Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net. The EventId.Net for Splunk Add-on assumes that Splunk is collecting information from Windows servers and workstation via the Splunk Universal Forwarder.
Information Store (2788) First Storage Group: A request to read from the file "<path to .edb file>" at offset <number> (<hex number>) for 4096 (0x00001000) bytes succeeded, but took an abnormally long time (<number of seconds> seconds) to be serviced by the OS. This problem is likely due to faulty hardware. Please contact your hardware vendor for further assistance diagnosing the problem.
|English: Request a translation of the event description in plain English.|
We experienced this when the local hard disks filled up. We cleared some space, rebooted and the problem was solved.
As per Microsoft: "This problem may be caused by faulty hardware. This problem may also be caused if the server or disk subsystem is not correctly configured". See MSEX2KDB for additional information about this event.
This event occurred on an SBS2003 server after performing an offline defrag using “eseutil /d /p /t” on both the Mailbox Store and the Public Store. I ran a chkdsk and the problem did not reappear.
When accessing various information stores (data in .edb files), the application is configured with a number of seconds as "normal" response threshold. When this threshold is reached, this message is recorded in the event log in order to notify the administrator about a potential problem. In itself, this is not a problem as the data was accessed but it indicates performance degradation and that may be just a symptom of problems to come. As the message suggests, one reason for this could be faulty hardware, especially the hard drives or their controllers. However, that's not always the case as bugs in software may affect the system as well. This may also occur if the I/O system is overloaded. If it is just a temporary condition then it is ok but otherwise, one should consider upgrading the system.
As a recommendation, double-check the hardware for potential faults, check the other event messages for errors or warnings, verify the availability of hardware resources on that system. A cautios step would be to run a chkdsk against the hard drives. Verify that the backup is running properly. If the message keeps showing up in the event logs, consider replacing the hardware.
|Private comment: Subscribers only. See example of private comment|
|Search: Google - Bing - Microsoft - Yahoo - EventID.Net Queue (0) - More links...|
Send comments or solutions
- Notify me when updated