The Barracuda TS Agent writes a debug log to help you monitor activity on your server and identify possible problems.
Viewing the Debug Log
To view the debug log:
- Launch TS Agent Config from the Windows start menu. The configuration interface of the Terminal Server Agent opens.
- Click the Debug Log tab.
Error and warning messages are highlighted in red and the log automatically refreshes when it changes. Log files are written to the installation directory. The current log file is named TSAgentSvc.log. Every time the service is restarted, the current log file is renamed to TSAgentSvc1.log. If TSAgentSvc1.log. already exists, this file is renamed as TSAgentSvc2.log. and so on until TSAgentSvc9.log.
Common Log Messages
For a list of most common/important log messages, expand the following section:
| Log ID | Message | Description |
|---|---|---|
| C004000A | Connect failed with error | Connection to the firewall failed. This can have several causes like a connection timeout because the firewall is down. The TSAgent will continually try to establish the connection, but will not display an error message for every unsuccessful try until the next successful connect. |
| C0070001 | Could not bind to LDAP://rootDSE. This can happen if the machine is not registered in a Domain. Error | Could not connect to the Active Directory. This can happen if the machine is not registered in a domain. |
| 4003000F | LDAP query returned no user info. This happens if the user does not exist in the AD. | This happens if the user from whom data like the group membership should be received does not exist in the Active Directory. |
| 400C0004 | User ' | This message is displayed whenever a user logs in on the server (either by RDP or physically). |
| 400D0004 | Port range | The TSAgent assigned the indicated port range for the user. |
| 40030006 | Send failed: no ready FW connection. | The TSAgent tried to send data to the firewall but there was no firewall connection yet established at that time. This is not a problem because the user data will be sent when the connection is established and the protocol handshake finished. This happens often on service startup when the connections have to be established first but the users are already using the server. |
| 4006000E | Could not remove user ' | A user logged off and the TSAgent tried to free the allocated port range. But at this time the user had still ports open. The driver will free the port range when all ports in the range are in a state where they can be assigned to another user. |
| 400C0005 | A user logged off, but could not find a user with this session ID. This happens if the service is started after the user logged in. | This line is displayed if the service could not find a user for the session ID which logged off. This is not a problem the user will be automatically removed when all ports in his range are unused and the last user activity was more than about 10 minutes ago. |
| 40060014 | We do not have a unused port range for ' | A connection was made using a port from the Windows default port range (this means the user is not distinguishable), because the indicated user did not get a port range because there is no unused range available and connectivity preferred is configured. In this case, increase the user port range and if necessary decrease the number of ports per user. |
| 40060015 | We do not have a unused port range for ' | A connection got blocked, because the indicated user did not get a port range because there is no unused range available and security preferred is configured. Increase the user port range and if necessary decrease the number of ports per user. |
| 40060016 | All ports are used in ' | The indicated user used up all ports in their range. The connection will be made using a port from the Windows default port range (this means the user is not distinguishable), because connectivity preferred is configured. This behavior is performed until a port in the users range is free again. |
| 40060017 | All ports are used in ' | The indicated user used up all ports in their range. The connection will get blocked, because security preferred is configured. This behavior is performed until a port in the users range is free again. |
| C0010001 | PostThreadMessage failed with | If this happens often try restarting the service. |
| C0010002 | Could not create thread ' | Try restarting the service and check available system resources. |
| 40010003 | Thread ' | This happens if a thread hangs. The agent will terminate the thread. |
| 40010004 | Thread ' | Shows that the specified thread successfully started. |
| 40010005 | Thread ' | Shows that the specified thread is ending in a controlled way. |
| 40020001 | Found registry ' | Shows the value of registry entry set in the config. |
| 40020002 | Found registry ' | Shows the value of registry entry set in the config. |
| 40030001 | Detected certificate change. | Displayed if the TLS/SSL identity field in the config changed. The TSAgent will disconnect all established connections and will use the new identity. |
| 40030002 | IP | This line is displayed if a Barracuda NG Firewall IP address got removed in the config GUI and the connection is going to close. |
| 40030003 | Found new IP | This lines means the service found a new Barracuda NG Firewall and tries to connect to it. |
| 40030004 | Disconnecting all FW connections. | This message is display if all firewall connections are going to get closed. |
| 40030005 | Sending FWs: AddUser ' | The TSAgent is going to send information about the new user to all the connected firewalls. |
| 40030007 | Sending FWs: IP info. | The TSAgent is going to send the adapter IP addresses on the server to all the connected firewalls. |
| 40030008 | Sending FWs: RemUser ' | The TSAgent is going to send information about the removed user to all the connected firewalls. |
| 40030009 | Sending FW ' | This line is displayed if the TSAgent is going to send information about all user port ranges to a particular firewall. This happens when the connection with the firewall is successfully established. The next update will be incremental and only contain one user. |
| 4003000A | Send failed: not connected to the FW. | This happens if the TSAgent tries to send the user port table to the Barracuda NG Firewall but before the data is successfully send the connection got closed. This is not a problem the TSAgent will try to reconnect. |
| 4003000B | Connecting to AD. | The TSAgent is trying to establish a connection with the Active Directory, to receive the user group information. |
| 4003000C | Successful connected to the AD. | The connection to the Active Directory got established. |
| C003000D | Could not connect to the AD error: | Connecting to the Active Directory failed. This means no user group information can be retrieved. This can happen if the Terminal Server did not join a domain. |
| C003000E | LDAP query failed. | Could not retrieve the user information from the Active Directory. |
| 40030010 | LDAP query returned | The Active Directory could not match a unique user but instead returned several. |
| 40030011 | FWComm Thread received stop event. | The Barracuda NG Firewall communication thread received a notification that it should terminate. |
| 40030012 | Got notified about registry change | The TSAgent got notified about a configuration change on the Barracuda NG Firewall. |
| 40030013 | Got notified about IP change. | The TSAgent got notified about a possible IP address change on the server. |
| C0030014 | WSAEnumNetworkEvents failed with error | The Barracuda NG Firewall connection failed in some way. The TSAgent will try to reconnect. |
| 40030015 | Received socket close ( | The Barracuda NG Firewall closed the connection. The TSAgent will try to reconnect. |
| C0030016 | Read failed with error | Receiving data from the Barracuda NG Firewall connection failed. This can happen if the connection gets terminated. The TSAgent will try to reconnect. |
| C0030017 | Write failed with error | Sending data to the Barracuda NG Firewall connection failed. This can happen if the connection gets terminated. The TSAgent will try to reconnect. |
| 40040001 | Connecting to ' | The TSAgent tries to establish a connection with the Barracuda NG Firewall. |
| C0040002 | WSAEventSelect failed with error | This can happen if the connection gets terminated. The TSAgent will try to reconnect. |
| C0040003 | Connect failed: | This error means we failed to connect to the Barracuda NG Firewall. |
| C0040004 | Error handle received data returned false | The received data was malformed. If this happens often, check if the Barracuda NG Firewall version is supported. |
| C0040005 | SetCertFile failed: | Setting the TLS/SSL certificate failed. Check if the configured certificate exists and is valid. |
| C0040006 | SetKeyFile failed: | Setting the TLS/SSL private key failed. Check if the configured private key exists and is valid. |
| C0040007 | Setting SSL plugin failed: | The TLS/SSL connection failed to initialize. |
| 40040008 | Could not send data: | Sending data to the Barracuda NG Firewall failed. |
| C0040009 | Could not flush socket: | Could not flush the socket which is connected to the Barracuda NG Firewall. |
| 4004000B | Not connected. | Happens if the code tried to send data but the TSAgent is not connected with the Barracuda NG Firewall. |
| 4004000C | Handshake not yet done. | Happens if the code tried to send data while the TSAgent tries to establish a TLS/SSL connection with the Barracuda NG Firewall. |
| C0050001 | Parse line failed. Line: ''. If this error does not go away, try checking if the NG Firewall version is compatible. | If this error does not go away, try checking if the Barracuda NG Firewall version is compatible. |
| C0050002 | Handle command failed. Cmd: ' | If this error does not go away, try checking if the Barracuda NG Firewall version is compatible. |
| C0050003 | Did not receive connection cmd. If this error does not go away, try checking if the NG Firewall version is compatible. | If this error does not go away, try checking if the Barracuda NG Firewall version is compatible. |
| 40050004 | Server supports SSL: <0/1>. | 0=TLS/SSL not supported. 1=TLS/SSL is supported. |
| 40050005 | Using SSL encrypted connection. | This message is displayed if both the TSAgent and the Barracuda NG Firewall support encryption. |
| 40050006 | Using unencrypted connection. | This message is displayed if the TSAgent or the Barracuda NG Firewall do not support encryption. |
| C0050007 | Did not receive server cmd. If this error does not go away, try checking if the NG Firewall version is compatible. | Check if the Barracuda NG Firewall version is compatible. |
| 40050008 | Server version: ' | Version of the Barracuda NG Firewall component. |
| C0050009 | Got malformed server data. Can not find the '=' delimiter in ''. | Check if the Barracuda NG Firewall version is compatible. |
| C005000A | Got malformed server data. We got a zero length key. (Data: ''). | Check if the Barracuda NG Firewall version is compatible. |
| 40060001 | Received service stop notification. | The service got notified that is should terminate. |
| C0060002 | Could not create overlapped IO event | Check if your servers resources are fully exploited. |
| C0060003 | Device read failed | The service failed read the data from the driver. Try restarting the server. And if this error does not go away check if the driver is working correctly. |
| 40060004 | Received registry change notification. | Got notified about a configuration change. |
| C0060005 | Error could not open device | Driver device open failed. Check if the TSAgentDrv driver is installed. |
| 40060006 | Successfully opened the device. | Successfully opened the TSAgentDrv driver device object. |
| 40060007 | Closing device. | Closing the TSAgentDrv driver device object. |
| C0060008 | Received too few bytes ( | Received malformed data from the driver. If this happens often check if the driver / service do not have a compatible version. |
| C0060009 | Received invalid SID. | Received malformed security identifier (SID) from the driver. The SID is used to uniquely identify users or groups. |
| C006000A | Received unknown IO request (IOType: | Received a unknown IO request from the server. If this happens often check if the driver / service do not have a compatible version. |
| C006000B | Could not notify FWCommThread. | Try restarting the service if this error continues. |
| 4006000C | Could not notify FWCommThread. | Try restarting the service if this error continues. |
| 4006000C | User exists already. | The driver notified us of a user but it already exists in our table. |
| C006000D | Could not add the user ' | Failed to add the user, possible because it already exists. |
| 4006000F | Driver could not remove the user. Error | The driver could not remove the user. |
| 40060010 | Could not remove user. | The ports which the user uses could not set unused. Possible because this user does not exist. |
| 40060011 | Found registry 'TcpTimedWaitDelay' entry, value is ' | The TSAgent found the value of the Windows TCP WAIT_STATE in the registry. |
| 40060012 | Excluding | If the administrator set “Reserved ports” the lines will show the port ranges the TSAgent will never use. It is also displayed on startup if the TS Agent found additional ports intersecting the system port range. |
| 40060013 | Blocked connect because user ' | This happens if a application tried to make a connection with a specific source port. This is only allowed for the system user as this would circumvent the user port assignment and therefore the connect got blocked. |
| C0070002 | Could not execute query. Could not bind to the container. Error | The Active Directory query could not get executed. |
| C0070003 | Failed to set searching preferences. HRESULT = | LDAP search preferences could not get set. |
| 40080001 | Can not use port range | The TSAgent cannot use the indicated sub range of the user port range because it intersects with an reserved port configured in the config app. |
| C0080002 | DeletePersistentTcpPortReservation returned error: | We failed to delete the TCP port range from the system. |
| C0080003 | DeletePersistentUdpPortReservation returned error: | We failed to delete the UDP port range from the system. |
| 40080004 | Marking port range | This line shows if the service gets restarted and the driver notifies the service of the existing users and there port ranges. |
| C0090001 | Open RegKey failed | This line is showed if the registry monitor can’t open the registry. |
| C0090002 | RegKey NotifyChangeKeyValue failed | This line is showed if the registry monitor failed to register the notification to receive registry changes. |
| 400A0001 | Setting service recovery option. | This message is displayed on startup and shows that the service is going to register recovery options so that it restarts if it would crash. |
| 400A0002 | Could not open the service. | This message is display if the TSAgentSvc could not open the TSAgentSvc service object. This can happen if the TSAgentSvc is not installed. |
| 400A0003 | Could not open the service manager. | This can happen if the TSAgentSvc does not run with enough excess permissions. |
| C00B0001 | Failed to get domain name from session ID | This happens if the OS failed to map a logon session ID to the domain name of the user. |
| C00B0002 | Failed to get user name from session ID | This happens if the OS failed to map a logon session ID to the user name of the user. |
| C00B0003 | Load account SID failed with error | This message is displayed if we could not get the SID of a domain/user. |
| 400C0001 | Service is starting. | This log message shows that the “TSAgentSvc “ service is starting, this means that the current log file is not truncated. |
| 400C0002 | Service start finished. | This line is displayed if the service initialization has finished. |
| C00C0003 | Could not find user for session id | This line is displayed if we could not find the username of a user which logged on. |
| 400C0006 | User ' | Displayed whenever a user logs off the server (either by RDP or physically). |
| 400C0007 | Could not remove user ' | A user logged of but the Agent could not set the port range to unused. It is highly possible this is because some ports are still in TCP_WAIT state and it will take a few minutes until the user can and will be removed. |
| 400C0008 | Service has version: | Show the version number of the TSAgentSvc component. |
| 400C0009 | Config application has version: | Show the version number of the TSAgentConfig component. |
| 400C000A | Driver has version: | Show the version number of the TSAgentDrv component. |
| 400C000B | OS Release: | Shows operating system version and installed service pack release number. |
| 400C000C | OS Type: | Displays the Windows product type and suite. |
| 400C000D | File ' | This line is displayed if a specific file exists but should be deleted on system restart. |
| 800C000E | Full functionality of the Terminal Server Agent requires a system reboot! | This line is displayed if there was a configuration change which needs a restart to take effect or the TSAgent got installed/updated but the restart was not made. |
| 400C000F | Marking ' | If this happens and you restart the system and the TSAgent still displays that you need to reboot to activate changes, you have to delete the “reboot_required” file which you can find in the installation directory. |
| 400C0010 | File ' | The indicated file got successfully marked for removal at next system start. |
| 400C0011 | File ' | This line is displayed if the specified file could not get read in for example because it does not exist. |
| C00D0001 | User ' | This lines is displayed if the user with the displayed SID already has a port range assigned. |
| C00D0002 | Could not find a unused system port range. Please try increasing the system port range size. | This line is displayed if the system port range is too small. Please increase the range in the config application. Otherwise the TSAgent fill not work correctly. |
| C00D0003 | Could not find a unused port range. Please try increasing the user port range size and if necessary decrease the number of ports per user. | This line is displayed if there are more users logged on at the same time than user port ranges available. Please try increasing the user port range size and if necessary decrease the number of ports per user. This can also happen if you have configured a large range of reserved ports which reduce the size of the user port range. |
| C00D0005 | Can not remove user ' | Should remove the user with the indicated SID but the user does not have a port range assigned. |
| 400D0006 | User ' | The port range assigned to the indicated user is now free for assignment to another user because all ports in the range are unused. |
| 400D0007 | Port range | This line shows if the service gets restarted and the driver notifies the service of the existing users and there port ranges. |