Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 2006 Source: Srv

The server received an incorrectly formatted request from \\<server name>.
See ME906913 for a hotfix applicable to Microsoft Windows 2000.
From a newsgroup post: "I was repeatedly getting an event 2006 source Srv that the "server received an incorrectly formatted request from" a particular Win 98 workstation. A friend told me that Win 98's driver for the Realtek chipset used by many cheap nics is broken. If your nic uses an 8019 or 8029 chip, you will get these errors sporadically. You need to download a new driver. The drivers for Win 95, Win NT4, and Win 2k work fine, it is just the Win 98 driver that has problems".
According to a Usenet post: "Typically, an application error causes this event to appear in your  event log. An application that utilizes LockingAndX and AndX may have been the  course. Other possible causes are a corrupted NIC driver or faulty network card or that the srv.sys is out of date or  corrupt. You might want to reapply the latest service pack. If the event viewer indicates a consistent pattern, you can reduce the frequency of these errors by setting the autodisconnect time to slightly higher than the time between the errors. From a command prompt, type in the following:

"net config server /autodisconnect:30"

Most likely cause is the NIC  in the client machine and a application error.
If the backup server is participating in a Backup Exec Network Storage Executive group this issue can occur if the Backup Exec for Windows NT Agent Accelerator (NTAA)server in not installed on the server mentioned in the error. See Veritas TechNote 231195.

See Microsoft Articles ME142617 and ME147246 for additional information on this event.
This event is also logged by Veritas Backup Exec on remote machines being backed up at the file level if the Remote Agent for Windows NT/Windows 2000 is not installed on the remote server. See Veritas TechNote 234315.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.