Error message

[bill sanderson]

-----Original Message-----
MSAS stopped with an error message 1003. It is running on
a win2003 server. I stopped the program and restarted and
all seems ok. It has been running on our server and 27
client computers for about 3 months now with no problems.
Does anyone know what this error means?

Can you describe this error any better? Is there any
trace in the event viewer logs that you could cut and
paste here? This didn't ring any bells, so I Googled,
and that brought up a classic KB article where a root-kit
type trojan is in place and crashes the server (with a
1003 error)--and the relevance is that Microsoft
Antispyware can remove this trojan.

However, you don't mention the server blue-screen
crashing, so I suspect your error is an antispyware
program error, rather than an event-viewer error?

Here are a couple of references--Have you done a full
system antivirus scan recently?
http://support.microsoft.com/?scid=kb;en-us;897079
http://support.microsoft.com/?id=894278

The other kind of knee-jerk reaction I have when I hear
that Microsoft Antispyware is running on a server, is to
suggest that you check the size of the errors.log file,
typically in c:\program files\microsoft antispyware.
this file can grow to 4 gigs on an NTFS partition, and I
have seen this happen on several servers. I don't
connect that to this error, but it may be worth checking
anyway.

I also checked and there is a visual basic error 1003--
"invalid number of arguments." If the error is coming
from within the program, that is probably the error, and
I can't suggest what to do about it, I'm afraid--it
sounds like a genuine bug--not something you can do much
about!

 

[Andy K]

Thanks Bill, i will post the part of the error log below:
Looking at this it does look like a program error. I will
also delete the contents of the log file as it has grown
to 6MB.
Is there a way to turn off/on the log file?

"7::ln 10:Out of
memory::gcasDtServ:ScheduleScans:Update::14/06/2005
02:00:20:1.0.509
5::ln 25:Invalid procedure call or
argument::gcASThreatAudit:modDataManager:InitializeIgnored
ThreatsData::14/06/2005 02:00:25:1.0.509
0::ln 0::gcASThreatAudit not
Authorized::GIANTAntiSpywareMain:modMain:Main::14/06/2005
02:00:25::1.0.509
7::ln 10:Out of
memory::gcasDtServ:ScheduleScans:Update::14/06/2005
02:00:52:1.0.509
5::ln 25:Invalid procedure call or
argument::gcASThreatAudit:modDataManager:InitializeIgnored
ThreatsData::14/06/2005 02:00:53:1.0.509
0::ln 0::gcASThreatAudit not
Authorized::GIANTAntiSpywareMain:modMain:Main::14/06/2005
02:00:53::1.0.509
438::ln 0:Object doesn't support this property or
method::gcasDtServ:modMain:ShutDown::14/06/2005
10:01:26:1.0.509
7::ln 10:Out of
memory::gcasDtServ:ScheduleScans:Update::15/06/2005
02:00:07:1.0.509
7::ln 10:Out of
memory::gcasDtServ:ScheduleScans:Update::15/06/2005
02:00:27:1.0.509
7::ln 10:Out of
memory::gcasDtServ:ScheduleScans:Update::15/06/2005
02:00:58:1.0.509
5::ln 0:Invalid procedure call or
argument::gcASThreatAudit:modDataManager:InitializeSetting
sData::15/06/2005 02:33:20:1.0.509"

 

[Bill Sanderson]

I'm afraid that there's no known way to turn off that logging--if your file
grows unusually, and that one seems large to me--you just have to keep an
eye on it.

The errors.log file contains stuff similar to what you've posted on most
machines. Lots of these messages appear to be basically debug statements,
rather than true error conditions, and I'm afraid I haven't learned enough
about what goes on in there to see whether yours indicates anything of
significance.

I've just looked at mine, and while it is only 21k, it also has the out of
memory and
invalid procedure call messages of various sorts.

I'd keep an eye on it, and if it gives you trouble (in my case that involved
filling up the system partition which wasn't too large!)--I'd remove the
current beta and wait for beta2 to test further.