Event ID 1078

G

Guest

Hello!

We have a web farm with 12 web servers, and we store the state on a state
server.

Occasionally we get error (1078) in the event log on the state server.

---
The state server has closed an expired TCP/IP connection. The IP address of
the client is 10.99.194.151. The expired Read operation began at 11/06/2005
21:51:23.
---

I have read about the error here:
http://support.microsoft.com/default.aspx?scid=kb;en-us;308097

But the problem is that none of our webserver or the state server is near
100% of cpu. The state server avg 10-15% and the web servers avarage between
10-20%. And they never peak higher than 40%.

The problem is reported to the event log ~20 times per minute.
Sometimes the error can go away for a couple of hours or a whole day, and
then the problem can come back for a couple of hours/days.

When the problem is reported it is mainly reported by one web server. But
over time all the webservers have had the problem.

How can I investigate this further?
 
M

Mr Newbie

Why not just try the resolution mentioned in the technote to increase the
timeout from 10 seconds upwards. Alternatively or in addiation, what about
upgrading the servers processor, memory etc and / or reducing its load by
turning off non essential services.
 
G

Guest

As I wrote we dont have any performance issues with our servers. So I cant
see why I should add more memory. Our webservers only handles asp.net, and
that is the only thing it does so we annot turn off any more services.

I cant see why I should increase the value since - once again - our servers
cpu peak is not near 100%. And it says that the timeout already is 10
seconds. If we have a bottleneck somewhere that makes it take 10 seconds to
do something, then we need to fix that. But the thing is that even during our
peak hours our site responds fast.

Other suggestions?
 
M

Mr Newbie

Perhaps it is the concurrency of the requests which is causing a denial of
service. I dont know enough about this to really give you an accurate
answer. If your servers are not running anywhere near 100% ( Which I misread
to be near 100% Hence my post ) then perhaps it cant cope with the number of
concurrent incomming connections and denies service.

Its a stab in the dark, but why dont you take a look at that metric and see
if it yeilds any further cause for investigation.
 
S

Steven Cheng[MSFT]

Hi Patrik,

Since you mentioned that both the webserver and stateserver both run with
low CPU utlization, I think the configuration is proper for common requests
in your secnario. However , there may exist some certain session processing
which cause the stateserver timeout that connection. Is there any large
memory exchange with the SessionState in your applicaion? For such problem
in production environment, it would be better if we can try isolating the
problem to a small scope, maybe page level or ...

Thanks,

Steven Cheng
Microsoft Online Support

Get Secure! www.microsoft.com/security
(This posting is provided "AS IS", with no warranties, and confers no
rights.)



--------------------
| From: "Mr Newbie" <[email protected]>
| References: <[email protected]>
<eacI#[email protected]>
<[email protected]>
| Subject: Re: Event ID 1078
| Date: Mon, 7 Nov 2005 17:12:21 -0000
| Lines: 91
| X-Priority: 3
| X-MSMail-Priority: Normal
| X-Newsreader: Microsoft Outlook Express 6.00.2900.2180
| X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180
| X-RFC2646: Format=Flowed; Original
| Message-ID: <[email protected]>
| Newsgroups: microsoft.public.dotnet.framework.aspnet
| NNTP-Posting-Host: host81-137-199-51.in-addr.btopenworld.com 81.137.199.51
| Path: TK2MSFTNGXA01.phx.gbl!TK2MSFTNGP08.phx.gbl!TK2MSFTNGP09.phx.gbl
| Xref: TK2MSFTNGXA01.phx.gbl
microsoft.public.dotnet.framework.aspnet:136652
| X-Tomcat-NG: microsoft.public.dotnet.framework.aspnet
|
| Perhaps it is the concurrency of the requests which is causing a denial
of
| service. I dont know enough about this to really give you an accurate
| answer. If your servers are not running anywhere near 100% ( Which I
misread
| to be near 100% Hence my post ) then perhaps it cant cope with the number
of
| concurrent incomming connections and denies service.
|
| Its a stab in the dark, but why dont you take a look at that metric and
see
| if it yeilds any further cause for investigation.
|
| --
| Best Regards
|
| The Inimitable Mr Newbie º¿?

|
|
| | > As I wrote we dont have any performance issues with our servers. So I
cant
| > see why I should add more memory. Our webservers only handles asp.net,
and
| > that is the only thing it does so we annot turn off any more services.
| >
| > I cant see why I should increase the value since - once again - our
| > servers
| > cpu peak is not near 100%. And it says that the timeout already is 10
| > seconds. If we have a bottleneck somewhere that makes it take 10
seconds
| > to
| > do something, then we need to fix that. But the thing is that even
during
| > our
| > peak hours our site responds fast.
| >
| > Other suggestions?
| >
| >
| > "Mr Newbie" wrote:
| >
| >> Why not just try the resolution mentioned in the technote to increase
the
| >> timeout from 10 seconds upwards. Alternatively or in addiation, what
| >> about
| >> upgrading the servers processor, memory etc and / or reducing its load
by
| >> turning off non essential services.
| >>
| >> --
| >> Best Regards
| >>
| >> The Inimitable Mr Newbie º¿?| >>
| >> | >> > Hello!
| >> >
| >> > We have a web farm with 12 web servers, and we store the state on a
| >> > state
| >> > server.
| >> >
| >> > Occasionally we get error (1078) in the event log on the state
server.
| >> >
| >> > ---
| >> > The state server has closed an expired TCP/IP connection. The IP
| >> > address
| >> > of
| >> > the client is 10.99.194.151. The expired Read operation began at
| >> > 11/06/2005
| >> > 21:51:23.
| >> > ---
| >> >
| >> > I have read about the error here:
| >> > http://support.microsoft.com/default.aspx?scid=kb;en-us;308097
| >> >
| >> > But the problem is that none of our webserver or the state server is
| >> > near
| >> > 100% of cpu. The state server avg 10-15% and the web servers avarage
| >> > between
| >> > 10-20%. And they never peak higher than 40%.
| >> >
| >> > The problem is reported to the event log ~20 times per minute.
| >> > Sometimes the error can go away for a couple of hours or a whole
day,
| >> > and
| >> > then the problem can come back for a couple of hours/days.
| >> >
| >> > When the problem is reported it is mainly reported by one web
server.
| >> > But
| >> > over time all the webservers have had the problem.
| >> >
| >> > How can I investigate this further?
| >>
| >>
| >>
|
|
|
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Top