Is your SharePoint server reporting Event IDs 7076, 6398, 6482

A lot of the SharePoint servers I look at have Error level events (7076, 6398 and 6482) showing up in their Event Logs and I think most people are either starting to ignore these or never look at their Event Logs.

I'm guilty of the latter. I have looked after our team MOSS server for at least a year and I haven't looked at the Event Logs once. It's the first place I go when there are problems but when everything is running smoothly then I don't do a proactive check to see what is happening.

If you have seen the following Events in your Event Log then relief is at hand.

Event Id: 7076
Event Source: Office SharePoint Server
The Message text contains:
"Attempted to read or write protected memory. This is often an indication that other memory is corrupt." and a reference to the Metabase in the callstack.

Event Id: 6398
Event Source: Windows SharePoint Services 3
The Message text contains: "Microsoft.Office.Server.Administration.ApplicationServerAdministrationServiceJob" and "Attempted to read or write protected memory. This is often an indication that other memory is corrupt."

Event Id: 6482
Event Source: Office SharePoint Server
The Message text contains:
"Microsoft.Office.Server.Search.Administration.SearchAdminSharedWebServiceInstance", "Attempted to read or write protected memory. This is often an indication that other memory is corrupt." and a reference to the Metabase in the callstack.

A hotfix, KB946517, is now available for this issue.

946517    FIX: You may be unable to manage IIS 6.0 by using Server Manager if two threads access IIS 6.0 at the same time
https://support.microsoft.com/default.aspx?scid=kb;EN-US;946517

Share this post :