Microsoft Windows Server 2003-only NLB Events

Article
10/08/2009

Applies To: Windows Server 2003 with SP1

These events are new in Windows Server 2003 and are therefore only logged on computers running Windows Server 2003.

Event ID: 51

Alert Severity: E

Event Text: NLB Cluster %2 %1: Cannot bind NLB to this adapter due to memory allocation failure. %3 %4

Error Message Explanation: This event is logged when there is not enough memory to bind Network Load Balancing to this network adapter.

User Action: To increase the amount of available memory, try one or more of the following:

Add additional random access memory (RAM) to the host.
Close programs on the host that might be consuming memory.
Force the NLB driver to reload. Reloading will occur if you restart the host or disable all network adapters that are bound to NLB and then re-enable those adapters.

Event ID: 52

Alert Severity: I

Event Text: NLB Cluster %2 %1: Registry parameters successfully reloaded without resetting the driver. %3 %4

Error Message Explanation: Certain changes, such as adding a new port rule, require Network Load Balancing to be stopped and restarted. Other changes do not require NLB to be stopped and restarted. This event is logged to inform you that changes were made to the NLB configuration which did not require NLB to be stopped and restarted.

User Action: No user action is required.

Event ID: 53

Alert Severity: E

Event Text: NLB Cluster %2 %1: The adapter to which NLB is bound does not support dynamically changing the MAC address. NLB will not bind to this driver. %3 %4

Error Message Explanation: To be operated in unicast mode, Network Load Balancing must alter the unicast MAC address on the network adapter that it will be using. This event is logged when the network adapter to which NLB is trying to bind does not support dynamic changing of its unicast MAC address.

User Action: Replace the network adapter with one that supports changing the unicast MAC address dynamically. Alternatively, operate the cluster in multicast mode.

Event ID: 54

Alert Severity: W

Event Text: NLB Cluster %2 %1: Host %3 MAY be a Windows 2000 or NT 4.0 host participating in a cluster utilizing virtual cluster support. Virtual Clusters are only supported in a homogeneous Windows Server 2003 cluster. %4

Error Message Explanation: Virtual clusters, which are Network Load Balancing clusters where specific port rules are assigned to specific virtual IP addresses, are configured on this host, but at least one host in this cluster has one or more port rules that are not valid and appear to be missing the virtual IP address specification. Therefore, either:

A Windows 2000 or Windows NT 4.0 host exists in the cluster. Virtual clusters require a cluster containing only hosts running products in the Windows Server 2003 family, or
A Windows Server 2003 host with an incorrectly configured port rule exists in the cluster.

The cluster will not converge until the problem is corrected.

User Action: If there is a Windows 2000 or Windows NT 4.0 host in the cluster, either remove it or stop using virtual clusters on the Windows Server 2003 hosts.

If the cluster contains only Windows Server 2003 hosts, then use NLB Manager to check the port rule configuration of all hosts to ensure that all hosts have compatible port rule configurations.

For more information about virtual clusters and port rules, see Network Load Balancing in Help and Support.

Event ID: 55

Alert Severity: E

Event Text: NLB Cluster %2 %1: Inconsistent bi-directional affinity (BDA) teaming configuration detected on host %3. The team in which this cluster participates will be marked inactive and this cluster will remain in the converging state until consistent teaming configuration is detected. %4

Error Message Explanation: A bidirectional affinity (BDA) team is a set of adapters on a single host that act in concert. This event is logged when the local host and the remote host specified in the message have inconsistent BDA configurations. The BDA configuration must be identical on all hosts in a cluster. This is enforced through the Network Load Balancing heartbeat mechanism. The cluster will not converge until the problem is corrected.

User Action: If this event is followed by an NLB 58 event in Event Viewer, no user action is needed. If this event is not followed by an NLB 58 event, then you need to change your BDA configuration. BDA configuration is specified by the Microsoft Internet Security and Acceleration Server (ISA Server) configuration. For more information about configuring BDA, see the relevant ISA Server documentation.

Event ID: 56

Alert Severity: E

Event Text: NLB Cluster %2 %1: Invalid bi-directional affinity (BDA) teaming port rules detected. Each member of a BDA team may have no more than one port rule whose affinity must be single or class C if multiple host filtering is specified. To add this cluster to a team, correct the port rules and run 'wlbs reload' followed by 'wlbs start'. %3 %4

Error Message Explanation: A bidirectional affinity (BDA) team is a set of adapters on a single host that act in concert. A team ID identifies the different network adapters that belong to the same BDA team. The team ID is a {GUID} that uniquely identifies the team to which an adapter belongs. This event is logged when this adapter has been configured as a member of a BDA team, but the specified team ID is either missing or not valid.

User Action: Correct the BDA team ID, and then run nlb reload' followed by 'nlb start'. BDA configuration is specified by the Microsoft Internet Security and Acceleration Server (ISA Server) configuration. For more information about configuring BDA, see the relevant ISA Server documentation.

Event ID: 57

Alert Severity: E

Event Text: NLB Cluster %2 %1: Invalid bi-directional affinity (BDA) team ID detected. Team IDs must be a GUID of the form {xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx}. To add this cluster to a team, correct the team ID and run 'wlbs reload' followed by 'wlbs start'. %3 %4

Error Message Explanation: A bidirectional affinity (BDA) team is a set of adapters on a single host that act in concert. This event is logged when this adapter has been configured as a member of a BDA team, but the configured port rules do not comply with the requirements for using BDA. The use of BDA requires a single port rule that covers all ports (0 65535), configured as either Single or Class C affinity.

User Action: Correct the BDA teaming port rules, and then run nlb reload' followed by 'nlb start'. BDA configuration is specified by the Microsoft Internet Security and Acceleration Server (ISA Server) configuration. For more information about configuring BDA, see the relevant ISA Server documentation.

Event ID: 58

Alert Severity: I

Event Text: NLB Cluster %2 %1: Consistent bi-directional affinity (BDA) teaming configuration detected again. The team in which this cluster participates has been re-activated. %3 %4

Error Message Explanation: A bidirectional affinity (BDA) team is a set of adapters on a single host that act in concert. This event is logged to inform you that a valid and consistent BDA configuration has been detected and therefore the team has been activated.

User Action: No user action is required.

Event ID: 59

Alert Severity: I

Event Text: NLB Cluster %2 %1: The bi-directional affinity (BDA) team which this cluster has attempted to join already has a designated master. This cluster will not join the team and will remain in the stopped state until the parameter errors are corrected and the cluster is restarted by running 'wlbs reload' followed by 'wlbs start'. %3 %4

Error Message Explanation: A bidirectional affinity (BDA) team is a set of adapters on a single host that act in concert. A single adapter from each team must be assigned the role of master for that team. This event is logged when this adapter attempts to join a BDA team as the master but the team already has an active master.

User Action: Correct the BDA team parameters, and then run nlb reload' followed by 'nlb start'. BDA configuration is specified by the Microsoft Internet Security and Acceleration Server (ISA Server) configuration. For more information about configuring BDA, see the relevant ISA Server documentation.

Event ID: 60

Alert Severity: I

Event Text: NLB Cluster %2 %1: The bi-directional affinity (BDA) team in which this cluster participates has no designated master. The team is inactive and will remain inactive until a master for the team is designated and consistent BDA teaming configuration is detected. %3 %4

Error Message Explanation: A bidirectional affinity (BDA) team is a set of adapters on a single host that act in concert. One adapter on each cluster host must be the master for that team. This event is logged when the team that this adapter has just joined does not have an active master yet. This might be a transient condition due to the binding order of adapters in the system.

User Action: If this event is followed by an NLB 61 event in Event Viewer, no user action is required.

If this event is not followed by an NLB 61 event, then you need to change your BDA configuration to make it consistent across all hosts. BDA configuration is specified by the Microsoft Internet Security and Acceleration Server (ISA Server) setup. For more information about configuring BDA, see the relevant ISA Server documentation.

Event ID: 61

Alert Severity: I

Event Text: NLB Cluster %2 %1: This cluster has joined a bi-directional affinity (BDA) team as the designated master. If the rest of the team has been consistently configured, the team will be activated. %3 %4

Error Message Explanation: A bidirectional affinity (BDA) team is a set of adapters on a single host that act in concert. A single adapter from each team must be assigned the role of master for that team. This event is logged to inform you that this adapter has joined a BDA team as the master.

User Action: No user action is required.

Event ID: 62

Alert Severity: I

Event Text: NLB Cluster %2 %1: This cluster has left a bi-directional affinity (BDA) team in which it was the designated master. If other adapters are still participating in the team, the team will be marked inactive and will remain inactive until a master for the team is designated and consistent BDA teaming configuration is detected. %3 %4

Error Message Explanation: A bidirectional affinity (BDA) team is a set of adapters on a single host that act in concert. One adapter on each cluster host must be the master for that team. This event is logged when the master has just left the BDA team and a new master must be configured for the team to operate. Note that this can be a transient condition caused by a re-configuration of BDA teaming.

User Action: If this event is followed by an NLB 61 event in Event Viewer, no user action is required.

If this event is not followed by an NLB 61 event, then you need to change your BDA configuration. BDA configuration is specified by the Microsoft Internet Security and Acceleration Server (ISA Server) setup. For more information about configuring BDA, see the relevant ISA Server documentation.

Event ID: 63

Alert Severity: I

Event Text: NLB Cluster %2 %1: Initiating convergence on host %3. Reason: Host %4 is joining the cluster.

Error Message Explanation: This event is logged for informational purposes only.

User Action: If this event is followed by an NLB 28 event, NLB 29 event, NLB 71 event, or NLB 72 event in Event Viewer, no user action is required.

If this event is not soon followed by one of these other events, use Network Load Balancing (NLB) Manager to determine the specific configuration problem and then correct as appropriate. For more information about Network Load Balancing, see Help and Support.

Event ID: 64

Alert Severity: I

Event Text: NLB Cluster %2 %1: Initiating convergence on host %3. Reason: Host %4 has conflicting configuration.

Error Message Explanation: This event is logged for informational purposes only.

User Action: If this event is followed by an NLB 28 event, NLB 29 event, NLB 71 event, or NLB 72 event in Event Viewer, no user action is required.

Event ID: 65

Alert Severity: I

Event Text: NLB Cluster %2 %1: Initiating convergence on host %3. Reason: Host %4 is converging for an unknown reason.

Error Message Explanation: This event is logged for informational purposes only.

User Action: If this event is followed by an NLB 28 event, NLB 29 event, NLB 71 event, or NLB 72 event in Event Viewer, no user action is required.

Event ID: 66

Alert Severity: I

Event Text: NLB Cluster %2 %1: Initiating convergence on host %3. Reason: Host %4 is configured with the same host ID.

Error Message Explanation: This event is logged for informational purposes only.

User Action: If this event is followed by an NLB 28 event, NLB 29 event, NLB 71 event, or NLB 72 event in Event Viewer, no user action is required.

Event ID: 67

Alert Severity: I

Event Text: NLB Cluster %2 %1: Initiating convergence on host %3. Reason: Host %4 is configured with a conflicting number of port rules.

Error Message Explanation: This event is logged for informational purposes only.

User Action: If this event is followed by an NLB 28 event, NLB 29 event, NLB 71 event, or NLB 72 event in Event Viewer, no user action is required.

Event ID: 68

Alert Severity: I

Event Text: NLB Cluster %2 %1: Initiating convergence on host %3. Reason: Host %4 has changed its port rule configuration.

Error Message Explanation: This event is logged for informational purposes only.

User Action: If this event is followed by an NLB 28 event, NLB 29 event, NLB 71 event, or NLB 72 event in Event Viewer, no user action is required.

Event ID: 69

Alert Severity: I

Event Text: NLB Cluster %2 %1: Initiating convergence on host %3. Reason: Host %4 is leaving the cluster.

Error Message Explanation: This event is logged for informational purposes only.

User Action: If this event is followed by an NLB 28 event, NLB 29 event, NLB 71 event, or NLB 72 event in Event Viewer, no user action is required.

Event ID: 71

Alert Severity: I

Event Text: NLB Cluster %2 %1: Host %3 converged with %4 host(s) as part of the cluster. Note: The list of cluster members was too large to fit in this event log - see the first data dump entry for a binary map of the cluster membership or run 'wlbs query' to see a list of cluster members.

Error Message Explanation: This event is logged to inform you that the specified host has joined the cluster.

User Action: No user action is required. If you do not want this host to be the default host, reconfigure the host priority settings. For more information about Network Load Balancing, see Help and Support.

Event ID: 72

Alert Severity: I

Event Text: NLB Cluster %2 %1: Host %3 converged as DEFAULT host with %4 host(s) as part of the cluster. Note: The list of cluster members was too large to fit in this event log - see the first data dump entry for a binary map of the cluster membership or run 'wlbs query' to see a list of cluster members.

Error Message Explanation: This event is logged to inform you that the specified host has joined the cluster. This host will be the default host and will handle all traffic that is not governed by any port rules.

Event ID: 73

Alert Severity: E

Event Text: NLB Cluster %2 %1: Cluster IGMP multicast IP address %3 is invalid. Please check the NLB configuration and make sure that the cluster IGMP multicast IP address consists of four decimal byte values separated by dots. %4.

Error Message Explanation: The Internet Group Management Protocol (IGMP) multicast IP address in the registry is not valid.

User Action:

Open the following registry key: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\WLBS\Parameters\Interface\{GUID}, where the GUID is the globally unique identifier of the network adapter that is experiencing the problem. This is the network adapter that is bound to Network Load Balancing. If NLB is, or has been, bound to multiple network adapters, you can find the correct adapter by looking at the value for the ClusterIPAddress key for each GUID.
Examine the IPtoMcastIP key and verify that it is a non-zero value. If it is a value of zero, change it to a value of one.
In Network Connections, open NLB Properties (do not use NLB Manager).
Click OK. This action forces NLB to recalculate the IGMP multicast address automatically and subsequently reload the NLB driver.

If these actions do not resolve the problem, contact Microsoft Product Support Services. For more information about product support, see Help and Support. Alternatively, see Product Support Services at https://www.microsoft.com/homepage/ms.htm. Under the Resources area in the navigation pane, point to Support, and then click Support Home.

For more information about Windows Registry best practices, see Help and Support.

Event ID: 74

Alert Severity: W

Event Text: NLB Cluster %2 %1: Unable to update the NLB host state in the registry. This will affect the ability of NLB to persist the current state across a reboot if NLB has been configured to do so. To predict the state of NLB at the next reboot, please delete the HKLM\SYSTEM\CurrentControlSet\Services\WLBS\Parameters\{GUID}\%3 registry value, which will cause the state at the next reboot to revert to the user-specified preferred initial host state. %4.

Error Message Explanation: A Network Load Balancing (NLB) host can be in one of three states: started, stopped or suspended. The preferred state of NLB on startup can be configured to be any one of the three available states. Each time the server restarts, the host assumes that initial state. However, NLB can be configured to remember a suspended state. This can be used to override the preferred initial state if a host is restarted while suspended and this option has been selected. The host will remain suspended upon completion of the restart, regardless of the specified initial state. NLB therefore must track the last known state of the host to correctly configure the host during a restart. If NLB cannot save that information to the registry, the startup state of the cluster at this restart and subsequent restarts might not be what is expected.

User Action: The registry key specified in the message is incorrect. To be able to predict the state of the NLB host at the next restart, advanced users should delete the following registry key, if it exists:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\WLBS\Parameters\Interface\{GUID}\HostState. The GUID is the globally unique identifier of the network adapter that is experiencing the problem. This will be the network adapter that is bound to NLB. If NLB is, or has been, bound to multiple network adapters, you can find the correct adapter by looking at the value for the ClusterIPAddress key for each GUID entry in the registry.

Deleting this key ensures that on the next restart, NLB will use the preferred initial host state.

For more information about Windows Registry best practices, see Help and Support.

Event ID: 75

Alert Severity: I

Event Text: NLB Cluster %2 %1: Current NLB host state successfully updated in the registry.

Error Message Explanation: This event is logged for informational purposes only.

User Action: No user action required.

Event ID: 76

Alert Severity: W

Event Text: NLB Cluster %2 %1: Last known NLB host state not found in the registry. The state of this host will revert to the user-specified preferred initial host state. %3 %4

Error Message Explanation: A Network Load Balancing (NLB) host can be in one of three states: started, stopped or suspended. The preferred state of NLB on startup can be configured to be any one of the three available states. Each time the server restarts, the host assumes that initial state. However, NLB can be configured to remember a suspended state. This can be used to override the preferred initial state if a host is restarted while suspended and this option has been selected. The host will remain suspended upon completion of the restart, regardless of the specified initial state. NLB therefore must track the last known state of the host to correctly configure the host during a restart. If NLB cannot read that information from the registry, the startup state of the cluster at this restart might not be what is expected.

User Action: No user action is required. NLB will attempt to correct this condition over time.

Event ID: 77

Alert Severity: I

Event Text: NLB Cluster %2 %1: This host is configured to persist 'Started' states across reboots. Because the last known state of this host was started, the host will be re-started regardless of the user-specified preferred initial host state. To stop the host, use 'wlbs stop' or 'wlbs suspend'. %3 %4

Error Message Explanation: This event is logged for informational purposes only.

User Action: No user action is required. If you want to change the default state, use Network Load Balancing (NLB) Manager to make the change. For more information about Network Load Balancing, see Help and Support.

Event ID: 78

Alert Severity: I

Event Text: NLB Cluster %2 %1: This host is configured to persist 'Stopped' states across reboots. Because the last known state of this host was stopped, the host will remain stopped regardless of the user-specified preferred initial host state. To start the host, use 'wlbs start'. %3 %4

Error Message Explanation: This event is logged for informational purposes only.

User Action: No user action is required. If you want to change the default state, use Network Load Balancing (NLB) Manager to make the change. For more information about Network Load Balancing, see Help and Support.

Event ID: 79

Alert Severity: I

Event Text: NLB Cluster %2 %1: This host is configured to persist 'Suspended' states across reboots. Because the last known state of this host was suspended, the host will remain suspended regardless of the user-specified preferred initial host state. To start the host, use 'wlbs resume' followed by 'wlbs start'. %3 %4

Error Message Explanation: This event is logged for informational purposes only.

Event ID: 80

Alert Severity: W

Event Text: NLB Cluster %2 %1: Windows 2000 or NT 4.0 host(s) are participating in this cluster. Consult the relevant NLB documentation concerning the potential limitations of operating a mixed cluster. %3 %4

Error Message Explanation: Certain features of Network Load Balancing are not designed to work in a mixed cluster, that is, in a cluster with hosts running a product in the Windows Server 2003 family along with hosts running Windows 2000 or Windows NT 4.0. These features include virtual clusters, bidirectional affinity, and IPSec load balancing (such as VPN).

User Action: These features can be used if the cluster contains only hosts running a product in the Windows Server 2003 family. If you require any of these features, remove all hosts running Windows 2000 and Windows NT 4.0 from the cluster. For more information about Network Load Balancing, see Help and Support.

Event ID: 81

Alert Severity: W

Event Text: NLB Cluster %2 %1: NLB was unable to open the TCP connection callback object and will therefore be unable to track TCP connections. %3 %4

Error Message Explanation: Network Load Balancing tracks TCP connections to ensure affinity to the host servicing the connection. If NLB cannot open a communication channel with the TCP/IP stack, it cannot guarantee, under certain conditions, that a given TCP connection is serviced by the same host for its duration.

User Action: Try restarting the host. If restarting fails to establish communication with the TCP/IP stack, advanced users can force NLB to track TCP connections itself by setting the following REG_DWORD value to 0 (zero): HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\WLBS\Parameters\Global\EnableTCPNotification

Note

The key will not exist by default. You must create it.

You must restart the computer after making this change. This latter method of tracking TCP connections is less robust than using the TCP/IP stack, but it ensures TCP connection affinity in most cases. This method is not recommended if you are using multiple network adapters with asymmetric traffic flow (that is, using different network adapters to handle outbound vs. inbound NLB traffic).

For more information about Windows Registry best practices, see Help and Support.

Event ID: 82

Alert Severity: E

Event Text: NLB Cluster %2 %1: The network adapter to which NLB is bound does not support NDIS packet indications, which is commonly caused by outdated network adapter hardware and/or drivers. In order to properly load-balance incoming load, NLB requires that adapters support NDIS packet indications. %3 %4

Error Message Explanation: Your computer is using a network adapter that is either older or non-server-class. Network Load Balancing (NLB) requires that network adapters support Network Driver Interface Specification (NDIS) packet indications. NLB no longer accepts the older NDIS Packet Receive indications from network adapters. Incoming packets that arrive via this older mechanism will be dropped by NLB.

User Action: Verify that the drivers for the network adapter are up-to-date and that your network adapter is listed in the Windows Catalog as a supported adapter for the Windows Server 2003 family of products. If necessary, install a different (newer) network adapter that supports NDIS packet receives. For more information, see the Windows Catalog at https://go.microsoft.com/fwlink/?LinkID=37604.

Event ID: 83

Alert Severity: E

Event Text: NLB Cluster %2 %1: Duplicate dedicated IP address %3 was discovered on the network. Please check the NLB configuration on all hosts that belong to the cluster and make sure that they all contain unique dedicated IP addresses. %4

Error Message Explanation: Another host in the cluster has an identical dedicated IP address.

User Action: Check the Network Load Balancing configuration on all hosts that are members of the cluster, and verify that they are all configured with unique dedicated IP addresses. For more information about Network Load Balancing, see Help and Support.

Event ID: 84

Alert Severity: W

Event Text: NLB Cluster %2 %1: NLB was unable to open the NLB public connection callback object and will therefore be unable to track connections. %3 %4

Error Message Explanation: Network Load Balancing (NLB) tracks TCP connections to ensure affinity to the host servicing the connection. In a Microsoft Internet Security and Acceleration Server (ISA Server)/NLB deployment, if NLB cannot open a communication channel with the firewall engine, it cannot guarantee, under certain conditions, that a given TCP connection is serviced by the same host for its duration.

User Action: This communication medium with the firewall engine is required for ISA Server/NLB deployments. Check the ISA Server installation to verify that it is correctly configured, and then try restarting the host.

Event ID: 4096

Alert Severity: W

Event Text: Configuration completed. Microsoft Cluster service is also installed on this machine, and this may prevent the proper operation of both.

Error Message Explanation: This computer is a member of a server cluster. Network Load Balancing can interfere with a server cluster's use of network adapters: therefore, Microsoft does not support this configuration.

User Action: Either do not install NLB on this computer, or remove this computer from the server cluster.

Event ID: 12288

Alert Severity: I

Event Text: Configuration update %2 started by %1 on adapter %3

Error Message Explanation: This event is logged to inform you that a user action was initiated using Network Load Balancing Manager.

User Action: No user action is required.

Event ID: 12289

Alert Severity: I

Event Text: Configuration update %2 completed with status %1 on adapter %3. Information log contains: %n%4

Error Message Explanation: This event is logged to inform you that a user action was initiated using Network Load Balancing Manager.

User Action: No user action is required.

Microsoft Windows Server 2003-only NLB Events

Additional resources