Windows Forum

Ask something
Discussion Locked

constant DCOM 10009 error after Srv 2019

0 helpful
4 replies

by me

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hey guys,

Since I've taken this job in the last two weeks, I've been wreslting with a repetative DCOM error that comes up about every 25-30 seconds after a single SRV 2019
The environment is Windows2000 Server SP4 with 5 servers, 1 AD-DC. We are on a VPN for WAN sites and do not have this error at any other location.
The server having this problem has IBM Unidata 6.0.10 running on it (we've also seen a Unidata telnet error resurface every so often: twice a day).
The DCOM error would specify first loosing communication with the server itself "./" but then it would say from the client "buyer". So it cycles between loosing connection with itself and the client buyer, one after the other. on the client i found several malware hijacks, removed them and have not seen a difference.
I've MemTest86'd it, replaced the ram, updated Win, killed all extra connections and scanned out any hijacks leaving open connections (the old Admin didn't care and actually webbrowsed with this server: unwise), set the RPC service to restart after failing, checked all RPC protocols between the servers for compatibility, used Performance monitor to check for a pageleak, and even chkdsk /f /r incase of blip on the drive anywhere. I'm running outta steam.
Any clues ? Any framiliar signs ?

Thanks in advance,

cRass-H

4 replies

by me

The MS way to performance monitor for leaks was useless. It did not provide any information, nor was the page leaking (from the MS point of view).
As for Active Ports, yes I have checked that. but I was unsure of how many ports I was supposed to have available so I'm still checking this. can you recommend how to diagnose extra left open sockets from one to many daemons ? sometimes there are so many open other forked daemons running that I can't differentiate which are dependancies or which are a waste.

by me

Winterfrost

Yes I have tried that fix. And it was no help. I did not notice any leaks.
It would not surprise me if some sockets were being left open and eventually over utilized but I have checked with some sysinternals tools for that and again, nothing came back.

Any thing else you can recommend ?

by winterfrost

"can you recommend how to diagnose extra left open sockets from one to many daemons ? sometimes there are so many open other forked daemons running that I can't differentiate which are dependancies or which are a waste."

I'm not sure I'm exactly following you on this, but you could try "netstat -a" to get a list current network connections. If it is a telnet service running amok you could just filter out the telnet connections with: netstat -a | find "23"

At least it would show you who is connected to what, how many connections are left open, and in what state they are. Given the other malware you said you found on the server I'd be extra suspicious of unusual network activity...

This discussion is closed to new replies.