A customer was having a problems with Central Administration. The backups would fail. Creating a new web application would fail. IIS manager couldn't be opened. An IISRESET sorted the problem temporarily but it soon came back.

Symptoms

I noticed the event log was generating 6 types of events at regular intervals since the 26/6/8. They were:

7076 Attempted to read or write to protected memory
7076 Exception from HRESULT 0x80005006
6482 Attempted to read or write to protected memory
6482 Exception from HRESULT 0x80005006
6398 Attempted to read or write to protected memory
6398 Exception from HRESULT 0x80005006

They are all problems with the Application server administration Job.

Answer

I stopped the errors and the behaviour by doing two things:

Installed hot fix 923028 for .NET 2.0
Re-entered the username and password for the SharePoint timer job service

I've been told that for event 6398 you should check that he SSP service account is a member of the local WSS_ADMIN_WPG group on all query and index servers.

Posted at 9:50 AM by EUROPE\mmunslow | Permalink | Email this Post | Comments (12)

Comments

Very cool

Thanks for posting this. I had the same problem although that crept up while I was attempting to delete some sites.

at 7/26/2007 5:37 PM

This does not work always

Hi. My name is Amol and I am a engineer at Microsoft. I came accross this article and would like to add a note to this thread. The problem with resolution is that it might not work on all the systems or on all the occasions. The event ID may pop up after 8-9 hours or even after one month. If you are not getting the error then you are lucky.... :)

Anyways for the ones who get this error may have to wait for MOSS 2007 SP1 and the ETA is not yet final.

Thank You.

Amol Ghanwat.

at 8/24/2007 9:08 AM

Thanks, I found the same thing

I'll try your fix.

at 8/25/2007 8:58 AM

Hotfix, SP1 Applied

I have these exact errors on my application server which run my central admin web also. I've reset the passwords, checked the WSS_ADMIN_WPG, applied the 923028 hotfix, and applied SP1 for WSSv3/MOSS/.NET 2.0/.Net 3.0, the errors remain :( Like Amol said, sometimes weeks go by and I don't see the errors. Then, randomly, they appear again.

at 1/3/2008 8:35 PM

Possible Workaround

Indeed, I noticed that SPAdmin throws a Memory violation exception and than start to write all these error to Event Log. I liked the solution in

http://soerennielsen.wordpress.com/2007/06/29/%e2%80%9dnot-enough-storage%e2%80%9d-event-log-error/

The author says:

However a simple work around is to schedule a task to restart your SPTimer service once a day. Not the server, not SharePoint, just the service.

There should no adverse side-effects to this as it is a proper service shutdown that should allow any running jobs to terminate prior to termination.

So, create a bat file “Restart SPTimer.bat” containing these lines:

net stop “Windows SharePoint Services Timer”
net start “Windows SharePoint Services Timer”

Schedule it to run once every night with the windows task scheduler.

Simple does it. Don’t care to waste any more time on this issue, don’t you all agree?

at 1/12/2008 2:05 AM

Hotfix for this issue available

Hi Amol - from what I've read, it's an IIS issue (SP1 for MOSS and WSS 3.0 did not address this) and there's a hotfix (KB 946517) available now to address these three events. This and this are my references. Hope this is useful to everyone out there...

at 1/24/2008 10:42 AM

Top issue in SP1

Hi People, The event ID issue that we are discussing here is solved by Office Server SP1. It was the top issue with Microsoft and we have worked hard here. If you face the event ID error, then go ahead and install SP1 for MOSS. Thanks Amol Ghanwat.

at 1/28/2008 6:59 PM

Event ID: 6394 et al.,

Hi,

I had this problem resolved. The solution to apply the hotfix KB923028 (.NET 2.0) may not be possible in an environment where .2.0 SP1 and .NET 3.0 SP1 is installed, along with WSS 3.0 SP1 and MOSS 2007 SP1.

The solution in this scenario is to re-install (note: do not uninstall) by choosing "Change" option from "Add/Remove Programs" both .NET 2.0SP1 and .NET 3.0 SP1 conmponents. After a succesful completionrestart the server.

Hope this helps.

at 1/31/2008 1:26 PM

Thanks a lot

Thanks a lot http://www.roro44.com

at 2/7/2008 1:04 AM

Not resolved

I have a new fresh MOSS 2007 install with 3 WFE's, patched fully with WSS SP1 and MOSS SP1, and continue to have all 3 event log errors.

I will be trying to install the IIS hotfix next.

Restarting the Timer Service does temporarily fix the problem.

Bryan Davis

bryan.davis@berbee.com

at 2/25/2008 9:28 AM

Only getting the event id: 6482 every minute in 1 WFE server

Hi,

This post talks about three event ids. I am getting just the single error in my event logs (event id: 6482).

So, will the work-arounds given here solve my purpose too. If yes, can you tell me what would be the final fix to this issue.

1. Amol's Ofice Server SP1, or

2. Hotfix KB923028

3. Restart timer service

4. Apply hotfix KB 946517

Please reply. These errors are making my event logs look awful. Each minute i get this error.

Thanks,

Sid

at 8/31/2009 7:36 AM

Whats the error?

What is the error you are getting? 6482 can be logged for any number of reasons. Also worth having a dig around in the ULS logs too.

Regards,

Chris Whitehead (PFE)

at 9/24/2009 2:27 PM

Add Comment

Items on this list require content approval. Your submission will not appear in public views until approved by someone with proper rights. More information on content approval.

Title (required) *

Body (required) *

Name (required) *

Are you a bot? *

Anti-Spam Filter 1

What's 10+4? *

Anti-Spam Filter 2

Attachments