thys

Today I noticed a lot of TFS Services errors in the application eventlog with the problem:

Detailed Message: The event log file is full
Exception Message: The event log file is full (type SoapException)

I started a trace on the apptier and after a workitemchange I typically get the following logs:

[1852] [CS] [Verbose, PID 1852, TID 2852, 12:54:18.657] Created notification for subscriber: Microsoft.TeamFoundation.Server.SubscriptionOnServer
[1852] [CS] [Info, PID 1852, TID 2852, 12:54:18.657] Calling notification filter: Microsoft.TeamFoundation.WorkItemTracking.Server.NotificationFilter
[1852] [CS] [Verbose, PID 1852, TID 2852, 12:54:18.657] -->RemoveRestrictedContent() (WorkItemTracking Security Filter)
[1852] [CS] [Verbose, PID 1852, TID 2852, 12:54:18.657] Checking if SubscriberTongue Tied-1-5-21-2797055980-861071410-1480047075-1116 has permission to read work item with query:<Query Product='Software Factory Support Center'><Expression Column='System.ID' FieldType='32' Operator='equals'><Number>4885</Number></Expression></Query>
[1852] [CS] [Info, PID 1852, TID 2692, 12:54:18.667] Entering Send loop
[1852] [CS] [Verbose, PID 1852, TID 2692, 12:54:18.667] Sending e-mail.
[1852] [CS] [Verbose, PID 1852, TID 2692, 12:54:18.667] Creating body for e-mail.
[1852] [CS] [Error, PID 1852, TID 276, 12:54:18.817] Application Request Processing Started
[1852] [CS] [Verbose, PID 1852, TID 276, 12:54:18.837] Request authentication type: NTLM
[1852] [CS] [Info, PID 1852, TID 276, 12:54:18.837] Application Authentication
[1852] [CS] [Verbose, PID 1852, TID 276, 12:54:18.837] Starting IsPermitted('$NAMESPACE', 'GENERIC_READ', 'S-1-5-21-2797055980-861071410-1480047075-1114')
[1852] [CS] [Verbose, PID 1852, TID 276, 12:54:18.837] Returning True from memory cache
[1852] [CS] [Info, PID 1852, TID 276, 12:54:18.837] Application Request Processing Ended
[1852] [WI] Verifying clientSid in BIS: S-1-5-21-2797055980-861071410-1480047075-1114
[1852] [CS] [Error, PID 1852, TID 800, 12:54:18.887] Application Request Processing Started
[1852] [CS] [Verbose, PID 1852, TID 800, 12:54:18.917] Request authentication type: NTLM
[1852] [CS] [Info, PID 1852, TID 800, 12:54:18.917] Application Authentication
[1852] [CS] [Verbose, PID 1852, TID 800, 12:54:18.917] Starting IsPermitted('$NAMESPACE', 'GENERIC_READ', 'S-1-5-21-2797055980-861071410-1480047075-1114')
[1852] [CS] [Verbose, PID 1852, TID 800, 12:54:18.917] Returning True from memory cache
[1852] [CS] [Info, PID 1852, TID 800, 12:54:18.917] Application Request Processing Ended
[1852] [CS] [Error, PID 1852, TID 276, 12:54:18.937] Application Request Processing Started
[1852] [CS] [Verbose, PID 1852, TID 276, 12:54:18.957] Request authentication type: NTLM
[1852] [CS] [Info, PID 1852, TID 276, 12:54:18.957] Application Authentication
[1852] [CS] [Verbose, PID 1852, TID 276, 12:54:18.957] Starting IsPermitted('$NAMESPACE', 'GENERIC_READ', 'S-1-5-21-2797055980-861071410-1480047075-1114')
[1852] [CS] [Verbose, PID 1852, TID 276, 12:54:18.957] Returning True from memory cache
[1852] [CS] [Info, PID 1852, TID 276, 12:54:18.957] Application Request Processing Ended
[1852] [CS] [Verbose, PID 1852, TID 2852, 12:54:18.977] Subscriber:XYXY\userID has permissions to this workItem
[1852] [CS] [Error, PID 1852, TID 800, 12:54:18.997] Application Request Processing Started
[1852] [CS] [Verbose, PID 1852, TID 2692, 12:54:19.007] E-mail sent.
[1852] [CS] [Info, PID 1852, TID 2692, 12:54:19.007] Done with notification.
[1852] [CS] [Verbose, PID 1852, TID 800, 12:54:19.007] Request authentication type: NTLM
[1852] [CS] [Info, PID 1852, TID 800, 12:54:19.007] Application Authentication
[1852] [CS] [Verbose, PID 1852, TID 800, 12:54:19.017] Starting IsPermitted('$NAMESPACE', 'GENERIC_READ', 'S-1-5-21-2797055980-861071410-1480047075-1114')
[1852] [CS] [Verbose, PID 1852, TID 800, 12:54:19.017] Returning True from memory cache
[1852] [CS] [Info, PID 1852, TID 800, 12:54:19.017] Application Request Processing Ended
[1852] [CS] [Verbose, PID 1852, TID 2852, 12:54:19.017] From Address set:
[1852] [CS] [Verbose, PID 1852, TID 2852, 12:54:19.017] <--RemoveRestrictedContent() (WorkItemTracking Security Filter)
[1852] [CS] [Info, PID 1852, TID 2852, 12:54:19.017] Found restrictions: Microsoft.TeamFoundation.WorkItemTracking.Server.NotificationFilter
[1852] [CS] [Info, PID 1852, TID 2852, 12:54:19.027] Activating a new thread to send events.
[1852] [CS] [Info, PID 1852, TID 2792, 12:54:19.027] Entering Send loop
[1852] [CS] [Info, PID 1852, TID 2692, 12:54:19.048] Exiting Send loop
[1852] [CS] [Error, PID 1852, TID 2792, 12:54:19.088] TF53010: An unexpected condition has occurred in a Team Foundation component. The information contained here should be made available to your site administrative staff.
[1852] Technical Information (for the administrative staff):
[1852] Date (UTC): 4/27/2007 12:54:19 PM
[1852] Machine: XYXY_TFSAPP
[1852] Application Domain: /LM/W3SVC/3/Root/services-1-128221453348258843
[1852] Assembly: Microsoft.TeamFoundation.Server, Version=8.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a; v2.0.50727
[1852] Process Details:
[1852] Process Name: w3wp
[1852] Process Id: 1852
[1852] Thread Id: 2792
[1852] Account name: XYXY\tfsservice
[1852]
[1852] Detailed Message: The event log file is full
[1852] Exception Message: The event log file is full (type SoapException)
[1852]
[1852] Exception Stack Trace: at System.Web.Services.Protocols.SoapHttpClientProtocol.ReadResponse(SoapClientMessage message, WebResponse response, Stream responseStream, Boolean asyncCall)
[1852] at System.Web.Services.Protocols.SoapHttpClientProtocol.Invoke(String methodName, Object[] parameters)
[1852] at Microsoft.TeamFoundation.Server.NotificationClient.Notify(String eventXml, String tfsIdentityXml, SubscriptionInfo SubscriptionInfo)
[1852]
[1852]
[1852] [CS] [Info, PID 1852, TID 2792, 12:54:19.088] Done with notification.
[1852] [CS] [Info, PID 1852, TID 2792, 12:54:19.088] Exiting Send loop


I cleared all event logs on the apptier and the datatier, but still this error appears. This set of servers has been running flawlessly for over half a year and we haven't made any changesin the config recently.
What else could be wrong here



Re: Team Foundation Server - Administration Event log errors

Hua Chen - MSFT

Hello thys:

The restrictions are security related.

Please check if the subscribed user can see the changes happened to a workitem.

Thanks