SMBWitnessClient Event ID 42

Question

Our monitoring software, for monitoring free space on our FSX, is getting the following errors in the event log on the client machine doing the monitoring:

```
* Source: Microsoft-Windows-SMBWitnessClient    
* Event Log: Microsoft-Windows-SMBWitnessClient/Admin    
* Type: Error    
* Event ID: 42    
* Event User: NT AUTHORITY\NETWORK SERVICE    
* Witness Client failed to connect to the witness server at IP address [redacted] with error (The RPC server is unavailable.).  This event may be suppressed for this resource for the next 12 hours if the condition persists.

PID 1208: C:\Windows\system32\svchost.exe -k NetworkService
```

```
* Source: Microsoft-Windows-WinRM    
* Event Log: Microsoft-Windows-WinRM/Operational    
* Type: Error    
* Event ID: 138    
* Event User: [redacted\redacted]   
* The client got a timeout from the network layer (ERROR_WINHTTP_TIMEOUT)

PID 4468: "C:\Program Files\PA Server Monitor\PALowPriorityHelper_Net4.exe"  
```

```
* Source: Microsoft-Windows-WinRM    
* Event Log: Microsoft-Windows-WinRM/Operational    
* Type: Error    
* Event ID: 161    
* Event User: [redacted\redacted]    
* WinRM cannot complete the operation. Verify that the specified computer name is valid, that the computer is accessible over the network, and that a firewall exception for the WinRM service is enabled and allows access from this computer. By default, the WinRM firewall exception for public profiles limits access to remote computers within the same local subnet.

PID 4468: "C:\Program Files\PA Server Monitor\PALowPriorityHelper_Net4.exe"  
```

Answer

Hello. Thank you for writing to us. Looking at the events, it  appears to be an issue at the Network level. We will suggest to check if you have any proxy server is enabled and causing the issue. Please consider to run the following commands:

1. Execute the following command to see if "TcpTestSucceeded" is True":
Test-NetConnection -ComputerName "Replace with Windows powershell endpoint of FSx" -Port 5985
2. Check if 'Test-WSMan' is successful or not:
Test-WSMan -ComputerName  "Replace with Windows powershell endpoint of FSx"
3. If the above commands fails, then execute the following to check if proxy is set:
netsh winhttp show proxy
4. If proxy is found then execute the following command to reset it (do make note of the proxy settings from step 3 before resetting):
netsh winhttp reset proxy
5. After resetting, please execute the command from step 2 and it should work this time.

Check if the software is able to fetch the desired output of free space for FSx now.

Please mark this response as "Answer" if it helped to resolve the issue.

Answer

Thanks for your reply.

Test-NetConnection -Port 445 **==> True**

Test-NetConnection -Port 5985 **==> False**

netsh winhttp show proxy **=> Direct access (no proxy server)**

As a note: I temporarily allowed all traffic between source machine and FSX, although there are already discrete rules for 445 and 5985.

SMBWitnessClient Event ID 42

관련 콘텐츠