Nime Cloud's questions

I need to create a custom event filter to trigger a scheduled task to recover a hung process.

Here is the event log in XML format:

  <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
   
    <System>
      <Provider Name="ASP.NET 4.0.30319.0" /> 
      <EventID Qualifiers="32768">1309</EventID> 
      <Level>3</Level> 
      <Task>3</Task> 
      <Keywords>0x80000000000000</Keywords> 
      <TimeCreated SystemTime="2020-09-26T23:01:21.884208100Z" /> 
      <EventRecordID>12229</EventRecordID> 
      <Channel>Application</Channel> 
      <Computer>Web-Srv2</Computer> 
      <Security /> 
    </System>
   
     <EventData>
      <Data>3005</Data> 
      <Data>An unhandled exception has occurred.</Data> 
      <Data>30336b89c6e34e1e98387c2026f928a3</Data> 
      <Data>14</Data> 
      <Data>11</Data> 
      <Data>0</Data> 
      <Data>/LM/W3SVC/2/ROOT/Web-2-132456334351742952</Data> 
      <Data>Full</Data> 
      <Data>/WebSYS</Data> 
      <Data>WEB-SRV2</Data> 
      <Data /> 
      <Data>3772</Data> 
      <Data>w3wp.exe</Data> 
      <Data>Exception</Data> 
      <Data>CACHE_DATABASE_CONNECTIONS : cache error! at Webserver.Caching.Cache.Put(String key, Object val) at very very very long text here</Data> 
    </EventData>
      
  </Event>

What would be the custom event filter? I've tried this one it has triggered:

<QueryList>
  <Query Id="0" Path="Application">
    <Select Path="System">*[System[(Level=3) and (EventID=1309)]]</Select>
  </Query>
</QueryList>

Then I wanted to combine error description and it didn't work:

<QueryList>
  <Query Id="0" Path="Application">
    <Select Path="System">*[System[(Level=3) and (EventID=1309)]] 
       and (Data='CACHE_DATABASE_CONNECTIONS$')
    </Select>
  </Query>
</QueryList>

I've got an entry level HPE SRV 778640R-B21 which supports dual CPU but comes with an E5-2603v3 (LGA2011-3 / DDR4). It has also 550W power supply.

I want to remove the current cpu and add a pair of E5-2690v4 if it's possible. If the power will be problem I can chose another pair of cpus like 2650 which consume lower watts.

I've googled but there is no clear info/datasheet. Is it possible to upgrade cpu or what would be your choice?

We run a main site and want to run a second site under /tesmer folder. On the demo site it works perfectly. When I upload it on a Windows server just /tesmer/ displayed correctly. Any subpages likes /tesmer/smmm-sinav-islemleri has got 404 error.

We use Url rewrite and it seems like url rewrite is faulty under IIS.

Working page under development site: http://demo.dijitall.net/izsm/tesmer/smmm-sinav-islemleri

Non-working page on IIS / Windows Server 2016 http://yeni.izsmmmo.org.tr/tesmer/smmm-sinav-islemleri

Below is the web.config file in /tesmer folder

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <system.webServer>
        <rewrite>
            <rules>
                <rule name="Imported Rule 10">
                    <match url="^([0-9a-zA-Z-_/]+)$" ignoreCase="false" />
                    <conditions logicalGrouping="MatchAll">
                        <add input="{REQUEST_FILENAME}" matchType="IsDirectory" ignoreCase="false" negate="true" />
                        <add input="{REQUEST_FILENAME}" matchType="IsFile" ignoreCase="false" negate="true" />
                    </conditions>
                    <action type="Rewrite" url="index.php?par={R:1}" appendQueryString="false" />
                </rule>
                <rule name="Imported Rule 20" stopProcessing="true">
                    <match url="^resimmap.xml$" ignoreCase="false" />
                    <action type="Rewrite" url="resimmap.php" />
                </rule>
            </rules>
        </rewrite>
        <httpErrors errorMode="Detailed" />
    </system.webServer>
</configuration>

What would be the solution? Correct url write rule or something else?

I couldn't create a VHD disk on a remote share (\\ortak\backup\lucasrv) because I supplied the wrong credentials, and saved them in the Remote File Browser dialog box.

I can create VHD disks at \\ortak2\backup\lucasrv, the test location.

How can I reset saved user credentials? I think the information is stored in Hyper-V Server 2012 because I've tried to add a disk from a different Hyper-V Manager with no luck. Resetting the user credentials in Hyper-V Manager won't help.

I just converted HP Proliant DL380 G7 Windows Server R2 Standard using Disk2Vhd utility. Removed a few HP based things, assigned static IP addresses and then rebooted.

When rebooted, there were no network adapters and no mouse capture. Somehow I've installed the network adapter and captured the mouse. Then rebooted again.

After every reboot the network adapter & related devices have lost. There is no Hyper-V Signal and other devices, either. I could discover "new" network device at Device Manager and I can see the lost one in hidden devices list. It seems like unplugged.

I've tried to remove every single device under System Devices and rebooted. Windows Server 2008 R2 Standard has initialized like a charm and an IP address has been assigned in a blink. Windows has discovered many devices again which I removed just before. I've booted again and viola! No mouse capture and no network adapters again.

I couldn't use Physical to Virtual Migration Wizard, it won't work.

What would be the wrong with that guest OS?

I use a relay server to deliver external mails. I use relay server's IP in SPF record. But I'm not sure about blacklist monitoring/checking. Should I check main server's IP or relay's IP?

This command clears all open UDP ports by DNS.EXE

net stop dns

After restarting the DNS service, DNS.EXE allocates 5000+ ports.

net start dns

It doesn't consume extensive memory or cpu. However I noticed/alarmed many http/smtp/pop3 connection problems to the server because of timeouts. I just examined and found tons of open ports by DNS.EXE. Currports displays UDP local ports from 50000 to 56000, local addresses are :: and remote addresses are empty. Last lines of netstat - a command are below:

UDP    [::]:55976             *:*   
UDP    [::]:55977             *:*   
UDP    [::]:55978             *:*     
UDP    [::]:55979             *:*     
UDP    [::]:55980             *:*     
UDP    [::]:55981             *:*     
UDP    [::]:55982             *:*    

I didn't notice these ports before, so I don't know for sure it is ok or not. What do you think? I did restart the server and monitoring/alert mails are NOT continuing.

Somehow IIS resists to bind any/exist/new site on another IP. To test I did bind POP3 service on other IP:port80 and telnet successfully.

HTTP service won't start on other IP:port

What's wrong with IIS?

UPDATE: More info for non-skilled people:

Network adapter has many IP addresses like below: x.y.z.42 (primary) x.y.z.43 x.y.z.44 x.y.z.45

I can ping all of them. 43 is the default IP for web service. I can telnet x.y.z.43 80 with no problem.

I've added a test site runs on IP x.y.z.43, I can navigate it, telnet it. Everything is ok.

I've also added another binding that test site: x.y.z.44, however I cannot navigate site at http://x.y.z.44, or cannot telnet.

netstat displays only x.y.z.43:80 as listening. So there is no service binding on IP x.y.z.44.

I've removed the ip 44, configured POP3 service to run on ip x.y.z.44 port 80. I could telnet port 80. So there was nothing on port 80, it was unused.

It's Windows Server 2008 Standard. I'm not working from a remote pc, so firewall or internet connection & remote access won't block me. I can start a service on ip x.y.z:44 port:80 and make a connection. In short; IIS resists to start on another IP except x.y.z.43.

I've examined Event Log but no luck. I think I have to take a look to text logs of IIS, etc.

Server seems like modified a lot. I cannot start/run/do many tasks like Task Manager, Server Backup, commandline password change, etc.

User names, full names don't match with their descriptions. Now Administrator may not be the administrator.

I cannot enable/disable accounts.

Server is being used as bruteforce attacker: DuBrute was running.

I tried to reboot, SAM init error occured & BSOD appeared. I could recover SAM file from older copy.

Now I cannot do many things. It looks like the server has been hacked a week ago - file creation dates say-

I found a few registry files like this one: HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin

Can I clear that mess or I have to restore from backup?

Yesterday I've installed Hyper-V 2012 and I've forgotten to plug Intel LAN card. Hyper-V has detected built-in Atheros LAN device. Now how can I install the external LAN card automatically? Should I use pnputil and driver CD?

I need to use Fortigate 60 as gateway. I just switched to NAT mode.

Gateway IP from ISP: XXX.255.136.41 - 255.255.255/48 Real IP from ISP - WAN2 IP: XXX.255.136.45 Internal IP : 192.168.35.1

I can ping those IP adresses from local & internet. However I cannot use 192.168.35.1 as gateway on my Windows 7.

I've added ALL ALLOW ANYTIME ANYWHERE firewall policy. I've added 0.0.0.0 / 0.0.0.0 internal > XXX.255.136.41 static route as trial. I've added 0.0.0.0 / 0.0.0.0 WAN2 > XXX.255.136.41 static route as trial.

Now I can't ping 8.8.8.8.

What are the correct settings to make Fortigate a gateway?

You know Live Messenger is over and we have to migrate to Skype. I got two choices to do that on 40+ computers under the domain.

1. Give standard users permission to install software.
2. Automatically/centrally install the software.

Can I do the 2nd choice and how?

Because of high CPU usage by the lsass.exe process I googled then discovered the guest account is enabled. I disabled it yesterday & rebooted, as the result CPU usage became normal.

Today I checked the things again and found Guest is disabled, at Task Manager it says Guest disconnected and lsass.exe gone crazy. I forced to logoff Guest. CPU is ok again.

What could cause this?

It seems it doesn't support APIs, cannot create user, cannot change password, etc. forum.mailenable.com keeps the answer as secret.

  If oLogin.getLogin() Then

          oLogin.Password = newpass              
          ChangeResult = oLogin.EditLogin(oLogin.UserName, oLogin.Status, oLogin.Password, oLogin.Account, oLogin.Description, 0, 0, 0, oLogin.Rights)

   End If   

ChangeResult may contain 1 (success) but the result might not be OK in real; that's what my problem is.

I've built two similar Hyper-V servers. One is OK but other Windows Hyper-V Core fails in 1~4 days (BSODs with different reasons).

The only different parts are CPU & RAM. Now I'm testing the failed server with MemTest86+ and got an error; Test:8 Pass: 0 ...etc Count: 1

Is this error fatal? There are 4 modules of 4GB RAMs without ECC.

I got an Hyper-v core box and I need to turn automatic restart on. How can I do that?

I run IIS on Windows 2008 R2 Standart Edition & bind IIS on a public IP. At my desktop PC, I cannot open any non-asp files if my IP is local -ie 192.168.35.45-

I can open

• http://mysite.com/test.asp

I cannot open

• http://mysite.com/test.css (same file, renamed)
• http://mysite.com/test.txt (same file, renamed)
• http://mysite.com/a-test-image.jpg

I can open all these files if I use ktunnel/proxy

I can open all these files if I use real IP in TCP/IP settings on my desktop

As you guess all links are accessible from the internet

I want to move pagefile.sys from C: -HDD- to S: -SSD- on Hyper-V Core. I just upgraded RAM from 8GB to 16GB. 8GB was pretty enough. I also want to move guest OSes' pagefiles to SSD as .VHD format. Primary virtual Windows Server SBS has 6GB RAM and it's pagefile is 6GB too. At the end SSD will contain Hyper-V & and guest OSes' pagefiles. SSD can read/write up to 300MB/sn, average 80MB/sn.

Current Hyper-V pagefile is 8GB (RAM amount) and will be 16GB. I think 16GB is not necessary. Can I keep it as 8GB? And what you think about my idea; all paging files are in a SSD?