Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 100 Source: Bonjour Service

576: ERROR: read_msg errno 10054 (An existing connection was forcibly closed by the remote host.)
This event can be recorded with various descriptions, each related to a different type of problem. We recommend searching the various troubleshooting resources using the event description rather than simply "event id 100 from Bonjour service".

The Bonjour service only records one event id (100) for all the messages it needs to log. For example, when the service is started, the Application event log will contain this event with "Service started" as description. The same is true for the service being stopped or restarted.

Examples of event descriptions that indicate errors:
Task Scheduling Error: m->NextScheduledSPRetry 2371
Task Scheduling Error: m->NextScheduledEvent 7426
Task Scheduling Error: Continuously busy for more than a second

The "Task Scheduling Error" type of problems seem to be a common issue on Windows 7 64 bit. Several users ended up stopping the service in order to avoid the logs being filled with these errors. They would only start the service when needed (iTunes needs this service in order to run properly).

From our experience, iTunes will start regardless of the status of the Bonjour service, however a warning is displayed saying that Bonjour is needed to access shared libraries. The warning will only be shown once so it won't bother you every time iTunes is started. In iTunes Preferences, the Sharing tab will display a message saying that the Bonjour service is required in order to use this feature.
Some support forum posts suggest turning off the Bonjour service. While this may get rid of this event, it doesn't solve the situation if you do need the service (to access network resources through it).

576: ERROR: read_msg errno 10054 (An existing connection was forcibly closed by the remote host.) - For this type of error, it appears that a remote computer (or printer) has abruptly closed the connection with the Bonjour service running on the computer where the event is recorded. This could be a simply because the remote computer was turned off or the power removed. The Error code 10054 is a standard Winsock (TCP/IP communication) error.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.