Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 7011 Source: ServiceControlManager

Level
Description
Timeout (<number> milliseconds) waiting for transaction response from the <service name> service.
Comments
 
- Service: BTSSvc$BizTalkServerApplication - See ME942221 for a hotfix applicable to Microsoft BizTalk Server 2006.
- Service: MSExchangeIS - See ME938673 for a hotfix applicable to Microsoft Exchange Server 2003.
- Service: cisvc - From a newsgroup post: "Try turning off index server cisvc (catalog index service)".
- Service: SMTPSVC - See ME906557.
- Service: W3SVC - See ME906557.
- Service: IISADMIN - See ME906557.
- Service: IMAP4Svc - See ME906557.
- Service: NntpSvc - See ME906557.
- Service: RESvc - See ME906557.

See ME922918 and WITP77507 for additional information about this event.
- Service: BTSSvc$BizTalkServerApplication - See ME942221 for a hotfix applicable to Microsoft BizTalk Server 2006.
- Service: MSExchangeIS - See ME938673 for a hotfix applicable to Microsoft Exchange Server 2003.
- Service: cisvc - From a newsgroup post: "Try turning off index server cisvc (catalog index service)".
- Service: SMTPSVC - See ME906557.
- Service: W3SVC - See ME906557.
- Service: IISADMIN - See ME906557.
- Service: IMAP4Svc - See ME906557.
- Service: NntpSvc - See ME906557.
- Service: RESvc - See ME906557.

See ME922918 and VITPRO77507 "JSI Tip 6203" for additional information about this event.
- Service: Messenger - If the Messenger service is enabled under XP SP2 on a laptop with a wireless card, and the laptop goes into Suspend/Standby/Hibernate, the service may hang on resume. This may also cause other services hosted by svchost.exe to hang, so that the computer stops responding to requests to shut down or perform other commands. This seems to be a problem especially if there is another network connection on the system at the same time (e.g. disconnected network port on a laptop). I have found this problem on multiple laptop models with multiple wireless cards. The only solution I could find that solved the problem 100% of the time was to disable the Messenger service. You may also find that disabling all other network connections (inside Windows) and then rebooting, helps. This second solution may lead to the Messenger service crashing (with service-specific error 2270) rather than hanging on resume - but at least the computer remains responsive.
- Service: stisvc - From a newsgroup: “Stisvc.exe is an executable which is installed by Windows together with digital cameras, scanners or other graphical input devices. Hardware device drivers use this service and it should not be terminated whilst these devices are used”.
In our case, we have a HP 6110 All-In-One installed. The error appeared when a cartridge alignment error occurred on the device and we turned it off and then on again.
- Service: NtFrs - From a newsgroup post: "I stopped the errors by changing the autodisconnect value for the LAN setting under the registry key HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanmanServer\Parameters. I set my Autodisconnect value to 0xfffff. See ME138365 for an article describing the Autodisconnect parameter". The value 0xfffff is the highest value allowed on a domain controller. In my case, I used 0xfff. The default value on my SBS 2003 server was 0xf.


- Service: VxSvc - In my case, the error was caused by Dell's Open Manage Disk Management. Stopping and restarting the "Disk Management Service" fixed the error. You have to forcefully kill the vxsvc.exe process, if the service doesn't stop.
- Service: Spooler - I had to delete some old spool jobs in the folder: C:\WINNT\System32\Spool\PRINTERS\*.SHD and *.SPL (for Windows 2000). After I deleted those old jobs, I was able to start the spooler service without this error in the event log.
- Service: InoRT – From a newsgroup post: "Looks like a problem with InoculateIT antivirus. InoRT is the real-time scanner component. You should try to reinstall it, this may fix the problem. Or you can download the most recent real time driver for your version and give that a "whirl" (reboot required)".

- Service: Information Store - See ME329817.
- Service: SMTPSVC - See ME831572.
- Service: RESvc - See ME831572.
- Service: IISADMIN - See ME831572.
- Service: W3SVC - See ME831572.
- Service: MSExchangeIS - See ME835437.
- Service: McShield - Read McAfee Solution ID kb44876. Go to the McAfee Knowledge Search page and search for this solution to read it.

This event appears if a service does not respond to a control request (such as pause, continue, interrogate, or stop) from Service Control Manager within the specified time. See MSW2KDB for more details on this event.
- Service: VxSvc - I typed from the command prompt: C:\diskperf -y <enter> and rebooted the server. This solved my problem.
Service: IISADMIN - My suggestions: - possible IIS metadatabase corruption: ME238665. Other related to MS Exchange 2K: ME311517 (Inetinfo.exe stops responding), You might need manaually Remove and Reinstall IIS and Exchange: ME320202 - possible third-party software (e.g. AntiVir).
Service: Naimagent32 - no info.
Service: dmserver - no info.
Service: NtmsSvc - no info.
Service: HidServ - no info.
Service: TermService - no info.
Service: LcAgent - no info.
Service: Spooler - I had to stop the printer spooler service in order to get rid of this error (obviously not a fix, but if you do not need to print from that machine it should be ok).
The MOM Onepoint service was crashing on an Exchange server.  It turns out that Outlook XP was once installed on this machine.  Installing Outlook 2000 resolved the problem.
On our server it was caused by having the "Microsoft Exchange Event" service set to manual.
Service: DNSCache - From a newsgroup post: "I had the same problem. It was an application that I installed called "Spybot - Search & Destroy". It modifies the %root%/winnt/system32/drivers/ etc/hosts file by adding a few hundred entries all pointing to 127.0.0.1 which is the local host. By deleting the hosts file and renaming the backup hosts file back to its original name, the problem was fixed."

From a newsgroup post: "Indeed, there are issues with “hosts” files that have 1000 entries. I removed Search and Destroy and renamed the “hosts” file and achieved similar results. I have had many DNS timeouts, I thought that by removing Ares 1.8.1 build 2922 I had fixed the problem, but the problem came back with Kazaar. Whatever I have installed, it seems to knock out my route to my DNS server (ADSL router) which is behind my Linksys WAP. Every 60 seconds my network loses the ability to connect beyond the Linksys router for exactly 60 seconds. Normal service then returns. Something is locking up the DNS cache/database. Disabling Zone Alarm didn’t help. Removing Ares helped until I installed Kazaar. Removing kazaar has got rid of 90% of occurrences".

Service: Netman - From a newsgroup post: "I disabled Zone Alarm and the problem was solved."


Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...