DNS Events 5501, 5000, and 9999 Fill Up the Event Log

• Microsoft Windows NT Server version 4.0

SYMPTOMS

If you have the Domain Name System (DNS) service installed on your computer, one or more of the following event error messages may appear in the event log:

Event 5501
Source: DNS
Description: DNS Server encountered bad packet from IP Address. Packet processing leads beyond packet length.





Event 5000
Source: DNS
Description: DNS Server is logging numerous run-time events. This is usually caused by the reception of bad or unexpected packets, or from problems with or excessive replication traffic. See previous event log entries for information about bad packet source. Now suppressing event logging for these events.





Event 9999
Source: DNS
Description: DNS Server has encountered numerous run-time events. These are usually caused by the reception of bad or unexpected packets, or from problems with or excessive replication traffic. The data is the number of suppressed events encountered in the last 15-minute interval.

CAUSE

The occurrence of these event error messages does not necessarily indicate a problem with the DNS service.

Event 5501 indicates that after sending a recursive query on behalf of a client, DNS received a response with a fragmented flat set indicating that the answer did not fit in one packet and that there is more data to follow. In versions of Windows NT 4.0 earlier than Service Pack 4 (SP4), DNS incorrectly discards the packet.

Event 5000 indicates that DNS is not going to continue logging the warning events that are filling up the event log.

Event 9999 indicates the number of events DNS blocked from being logged in Event Viewer, and then the logging of those events starts again.

RESOLUTION

WARNING: Using Registry Editor incorrectly can cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk.

For information about how to edit the registry, view the "Changing Keys and Values" Help topic in Registry Editor (Regedit.exe) or the "Add and Delete Information in the Registry" and "Edit Registry Data" Help topics in Regedt32.exe. Note that you should back up the registry before you edit it. If you are running Windows NT, you should also update your Emergency Repair Disk (ERD).

To resolve this problem, install SP4.

To adjust the level of DNS logging in Event Viewer, use the registry key listed below.

NOTE: SP4 is required for this key to work.

Registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DNS\Parameters

0 - Event logging disabled
1 - Only error events
2 - Warning and error events
4 - Information, warning, and error events

STATUS

Microsoft has confirmed this to be a problem in Windows NT version 4.0. This problem has been corrected in the latest U.S. service pack for Windows NT version 4.0. For information on obtaining the service pack, query on the following word in the Microsoft Knowledge Base (without the spaces):

S E R V P A C K

REFERENCES

For additional information, please see the following article in the Microsoft Knowledge Base:

Q154984 DNS Server May Not Recursively Resolve Some Names

Additional query words: kbDSupport

Keywords : kbnetwork ntsp
Version : winnt:4.0
Platform : winnt
Issue type : kbbug