Share via

SharePoint 2007: Event IDs 7076, 6396 and 6482 Repeatedly Showing in the Event Logs of SharePoint Server

  • Article

Issue: Event IDs 7076, 6396 and 6482 repeatedly showing in the event logs of SharePoint server.

Errors:

Event Type:    Error
Event Source:    Windows SharePoint Services 3
Event Category:    Timer
Event ID:    6398
Date:        04/10/2013
Time:        12:11:08 PM
User:        N/A
Computer:    ++++++
Description:
The Execute method of job definition Microsoft.Office.Server.Administration.ApplicationServerAdministrationServiceJob (ID 6308384a-9a82-4571-b19b-28406b6e73d1) threw an exception. More information is included below.

Attempted to read or write protected memory. This is often an indication that other memory is corrupt.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:    Error
Event Source:    Office SharePoint Server
Event Category:    Office Server Shared Services
Event ID:    7076
Date:        04/10/2013
Time:        12:11:08 PM
User:        N/A
Computer:    ++++++
Description:
An exception occurred while executing the Application Server Administration job.
Message: Attempted to read or write protected memory. This is often an indication that other memory is corrupt. Techinal Support Details:
System.AccessViolationException: Attempted to read or write protected memory. This is often an indication that other memory is corrupt.
Server stack trace: 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:    Error
Event Source:    Office SharePoint Server
Event Category:    Office Server Shared Services
Event ID:    6482
Date:        04/10/2013
Time:        12:11:08 PM
User:        N/A
Computer:    ++++++
Description:
Application Server Administration job failed for service instance Microsoft.Office.Server.Search.Administration.SearchServiceInstance (65fcfbdb-354f-4c68-90a5-e7d36f638ed7).

Reason: Access to the path 'C:\WINDOWS\system32\drivers\etc\HOSTS' is denied.

Techinal Support Details:
System.UnauthorizedAccessException: Access to the path 'C:\WINDOWS\system32\drivers\etc\HOSTS' is denied.
   at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
   at System.IO.FileStream.Init(String path, FileMode mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32 bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath, Boolean bFromProxy)
   at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access,

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Background: Doing the daily health checks on the SharePoint Servers we found a lot of Event Ids 7076, 6396 and 6482 in Application event logs, repeated by every 13 minutes.

Troubleshooting: We didn’t find relevance to this error as such on the Server. However, to stop their occurrences on the server, we did research on the Internet and found a Hot fix which talked about the same issue.

Resolution: Microsoft has released a Hot fix to fix this issue and it is available at: http://support.microsoft.com/kb/946517

Reference:

http://blogs.technet.com/b/sharepointcomic/archive/2008/11/12/sharepoint-exception-errors-event-id-6398-event-id-6482-event-id-7076.aspx

http://blog.gavin-adams.com/2008/01/15/hotfix-released-for-time-job-errors-event-ids-7076-6398-6432-and-6482/

http://blogs.msdn.com/b/nickmac/archive/2008/01/31/event-7076-6398-6482-regularly-displayed-in-the-event-log-on-a-sharepoint-server.aspx?Redirected=true

Applies to: Windows server 2003 and SharePoint 2007.