Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 1014 Source: DhcpServer

Source
Level
Description
The Jet database returned the following Error: -<error code>
Comments
 
This event indicates a corrupted DHCP database (Using Jet.exe to compact the DHCP database does not resolve the issue.) See links below for recovering the DHCP database.

-Error: 1605 - See ME189009.
In my case the problem was solved just by restarting the DHCP service. Windows 2003 Server.
In my case, I fixed this by uninstalling and reinstalling the DHCP server.
In our case, excluding the DHCP folder from Symantec AV scanning solved our problem.
Same solution like Yvette, but it is on a Win2003 SBS SP2. I then disabled content indexing on that folder (I do not know why it was enabled in the first place). Since then, the DHCP service stops and starts perfectly without any errors.


In our case, this error was traced to a bad registry key as per article “Installing SQL Server 2005 April CTP Breaks DHCP Server”. After deleting the erroneous registry entry HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\VssAccessControl, DHCP started working again.
I received this error followed by EventID 1016 from source DHCP once every two hours. On inspection of my DHCP logs (C:\Winnt\System32\Dhcp\DhcpDvrLog.day) I noticed this message: "02, 05/15/06, 06:00:52, Paused, , , ". The 02 translates to "The log was temporarily paused due to low disk space", which was indeed my problem.
- Error code: -1811 - See the link to "Error code 1811" for information on this error.
Our Windows 2000 DHCP server had been running happily for over a year, then suddenly started recording 1014 and 1016 errors. The DHCP service appeared to be working ok; clients were leasing addresses without problems.
The 1014 errors were: The JET Database call returned the following error : -1032. Additional Debug Information: JetBackup.
The 1016 errors were: The DHCP service encountered the following error when backing up the database: An error occurred while accessing the DHCP database. Look at the DHCP server event log for more information on this error.
This occurred whenever the DHCP service attempted to back up the database. I confirmed that the AV software was excluding the “system32\dhcp” folder from its real-time scanning.
I could stop the DHCP service and manually compact the database but the error would recur the next time DHCP tried to automatically back itself up.
I used sysinternal’s "Handle" and "Filemon" tools to determine that the content indexing service was holding onto the folder “system32\dhcp\backup\jet\old”. Attempts to access this folder via Explorer or the command prompt resulted in a "file in use" type of error.
I restarted the indexing service. After that, I got a 524 jet error, which KB 266361 indicates is "Could not delete backup file".
I then disabled content indexing on that folder (I do not know why it was enabled in the first place). Since then the DHCP service stops and starts perfectly without any errors.
This message with Error code -533 can take place if “.chk” files were deleted from DHCP database folder (by default, %SystemRoot%\system32\dhcp). In this case, Event ID 1016 follows it.
- Error: 510 - I got this error multiple times together with DhcpServer Event ID 1016. It was caused by moving the DHCP server database to another server but leaving the DHCP service running. Stop DHCP and put the service on disabled (or uninstall DHCP completely).
- Error : -1022 - Using FileMon from Sysinternals, I found that TCPSVCS.EXE was trying to access the root of “C:”. BUILTIN\SYSTEM did not have access here. Adding SYSTEM into the ACL solved the issue.
For Windows NT Server 4.0:
Error: 510. - See ME216793.
Error: 524. - See ME193819.
Error: 1022. - See ME193819.
Error: 1032. - See ME193819.
Problem is caused by corrupt directory %systemroot%\system32\dhcp\backup\Jet\Old. To fix it unauthorise the server, make the DHCP Server service manual, stop it and restart the server. Upon restart the corrupt directory will be removed.
To prevent it from happening again: If you have an antivirus program running exclude %SystemRoot%System32\Dhcp\ and subdirectories, or exclude all dhcp.mdb files from the above directory and subdirectories.


Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...