Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 3013 Source: Rdr

The redirector has timed out a request to <server name>.
The server did not respond to a request from the redirector within the time specified by the SESSTIMEOUT entry in the configuration information. The default value for this entry is 45 seconds. When on a client the Microsoft Windows NT redirector opens a file for read or read/write access, the redirector utilizes the a cache to speed-up the performance. When data is written to a file, in fact, it is written to the cache and not sent (immediately) to the redirector. The cache manager flushes the data at a later time. If a network problem (error) occurs while the data is being transferred to the remote server, it may cause the write request to fail and the event log is generated. You can retry the command. If this error occurs frequently, ask the person with administrative rights on your computer to increase the value.
See ME245723 and ME923360 for information about this event.
This error can be caused by routing problems in large corporate intranet environments where the network connection takes a different route for each direction between a users’s desktop and a file server. Most commonly, this shows up when a user tries to save an open files on a network share where there are several hops in between the user and the file server.

Do a tracert from the file server to the user’s IP and compare it to a tracert from the user’s desktop to the file server. If the routes are different (especially if one route has additional hops), Windows can display erroneous error messages: “The disk is Full”, “An error occurred while reconnecting…”, “Windows was unable to save all the data for the file \device\LanmanRedirector\…", "The data has been lost.", "This error may be caused by a failure of your computer hardware or network to save this file elsewhere”. In addition, one of the pop up error windows on the user’s desktop may have a header that reads “Windows – Delayed Write Failed”.
Every time this happens, we document it and contact the networking group, they fix the routes, and the problem goes away. On the frustrating end, if the user is only getting a disk full error even though you have Gigabytes to spare on your file share, you can waste a lot of time troubleshooting the server when the network is the cause. BTW, this isn’t just Windows that is finicky about different to/from network routes, Unix X-Windows Sessions and UNISYS mainframe connectivity can also be affected by this.
As per Microsoft: "The server did not respond to a request from the redirector within the time specified by the SESSTIMEOUT entry in the configuration information. The default value for this entry is 45 seconds". See MSW2KDB for more details.

This behavior may occur if the duplex settings that are configured for the network adapter on the computer are incorrect. See ME319122 for more details. Also, note that this issue may occur if a non-Microsoft program that is installed on your computer uses an outdated kernel-mode filter driver. See ME822219, ME323819, and ME821464 for more details.

ME317249 shows how to troubleshoot event ID 2021, event ID 2022, and event ID 3013.

NOTE: Cluster resources may go offline after event ID 3013. See ME308151 for additional information.

Follow the link to "EventID 3013 from source MrxSmb" for additional information on this event.
This event means that the server that you are attempting to connect to is:
Busy and cannot respond before the rdr timeout occurs.
Being affected by an overload of traffic on the network.
Is on the other side of (or is the location of) a bottleneck in the network.
Troubleshoot this issue by:
a. Try to obtain a trace of the packets on the network. Track the amount of time it takes for the Server to respond back to the workstation.  
b. Another option is to perform whatever operation gave the error backwards. For example, if trouble is experienced when connecting to ServerA from ServerB, try connecting to ServerB from ServerA.
c. Have another client attempt to connect to the same server to see if both redirectors have the same problem connecting to the same server.
d. Check to see that the latest network driver is installed.
e. Check to determine whether the network adapter has a configuration utility that allows tuning parameters. If so, try maximizing the network performance. See Veritas TechNote ID: 237406 link.
See also ME148426.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.