's this or one of
the other two updates that causes this behaviour.

We switched to a failover server, since we are still researching this issue.

It would be great, if you could keep us informed about your progress
here, too.

greetings
michi

> Sorry, that I can't help right now - but we got the same events before
> Christmas, after applying the regular Windows updates (KB956097 and
> KB955069). 1 hour after the patches have been installed, I got the same
> error messages on the node with the updates. But KB958644 has already
> been installed for one month, so I don't know, if it's this or one of
> the other two updates that causes this behaviour.

Addon: The Node with the error messages stopped responding shortly
after. To failover to the other node, I had to hard-reboot the hanging
server, since the failover would not work otherwise...

greetings
michi

> Sorry, that I can't help right now - but we got the same events before
> Christmas, after applying the regular Windows updates (KB956097 and

another edit: it's KB957097, not KB956097

Michael Hirczy schrieb:
>
>> Sorry, that I can't help right now - but we got the same events before
>> Christmas, after applying the regular Windows updates (KB956097 and
>
> another edit: it's KB957097, not KB956097

Hmm. My nodes are running with this event. I don't need to hard reset
the node (until now ;-))

If we can anything invetigate, i'll post this here.

The most common reason we see for these errors is some system resource issue
at a lower level than the cluster service. The error occurs when the cluster
connects to the server service to verify if the share is still bound and
it's getting back a status 64 'network name not available'. Usually, this
is the server service either not able to keep up with the demand for free
connections or some resource depletion like paged pool, non-paged pool, etc
.. Check the system logs and see if you see any 2019's, , 2021's, 2022's etc.
prior to the failure. One of the things we try to tweak the server service
is detailed in the following KB article.

317249 How to troubleshoot Event ID 2021 and Event ID 2022
http://support.microsoft.com/default...b;EN-US;317249

--
Jeff Hughes, MCSE
Support Escalation Engineer
Microsoft Enterprise Platforms Support (Server Core/Cluster)


"Andreas Wahlert" <andreas.wahlert@_toDelete_gmx.de> wrote in message
news:#...
> Hi List,
>
> we have applied the KB958644 Fix against the Conflicker Worm on a 2 node
> File Cluster (win2003 SP2).
>
> After that, i get the EventID 1055 randomly for a few minutes:
>
> Cluster File Share resource 'name' has failed a status check. The error
> code is 64.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
>
> This resource depends on a seperate Networkname, IP Adress and File
> resource. there are 28 shares belonging to that Resource Group. There
> isn't running any Veritas Product, defrag tool or something else of this
> stuff. The only change is this Security Patch.
> The cluster runs without problems for round about three months.
>
> thx for help in advance
>
> Andreas

Jeff Hughes [MSFT] schrieb:
> The most common reason we see for these errors is some system resource
> issue at a lower level than the cluster service. The error occurs when
> the cluster connects to the server service to verify if the share is
> still bound and it's getting back a status 64 'network name not
> available'. Usually, this is the server service either not able to keep
> up with the demand for free connections or some resource depletion like
> paged pool, non-paged pool, etc . Check the system logs and see if you
> see any 2019's, , 2021's, 2022's etc. prior to the failure. One of the
> things we try to tweak the server service is detailed in the following
> KB article.
>
> 317249 How to troubleshoot Event ID 2021 and Event ID 2022
> http://support.microsoft.com/default...b;EN-US;317249
>
The issue starts today in the morning (01:45 AM) with EventID 2026 /
Source SRV:

The server has detected too many Denial-Of-Service attacks and will stop
logging events for any more of them. Be advised it is likely someone is
actively attacking your machine.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


our netbackup with commvault starts at this time with backing up the
shares on this cluster node.

then, a few seconds later, the eventID 1055 occurs. After that till now
there no EventIDs 20xx anymore. i see only eventIDs 1055.

regards

Andreas

Last week I read in the NYTimes that MIcrosoft had come up with a patch to
counter the Conflicker worm in October 2008. I have been downloading and
installing(the automatic doesn't work) all the updates that have come out. So
assume I am covered if I can go back in the Update History and find the KB
958644. If my Windows XP SP3 has received it, there have been no subsequent
problems. My main concern is to be covered. One other possible problem is
that I have shut off the Windows firewall because a few years ago, I read
that it wasn't necesary if Norton Antivirus is installed.


-
Wardtwo a do-it-yourself learner


"Jeff Hughes [MSFT]" wrote:

> The most common reason we see for these errors is some system resource issue
> at a lower level than the cluster service. The error occurs when the cluster
> connects to the server service to verify if the share is still bound and
> it's getting back a status 64 'network name not available'. Usually, this
> is the server service either not able to keep up with the demand for free
> connections or some resource depletion like paged pool, non-paged pool, etc
> . Check the system logs and see if you see any 2019's, , 2021's, 2022's etc.
> prior to the failure. One of the things we try to tweak the server service
> is detailed in the following KB article.
>
> 317249 How to troubleshoot Event ID 2021 and Event ID 2022
> http://support.microsoft.com/default...b;EN-US;317249
>
> --
> Jeff Hughes, MCSE
> Support Escalation Engineer
> Microsoft Enterprise Platforms Support (Server Core/Cluster)
>
>
> "Andreas Wahlert" <andreas.wahlert@_toDelete_gmx.de> wrote in message
> news:#...
> > Hi List,
> >
> > we have applied the KB958644 Fix against the Conflicker Worm on a 2 node
> > File Cluster (win2003 SP2).
> >
> > After that, i get the EventID 1055 randomly for a few minutes:
> >
> > Cluster File Share resource 'name' has failed a status check. The error
> > code is 64.
> >
> > For more information, see Help and Support Center at
> > http://go.microsoft.com/fwlink/events.asp.
> >
> >
> > This resource depends on a seperate Networkname, IP Adress and File
> > resource. there are 28 shares belonging to that Resource Group. There
> > isn't running any Veritas Product, defrag tool or something else of this
> > stuff. The only change is this Security Patch.
> > The cluster runs without problems for round about three months.
> >
> > thx for help in advance
> >
> > Andreas
>

I have found in my windows update the following patches for the Conflicker
worm and, perhaps other worms and viruses that could allow "an
unauthenticated remote attacker to compromise" the system:
KB958644 Oct 23/08, KB955069 Nov 11/08, KB956802 Dec 9/08 and KB958687
Jan 16/09
Have not observed any effect from these patches on my Windows XP SP3
performance.
Wardtwo a do-it-yourself learner


"Jeff Hughes [MSFT]" wrote:

> The most common reason we see for these errors is some system resource issue
> at a lower level than the cluster service. The error occurs when the cluster
> connects to the server service to verify if the share is still bound and
> it's getting back a status 64 'network name not available'. Usually, this
> is the server service either not able to keep up with the demand for free
> connections or some resource depletion like paged pool, non-paged pool, etc
> . Check the system logs and see if you see any 2019's, , 2021's, 2022's etc.
> prior to the failure. One of the things we try to tweak the server service
> is detailed in the following KB article.
>
> 317249 How to troubleshoot Event ID 2021 and Event ID 2022
> http://support.microsoft.com/default...b;EN-US;317249
>
> --
> Jeff Hughes, MCSE
> Support Escalation Engineer
> Microsoft Enterprise Platforms Support (Server Core/Cluster)
>
>
> "Andreas Wahlert" <andreas.wahlert@_toDelete_gmx.de> wrote in message
> news:#...
> > Hi List,
> >
> > we have applied the KB958644 Fix against the Conflicker Worm on a 2 node
> > File Cluster (win2003 SP2).
> >
> > After that, i get the EventID 1055 randomly for a few minutes:
> >
> > Cluster File Share resource 'name' has failed a status check. The error
> > code is 64.
> >
> > For more information, see Help and Support Center at
> > http://go.microsoft.com/fwlink/events.asp.
> >
> >
> > This resource depends on a seperate Networkname, IP Adress and File
> > resource. there are 28 shares belonging to that Resource Group. There
> > isn't running any Veritas Product, defrag tool or something else of this
> > stuff. The only change is this Security Patch.
> > The cluster runs without problems for round about three months.
> >
> > thx for help in advance
> >
> > Andreas
>

Michael,

did you find any solution we are having similar issues. The cluster is
hanging and have to do a hard shutdown in order to fail over the resources
the issue started about 3 weeks ago
--
ggb


"Michael Hirczy" wrote:

> Hi, Andreas!
>
> Andreas Wahlert schrieb:
> > Hi List,
> >
> > we have applied the KB958644 Fix against the Conflicker Worm on a 2 node
> > File Cluster (win2003 SP2).
> >
> > After that, i get the EventID 1055 randomly for a few minutes:
> >
> > Cluster File Share resource 'name' has failed a status check. The error
> > code is 64.
> >
> > For more information, see Help and Support Center at
> > http://go.microsoft.com/fwlink/events.asp.
> >
> >
> > This resource depends on a seperate Networkname, IP Adress and File
> > resource. there are 28 shares belonging to that Resource Group. There
> > isn't running any Veritas Product, defrag tool or something else of this
> > stuff. The only change is this Security Patch.
> > The cluster runs without problems for round about three months.
>
> Sorry, that I can't help right now - but we got the same events before
> Christmas, after applying the regular Windows updates (KB956097 and
> KB955069). 1 hour after the patches have been installed, I got the same
> error messages on the node with the updates. But KB958644 has already
> been installed for one month, so I don't know, if it's this or one of
> the other two updates that causes this behaviour.
>
> We switched to a failover server, since we are still researching this issue.
>
> It would be great, if you could keep us informed about your progress
> here, too.
>
> greetings
> michi
>