More details for: SSPI context / [DBNETLIB][ConnectionRead (recv()).] General network error

Hello together,

since over a week I've been looking to

find out the reason for two error messages I get from our users and

servers, unfortunately without success up to now.
I really hope you can help me.
We are using Win 2k servers with active directory and SQL Server 2000,

clients are all Win XP with SP2. Versions of access are 2002 &

2003. The errors are userspecific and occur in both versions. The

SQL-Servers are accessed with an adp-file in 2002-format.
We have one usergroup which is member of specially many groups. This

affects the size of their windows access token which becomes constantly

larger. In order to enable those users to still access their mailboxes

on our Exchange servers, the DWORD entry "MaxTokenSize" with the

decimal value "65535" was made to the newly created key "Parameters" of

their registry branch

"HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos ".
Since then those users can not access any of our SQL Servers using the

windows authentification. One of them gets the error

"[DBNETLIB][ConnectionRead(recv().] General network error. Check your

network documentation.", the others the error "Check connection:

Failed: Cannot generate SSPI context".
In case of resetting the registry entries (by deleting them), the one

user receives the same error message as the rest while it doesn't make

any difference to those (but at least they can't connect to their

mailboxes).
After having researched the web, I realised in one of the SQL-Servers

logfiles the entry "Invalid buffer received from client.." which lead

me to start to believe it could have to do something with the kerberos

encryption in the first place. Therefore I asked if changes to the

tokensize had been made. I applied the change with "EXEC sp_configure

'network packet size', 65535 RECONFIGURE" on our testsystem and "EXEC

sp_configure" confirms that the value is run.
Consequence: The entry in the SQL Server log doesn't appear any longer, but the users still receive their error messages.
Do you have any hints?
Your comments will be highly appreciated!
Regards,

caracol

Hi, CaraCol

Your case seems interesting. The error you hit is very general and could has various causes. So, please first check following blogs to see whether they resolved your problem:

http://blogs.msdn.com/sql_protocols/archive/2006/12/02/understanding-kerberos-and-ntlm-authentication-in-sql-server-connections.aspx

http://blogs.msdn.com/sql_protocols/archive/2005/10/15/481297.aspx

http://blogs.msdn.com/sql_protocols/archive/2005/10/19/482782.aspx

http://blogs.msdn.com/sql_protocols/archive/2007/01/02/cannot-generate-sspi-context-error-message-poisoned-dns.aspx

If they not, can you provide more detail answer about your system configuration by fllowing up the guideline:

http://forums.microsoft.com/MSDN/ShowPost.aspx?PostID=362498&SiteID=1

Thanks!

Ming

|||Hi Ming,

thanks for your informationsites. I had already tried out parts of it but reviewed them all the same.

The SPN does work correctly, otherwise our other usersgroups wouldn't be able to connect to our servers. I double checked this by setspn -l domain\accountname and got the desired result on the rigth port.

When turning on Named Pipes and restarting the instance on the serverside while activating NP on the clientside only (cliconfig.exe), we get the error message "Error on testing the connection while initialising the provider. [DBNETLIB][ConnectionOpen (Connect()).] SQL Server does not exist or access denied" (My error messages are translated from our german clients).

We are running SQL Servers 2000 Standard English Edition (8.00.760 SP3) on English W2k servers with SP4 and we use named instances with TCP/IP only.
Our clients are WinXP Pro with SP2 and Access 2002 (MDAC 2.70.7713.0) or Access 2003 (MDAC 2.81.1117.0). Connection is made by Access.
Aliases are not existent.
The service account is a domain administrator.
Service of WinXP SP2 Firewall is deaktivated or the firewall is configured as inactive.
There is no encryption enforcement.
Users are local admins.
We have installed Trend Micro Server Protect / Antivir Corporate Edition 5.58 respectively on every machine. A firewall is not provided by this version.

The Clients are shut down every day, so I doubt deleting the cached credentials when they should be deleted after every restart would make any difference.

Do you have any ohter hints?

Thanks again.

Regards,
caracol|||

Hi, Caracol

Sorry, I am confused the error you came across, is it "Can not generate SSPI Context" or " General Network Error"? If it is the latter, [DBNETLIB][ConnectionRead (recv()) indicates connection failed during your DB operation, so, please try

1) http://blogs.msdn.com/sql_protocols/archive/2006/04/12/574608.aspx

2) Open SQL Server Profile, repro the issue, see which specific client operation caused the failure, also, check server ERRORLOG or EventLog to find clue.

3) What if you enable NP on the SQL Server, and make np connection from client, see whether same issue occured? Or at least whether the "SSPI Context" error persist?, If so, that might due to your domain configuration issue.

BTW, It'd better upgrade your SQL Server 2000 from SP3 to SP4, this might be a known issue in SP3 but fixed in SP4 or SQL 2005.

Good Luck!

Ming.

|||

http://support.microsoft.com/kb/814401

http://www.sqlservercentral.com/columnists/cmiller/cannotgeneratesspicontext.asp

|||Hi Satya,

thanks for your interest, but your links are just some of the standard ones I came over a dozen times.

Regards,
caracol|||Hi Ming,

thanks again for your enthusiasm.

As I described, I got different messages depending on the configuration.

TCP/IP:
Quote:
"Since then those users can not access any of our SQL Servers using the windows authentification. One of them gets the error "[DBNETLIB][ConnectionRead(recv().] General network error. Check your network documentation.", the others the error "Check connection: Failed: Cannot generate SSPI context"."
-> This ist the configuration I started with and where the error occured the first time.

NP:
Quote:
"When turning on Named Pipes and restarting the instance on the serverside while activating NP on the clientside only (cliconfig.exe), we get the error message "Error on testing the connection while initialising the provider. [DBNETLIB][ConnectionOpen (Connect()).] SQL Server does not exist or access denied" (My error messages are translated from our german clients)."
-> This is what I tried later on to see if changing access method might succeed.

I have no idea, why this specific user on TCP/IP gets the error "[DBNETLIB][ConnectionRead(recv().]" while the rest gets
"Check connection: Failed: Cannot generate SSPI context". It must have to do with the profile, though, as it doesn't matter on which client he's logged on.

Quote from your last answer:
{1) http://blogs.msdn.com/sql_protocols/archive/2006/04/12/574608.aspx }
-> I already got over this due to your post from 01-02-2007, it was one of the sublinks over there. Therefore, this info was not helpful this time.

{2) Open SQL Server Profile, repro the issue, see which specific client operation caused the failure, also, check server ERRORLOG or EventLog to find clue.}
-> Standard to revise the logs again, so not helpful. I described that the users can't even log in to SQL server any longer, and that access 2002 / 2003 is this client. It is nothing else than access' standard connection that doesn't work, nothing of specific client operation.

{3) What if you enable NP on the SQL Server, and make np connection from client, see whether same issue occured? Or at least whether the "SSPI Context" error persist?, If so, that might due to your domain configuration issue.}
-> I wrote that I already had tried out NP, again Quote:
"When turning on Named Pipes and restarting the instance on the serverside while activating NP on the clientside only (cliconfig.exe), we get the error message "Error on testing the connection while initialising the provider. [DBNETLIB][ConnectionOpen (Connect()).] SQL Server does not exist or access denied" (My error messages are translated from our german clients)." So, not helpful, as I already decribed which error the users get in this case.

{BTW, It'd better upgrade your SQL Server 2000 from SP3 to SP4, this might be a known issue in SP3 but fixed in SP4 or SQL 2005.}
-> Finally another idea, thanks. As we have one version on every server worldwide, I'm in no possition to just install SP4 on one or a few of them, but I'll make the proposition to upgrade worldwide to SP4. We'll at least try this out in our test environment and see if it is of any help, although {"this might be a known issue in SP3 but fixed in SP4 or SQL 2005"} is not what commercial operations consider to be trustworthy or even professional. (This is meant as hint for MS, not to you personally.)

Nevertheless, I thank you very much for taking your time again to try to assist me.

Regards,
caracol

More details for: SSPI context / [DBNETLIB][ConnectionRead (recv()).] General network error

Hello together,

since over a week I've been looking to

find out the reason for two error messages I get from our users and

servers, unfortunately without success up to now.
I really hope you can help me.
We are using Win 2k servers with active directory and SQL Server 2000,

clients are all Win XP with SP2. Versions of access are 2002 &

2003. The errors are userspecific and occur in both versions. The

SQL-Servers are accessed with an adp-file in 2002-format.
We have one usergroup which is member of specially many groups. This

affects the size of their windows access token which becomes constantly

larger. In order to enable those users to still access their mailboxes

on our Exchange servers, the DWORD entry "MaxTokenSize" with the

decimal value "65535" was made to the newly created key "Parameters" of

their registry branch

"HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos ".
Since then those users can not access any of our SQL Servers using the

windows authentification. One of them gets the error

"[DBNETLIB][ConnectionRead(recv().] General network error. Check your

network documentation.", the others the error "Check connection:

Failed: Cannot generate SSPI context".
In case of resetting the registry entries (by deleting them), the one

user receives the same error message as the rest while it doesn't make

any difference to those (but at least they can't connect to their

mailboxes).
After having researched the web, I realised in one of the SQL-Servers

logfiles the entry "Invalid buffer received from client.." which lead

me to start to believe it could have to do something with the kerberos

encryption in the first place. Therefore I asked if changes to the

tokensize had been made. I applied the change with "EXEC sp_configure

'network packet size', 65535 RECONFIGURE" on our testsystem and "EXEC

sp_configure" confirms that the value is run.
Consequence: The entry in the SQL Server log doesn't appear any longer, but the users still receive their error messages.
Do you have any hints?
Your comments will be highly appreciated!
Regards,

caracol

Hi, CaraCol

Your case seems interesting. The error you hit is very general and could has various causes. So, please first check following blogs to see whether they resolved your problem:

http://blogs.msdn.com/sql_protocols/archive/2006/12/02/understanding-kerberos-and-ntlm-authentication-in-sql-server-connections.aspx

http://blogs.msdn.com/sql_protocols/archive/2005/10/15/481297.aspx

http://blogs.msdn.com/sql_protocols/archive/2005/10/19/482782.aspx

http://blogs.msdn.com/sql_protocols/archive/2007/01/02/cannot-generate-sspi-context-error-message-poisoned-dns.aspx

If they not, can you provide more detail answer about your system configuration by fllowing up the guideline:

http://forums.microsoft.com/MSDN/ShowPost.aspx?PostID=362498&SiteID=1

Thanks!

Ming

|||Hi Ming,

thanks for your informationsites. I had already tried out parts of it but reviewed them all the same.

The SPN does work correctly, otherwise our other usersgroups wouldn't be able to connect to our servers. I double checked this by setspn -l domain\accountname and got the desired result on the rigth port.

When turning on Named Pipes and restarting the instance on the serverside while activating NP on the clientside only (cliconfig.exe), we get the error message "Error on testing the connection while initialising the provider. [DBNETLIB][ConnectionOpen (Connect()).] SQL Server does not exist or access denied" (My error messages are translated from our german clients).

We are running SQL Servers 2000 Standard English Edition (8.00.760 SP3) on English W2k servers with SP4 and we use named instances with TCP/IP only.
Our clients are WinXP Pro with SP2 and Access 2002 (MDAC 2.70.7713.0) or Access 2003 (MDAC 2.81.1117.0). Connection is made by Access.
Aliases are not existent.
The service account is a domain administrator.
Service of WinXP SP2 Firewall is deaktivated or the firewall is configured as inactive.
There is no encryption enforcement.
Users are local admins.
We have installed Trend Micro Server Protect / Antivir Corporate Edition 5.58 respectively on every machine. A firewall is not provided by this version.

The Clients are shut down every day, so I doubt deleting the cached credentials when they should be deleted after every restart would make any difference.

Do you have any ohter hints?

Thanks again.

Regards,
caracol|||

Hi, Caracol

Sorry, I am confused the error you came across, is it "Can not generate SSPI Context" or " General Network Error"? If it is the latter, [DBNETLIB][ConnectionRead (recv()) indicates connection failed during your DB operation, so, please try

1) http://blogs.msdn.com/sql_protocols/archive/2006/04/12/574608.aspx

2) Open SQL Server Profile, repro the issue, see which specific client operation caused the failure, also, check server ERRORLOG or EventLog to find clue.

3) What if you enable NP on the SQL Server, and make np connection from client, see whether same issue occured? Or at least whether the "SSPI Context" error persist?, If so, that might due to your domain configuration issue.

BTW, It'd better upgrade your SQL Server 2000 from SP3 to SP4, this might be a known issue in SP3 but fixed in SP4 or SQL 2005.

Good Luck!

Ming.

|||

http://support.microsoft.com/kb/814401

http://www.sqlservercentral.com/columnists/cmiller/cannotgeneratesspicontext.asp

|||Hi Satya,

thanks for your interest, but your links are just some of the standard ones I came over a dozen times.

Regards,
caracol|||Hi Ming,

thanks again for your enthusiasm.

As I described, I got different messages depending on the configuration.

TCP/IP:
Quote:
"Since then those users can not access any of our SQL Servers using the windows authentification. One of them gets the error "[DBNETLIB][ConnectionRead(recv().] General network error. Check your network documentation.", the others the error "Check connection: Failed: Cannot generate SSPI context"."
-> This ist the configuration I started with and where the error occured the first time.

NP:
Quote:
"When turning on Named Pipes and restarting the instance on the serverside while activating NP on the clientside only (cliconfig.exe), we get the error message "Error on testing the connection while initialising the provider. [DBNETLIB][ConnectionOpen (Connect()).] SQL Server does not exist or access denied" (My error messages are translated from our german clients)."
-> This is what I tried later on to see if changing access method might succeed.

I have no idea, why this specific user on TCP/IP gets the error "[DBNETLIB][ConnectionRead(recv().]" while the rest gets
"Check connection: Failed: Cannot generate SSPI context". It must have to do with the profile, though, as it doesn't matter on which client he's logged on.

Quote from your last answer:
{1) http://blogs.msdn.com/sql_protocols/archive/2006/04/12/574608.aspx }
-> I already got over this due to your post from 01-02-2007, it was one of the sublinks over there. Therefore, this info was not helpful this time.

{2) Open SQL Server Profile, repro the issue, see which specific client operation caused the failure, also, check server ERRORLOG or EventLog to find clue.}
-> Standard to revise the logs again, so not helpful. I described that the users can't even log in to SQL server any longer, and that access 2002 / 2003 is this client. It is nothing else than access' standard connection that doesn't work, nothing of specific client operation.

{3) What if you enable NP on the SQL Server, and make np connection from client, see whether same issue occured? Or at least whether the "SSPI Context" error persist?, If so, that might due to your domain configuration issue.}
-> I wrote that I already had tried out NP, again Quote:
"When turning on Named Pipes and restarting the instance on the serverside while activating NP on the clientside only (cliconfig.exe), we get the error message "Error on testing the connection while initialising the provider. [DBNETLIB][ConnectionOpen (Connect()).] SQL Server does not exist or access denied" (My error messages are translated from our german clients)." So, not helpful, as I already decribed which error the users get in this case.

{BTW, It'd better upgrade your SQL Server 2000 from SP3 to SP4, this might be a known issue in SP3 but fixed in SP4 or SQL 2005.}
-> Finally another idea, thanks. As we have one version on every server worldwide, I'm in no possition to just install SP4 on one or a few of them, but I'll make the proposition to upgrade worldwide to SP4. We'll at least try this out in our test environment and see if it is of any help, although {"this might be a known issue in SP3 but fixed in SP4 or SQL 2005"} is not what commercial operations consider to be trustworthy or even professional. (This is meant as hint for MS, not to you personally.)

Nevertheless, I thank you very much for taking your time again to try to assist me.

Regards,
caracol

monitoring sql server log

can somebody help me with script to monitor the sql server
log for errors/messages? thanks.use xp_readerrorlog
>--Original Message--
>can somebody help me with script to monitor the sql
server
>log for errors/messages? thanks.
>.
>

Monitoring SQL Server Error Message - Severity Level Messages

Hello,
Do SQL server error messages (severilty level messages 11-16 & 17-25),
both 2000 & 2005, get written to the Windows Application Log, as well
as, the SQL server error log? I mainly monitor the server externally
(Windows Event Logs) and would like to NOT have to configure a MAPI
client on SQL to receive the SQL server severity errors.
Thanks,
Dan
The ones that are written to the errorlog are also written to the eventlog.
However, whether an error is to be written to eventlog/errorlog depends on whether it is configured
to do so. In 2000, sysmessages table, check the dlevel column. In 2005, check sys.messages. In 2000,
you can specify whether an error is to be logged (using sp_altermessage), but not in 2005.
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://sqlblog.com/blogs/tibor_karaszi
"danfoxley@.anon.postalias" <danfoxley@.gmail.com> wrote in message
news:1187251441.579647.169310@.i38g2000prf.googlegr oups.com...
> Hello,
> Do SQL server error messages (severilty level messages 11-16 & 17-25),
> both 2000 & 2005, get written to the Windows Application Log, as well
> as, the SQL server error log? I mainly monitor the server externally
> (Windows Event Logs) and would like to NOT have to configure a MAPI
> client on SQL to receive the SQL server severity errors.
> Thanks,
> Dan
>

Monitoring SQL Server Error Message - Severity Level Messages

Hello,
Do SQL server error messages (severilty level messages 11-16 & 17-25),
both 2000 & 2005, get written to the Windows Application Log, as well
as, the SQL server error log? I mainly monitor the server externally
(Windows Event Logs) and would like to NOT have to configure a MAPI
client on SQL to receive the SQL server severity errors.
Thanks,
DanThe ones that are written to the errorlog are also written to the eventlog.
However, whether an error is to be written to eventlog/errorlog depends on whether it is configured
to do so. In 2000, sysmessages table, check the dlevel column. In 2005, check sys.messages. In 2000,
you can specify whether an error is to be logged (using sp_altermessage), but not in 2005.
--
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://sqlblog.com/blogs/tibor_karaszi
"danfoxley@.anon.postalias" <danfoxley@.gmail.com> wrote in message
news:1187251441.579647.169310@.i38g2000prf.googlegroups.com...
> Hello,
> Do SQL server error messages (severilty level messages 11-16 & 17-25),
> both 2000 & 2005, get written to the Windows Application Log, as well
> as, the SQL server error log? I mainly monitor the server externally
> (Windows Event Logs) and would like to NOT have to configure a MAPI
> client on SQL to receive the SQL server severity errors.
> Thanks,
> Dan
>

Monitoring SQL Server Error Message - Severity Level Messages

Hello,
Do SQL server error messages (severilty level messages 11-16 & 17-25),
both 2000 & 2005, get written to the Windows Application Log, as well
as, the SQL server error log? I mainly monitor the server externally
(Windows Event Logs) and would like to NOT have to configure a MAPI
client on SQL to receive the SQL server severity errors.
Thanks,
DanThe ones that are written to the errorlog are also written to the eventlog.
However, whether an error is to be written to eventlog/errorlog depends on w
hether it is configured
to do so. In 2000, sysmessages table, check the dlevel column. In 2005, chec
k sys.messages. In 2000,
you can specify whether an error is to be logged (using sp_altermessage), bu
t not in 2005.
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://sqlblog.com/blogs/tibor_karaszi
"danfoxley@.anon.postalias" <danfoxley@.gmail.com> wrote in message
news:1187251441.579647.169310@.i38g2000prf.googlegroups.com...
> Hello,
> Do SQL server error messages (severilty level messages 11-16 & 17-25),
> both 2000 & 2005, get written to the Windows Application Log, as well
> as, the SQL server error log? I mainly monitor the server externally
> (Windows Event Logs) and would like to NOT have to configure a MAPI
> client on SQL to receive the SQL server severity errors.
> Thanks,
> Dan
>

Monitoring service broker

Hi!
We have next problem in production.
We have one target that accepts messages from many initiators. Some time target can not get message from some initiator. It may be due hardware problem, for example technitian switch off router. In general service broker succeed to receive all messages when hardware problem was solved (if it takes less than retantion time on initiator side). I would like to build some job that would look at queue of target and could say (or trigger) that from the initiator A for some period of time target did not get any message or did not succeed to close conversation or it constantly have some connectivity problem (like duplicated message).

Any idea?

There are various traces you can use that indicate potential problems, like Message Drop, Message Classify with the subclass Delayed or Connection with the subclass Closing (unless is a ordinary timeout close due to lack of activity). Using the sp_trace_... procedure(s) some automation can be built around them.

An easier solution is to monitor the sys.transmission_queue on all parties involved. If messages are building up, is an indication of a problem that needs to be investigated.

money for nothing that works

What is $5 and 15 minutes when it can make you earn $100,000 ?
Not much, if you ask me...
You've probably seen a lot of those kind of messages over forums and
newsgroups,
and the explanation for this can be given in two words: IT WORKS!
But how on earth, will you ask me, does it actually works? How is such a
thing
possible?
This is a simple pyramid scheme. To explain it to you with realistic
numbers,
lets take a simple example:
Imagine you folow the instructions given below, and post your message to
500
newsgroups (wich isn't much). 10 people read your message and also folow
the
instructions: that's $10 for you.
These 10 people get 10 people each to join the process: that's $100 for
you.
These 100 people get 10 people each to join the process: that's $1,000
for you!
These 1,000 people get 10 people each to join the process: that's
$10,000 for
you!!
These 10,000 people get 10 people each to join the process: that's
$100,000 for
you!!!
After the whole process, you have therefore made $111,110! And it took
you only
15 minutes and $5!
If you think this might work (and it does, I can tell you that), then
folow
these simple instructions:
1) Open a FREE PayPal account (!Business or Premier, not the simple
one!), and
place $5 on it.
2) Using PayPal, pay $1 to the folowing 5 e-mail adresses, with 'Mailing
list
subscription' as subject and no message.
1- monkysnaks@.comcast.net
2- troost19@.zonnet.nl
3- jp2rocks@.vat.it
4- rdl1978@.gmail.com
5- monique_sloan@.hotmail.com
3) Make the changes you want to this message, and remove e-mail adress
number 1.
Then, place e-mail adress number 2 in number 1, 3 in number 2, 4 in
number 3, 5
in number 4, and add your own e-mail adress (the one you used on
PayPal!) in
number 5.
4) Send your new message to all the newsgroups on your server (or at
least 500
of them)!
(!) I suggest you run a IP-hiding software like Steganos Internet Anonym
(free
download on www.steganos.com) while posting with UltraNNTP.
That's it! It will take you 15 minutes and will cost you $5, but it will
also
make you earn more than $100,000!
All you have to do now is wait, and check your inbox to see PayPal money
flying
to you!
So, what is $5 and 15 minutes when it can make you earn $100,000 ?And the chicks for free! :P