Microsoft KB Archive/159840

= Access Violation in Services.exe Clearing Event Log When an Application Has the File Open =

Article ID: 159840

Article Last Modified on 11/1/2006

-

APPLIES TO


 * Microsoft Windows NT Workstation 3.51
 * Microsoft Windows NT Workstation 4.0 Developer Edition
 * Microsoft Windows NT Server 3.51
 * Microsoft Windows NT Server 4.0 Standard Edition

-



This article was previously published under Q159840



SYMPTOMS
If an application opens the event log file, and then someone tries to clear the event log, either interactively or by using an application, while the application still has the event log file open, Services.exe may quit with an access violation.

After Services.exe quits, RPC will no longer be available. After this occurs, %SystemRoot%\Drwtsn32.log will be created or updated. Often, NET USE sessions provided by the server remain active and new sessions can be established. The following messages may be returned to client requests involving the RPC services:

Error 1723: The RPC server is too busy to complete this operation.

-or-

Error 1722: The RPC server is unavailable.

-or-

Error 1721: Not enough resources are available to complete this operation.



RESOLUTION
Be sure the application closes the event log file before clearing the event log.



STATUS
Microsoft has confirmed this to be a problem in Windows NT versions 3.51 and 4.0. We are researching this problem and will post new information here in the Microsoft Knowledge Base as it becomes available.

Additional query words: eventlog

Keywords: kbbug KB159840

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.