We use cookies on our website to ensure we provide you with the best experience on our website. By using our website, you agree to the use of cookies for analytics and personalized content.This website uses cookies. More Information
It seems like your browser didn't download the required fonts. Please revise your security settings and try again.
Barracuda Reference / FAQ

Barracuda Terminal Server Agent Debug Log Messages

  • Last updated on

The Barracuda TS Agent writes a debug log to help you monitor activity on your server and identify possible problems.

Viewing the Debug Log

To view the debug log:

  1. Launch TS Agent Config from the Windows start menu. The configuration interface of the Terminal Server Agent opens.
  2. Click the Debug Log tab.

ts_log.png

Error and warning messages are highlighted in red and the log automatically refreshes when it changes. Log files are written to the installation directory. The current log file is named TSAgentSvc.log. Every time the service is restarted, the current log file is renamed to TSAgentSvc1.log. If TSAgentSvc1.log. already exists, this file is renamed as TSAgentSvc2.logand so on until TSAgentSvc9.log.

Common Log Messages

For a list of most common/important log messages, expand the following section:

Log IDMessageDescription
C004000AConnect failed with error ().Connection to the firewall failed. This can have several causes like a connection timeout because the firewall is down. The TSAgent will continually try to establish the connection, but will not display an error message for every unsuccessful try until the next successful connect.
C0070001Could not bind to LDAP://rootDSE. This can happen if the machine is not registered in a Domain. Error ().Could not connect to the Active Directory. This can happen if the machine is not registered in a domain.
4003000FLDAP query returned no user info. This happens if the user does not exist in the AD.This happens if the user from whom data like the group membership should be received does not exist in the Active Directory.
400C0004User '\' logged on.This message is displayed whenever a user logs in on the server (either by RDP or physically).
400D0004Port range assigned for '\' ().The TSAgent assigned the indicated port range for the user. 
40030006Send failed: no ready FW connection.The TSAgent tried to send data to the firewall but there was no firewall connection yet established at that time. This is not a problem because the user data will be sent when the connection is established and the protocol handshake finished. This happens often on service startup when the connections have to be established first but the users are already using the server. 
4006000ECould not remove user '\' because port(s) are still open. Will try it later.A user logged off and the TSAgent tried to free the allocated port range. But at this time the user had still ports open. The driver will free the port range when all ports in the range are in a state where they can be assigned to another user.
400C0005A user logged off, but could not find a user with this session ID. This happens if the service is started after the user logged in.This line is displayed if the service could not find a user for the session ID which logged off. This is not a problem the user will be automatically removed when all ports in his range are unused and the last user activity was more than about 10 minutes ago.
40060014We do not have a unused port range for '\'. Please increase the port range. Sending packets using Windows port range (Connectivity preferred).A connection was made using a port from the Windows default port range (this means the user is not distinguishable), because the indicated user did not get a port range because there is no unused range available and connectivity preferred is configured. In this case, increase the user port range and if necessary decrease the number of ports per user.
40060015We do not have a unused port range for '\'. Please increase the port range. Blocking packets (Security preferred).A connection got blocked, because the indicated user did not get a port range because there is no unused range available and security preferred is configured. Increase the user port range and if necessary decrease the number of ports per user.
40060016All ports are used in '\'s range ( ports). Please increase the number of ports per user.  Sending packets using Windows port range (Connectivity preferred).The indicated user used up all ports in their range. The connection will be made using a port from the Windows default port range (this means the user is not distinguishable), because connectivity preferred is configured. This behavior is performed until a port in the users range is free again.
40060017All ports are used in '\'s range ( ports). Please increase the number of ports per user.  Blocking packets (Security preferred).The indicated user used up all ports in their range. The connection will get blocked, because security preferred is configured. This behavior is performed until a port in the users range is free again. 
C0010001PostThreadMessage failed with .If this happens often try restarting the service.
C0010002Could not create thread ''.Try restarting the service and check available system resources.
40010003Thread '' ID did not end one it's own. Will terminate him.This happens if a thread hangs. The agent will terminate the thread.
40010004Thread '' started.Shows that the specified thread successfully started.
40010005Thread '' is terminating.Shows that the specified thread is ending in a controlled way.
40020001Found registry '' entry, value is ''.Shows the value of registry entry set in the config.
40020002Found registry '' entry, value is ''.Shows the value of registry entry set in the config.
40030001Detected certificate change.Displayed if the TLS/SSL identity field in the config changed. The TSAgent will disconnect all established connections and will use the new identity.
40030002IP is not in the registry value anymore. Stopping thread next.This line is displayed if a Barracuda NG Firewall IP address got removed in the config GUI and the connection is going to close.
40030003Found new IP . Creating new FW connection.This lines means the service found a new Barracuda NG Firewall and tries to connect to it.
40030004Disconnecting all FW connections.This message is display if all firewall connections are going to get closed.
40030005Sending FWs: AddUser '\'.

The TSAgent is going to send information about the new user to all the connected firewalls.

40030007Sending FWs: IP info.The TSAgent is going to send the adapter IP addresses on the server to all the connected firewalls.
40030008Sending FWs: RemUser '\'.The TSAgent is going to send information about the removed user to all the connected firewalls. 
40030009Sending FW '' whole user table.This line is displayed if the TSAgent is going to send information about all user port ranges to a particular firewall. This happens when the connection with the firewall is successfully established. The next update will be incremental and only contain one user. 
4003000ASend failed: not connected to the FW.This happens if the TSAgent tries to send the user port table to the Barracuda NG Firewall but before the data is successfully send the connection got closed. This is not a problem the TSAgent will try to reconnect.
4003000BConnecting to AD.The TSAgent is trying to establish a connection with the Active Directory, to receive the user group information. 
4003000CSuccessful connected to the AD.The connection to the Active Directory got established.
C003000DCould not connect to the AD error: .Connecting to the Active Directory failed. This means no user group information can be retrieved. This can happen if the Terminal Server did not join a domain.
C003000ELDAP query failed.Could not retrieve the user information from the Active Directory.
40030010LDAP query returned users.The Active Directory could not match a unique user but instead returned several.
40030011FWComm Thread received stop event.The Barracuda NG Firewall communication thread received a notification that it should terminate.
40030012Got notified about registry changeThe TSAgent got notified about a configuration change on the Barracuda NG Firewall.
40030013Got notified about IP change.The TSAgent got notified about a possible IP address change on the server.
C0030014WSAEnumNetworkEvents failed with error .The Barracuda NG Firewall connection failed in some way. The TSAgent will try to reconnect.
40030015Received socket close ().The Barracuda NG Firewall closed the connection. The TSAgent will try to reconnect.
C0030016Read failed with error ().Receiving data from the Barracuda NG Firewall connection failed. This can happen if the connection gets terminated. The TSAgent will try to reconnect.
C0030017Write failed with error ().Sending data to the Barracuda NG Firewall connection failed. This can happen if the connection gets terminated. The TSAgent will try to reconnect.
40040001Connecting to ''.The TSAgent tries to establish a connection with the Barracuda NG Firewall.
C0040002WSAEventSelect failed with error .This can happen if the connection gets terminated. The TSAgent will try to reconnect.
C0040003Connect failed: .This error means we failed to connect to the Barracuda NG Firewall.
C0040004Error handle received data returned falseThe received data was malformed. If this happens often, check if the Barracuda NG Firewall version is supported.
C0040005SetCertFile failed: .Setting the TLS/SSL certificate failed. Check if the configured certificate exists and is valid.
C0040006SetKeyFile failed: .Setting the TLS/SSL private key failed. Check if the configured private key exists and is valid.
C0040007Setting SSL plugin failed: .The TLS/SSL connection failed to initialize.
40040008Could not send data: .Sending data to the Barracuda NG Firewall failed.
C0040009Could not flush socket: .Could not flush the socket which is connected to the Barracuda NG Firewall.
4004000BNot connected.Happens if the code tried to send data but the TSAgent is not connected with the Barracuda NG Firewall.
4004000CHandshake not yet done.Happens if the code tried to send data while the TSAgent tries to establish a TLS/SSL connection with the Barracuda NG Firewall.
C0050001Parse line failed. Line: ''. If this error does not go away, try checking if the NG Firewall version is compatible.If this error does not go away, try checking if the Barracuda NG Firewall version is compatible.
C0050002Handle command failed. Cmd: ''.If this error does not go away, try checking if the Barracuda NG Firewall version is compatible.
C0050003Did not receive connection cmd. If this error does not go away, try checking if the NG Firewall version is compatible.If this error does not go away, try checking if the Barracuda NG Firewall version is compatible.
40050004Server supports SSL: <0/1>.0=TLS/SSL not supported. 1=TLS/SSL is supported.
40050005Using SSL encrypted connection.This message is displayed if both the TSAgent and the Barracuda NG Firewall support encryption.
40050006Using unencrypted connection.This message is displayed if the TSAgent or the Barracuda NG Firewall do not support encryption.
C0050007Did not receive server cmd. If this error does not go away, try checking if the NG Firewall version is compatible.Check if the Barracuda NG Firewall version is compatible.
40050008Server version: '’.Version of the Barracuda NG Firewall component.
C0050009Got malformed server data. Can not find the '=' delimiter in ''.Check if the Barracuda NG Firewall version is compatible.
C005000AGot malformed server data. We got a zero length key. (Data: '').Check if the Barracuda NG Firewall version is compatible.
40060001Received service stop notification.The service got notified that is should terminate.
C0060002Could not create overlapped IO event .Check if your servers resources are fully exploited.
C0060003Device read failed .The service failed read the data from the driver. Try restarting the server. And if this error does not go away check if the driver is working correctly.
40060004Received registry change notification.Got notified about a configuration change.
C0060005Error could not open device .Driver device open failed. Check if the TSAgentDrv driver is installed.
40060006Successfully opened the device.Successfully opened the TSAgentDrv driver device object.
40060007Closing device.Closing the TSAgentDrv driver device object.
C0060008Received too few bytes ( should be at least bytes).Received malformed data from the driver. If this happens often check if the driver / service do not have a compatible version.
C0060009Received invalid SID.Received malformed security identifier (SID) from the driver. The SID is used to uniquely identify users or groups.
C006000AReceived unknown IO request (IOType: ).Received a unknown IO request from the server. If this happens often check if the driver / service do not have a compatible version.
C006000BCould not notify FWCommThread.Try restarting the service if this error continues.
4006000CCould not notify FWCommThread.Try restarting the service if this error continues.
4006000CUser exists already.The driver notified us of a user but it already exists in our table.
C006000DCould not add the user '\'.Failed to add the user, possible because it already exists.
4006000FDriver could not remove the user. Error .The driver could not remove the user.
40060010Could not remove user.The ports which the user uses could not set unused. Possible because this user does not exist.
40060011Found registry 'TcpTimedWaitDelay' entry, value is ''.The TSAgent found the value of the Windows TCP WAIT_STATE in the registry. 
40060012Excluding port (range) .

If the administrator set “Reserved ports” the lines will show the port ranges the TSAgent will never use.

It is also displayed on startup if the TS Agent found additional ports intersecting the system port range.
40060013Blocked connect because user '\' tried to connect with specific source port . This could be an attempt to impersonate an other user.This happens if a application tried to make a connection with a specific source port. This is only allowed for the system user as this would circumvent the user port assignment and therefore the connect got blocked.
C0070002Could not execute query. Could not bind to the container. Error ().The Active Directory query could not get executed.
C0070003Failed to set searching preferences. HRESULT = ().LDAP search preferences could not get set.
40080001Can not use port range because it intersects with excluded range .The TSAgent cannot use the indicated sub range of the user port range because it intersects with an reserved port configured in the config app. 
C0080002DeletePersistentTcpPortReservation returned error: .We failed to delete the TCP port range from the system.
C0080003DeletePersistentUdpPortReservation returned error: .We failed to delete the UDP port range from the system.
40080004Marking port range as used because of existing user.This line shows if the service gets restarted and the driver notifies the service of the existing users and there port ranges. 
C0090001Open RegKey failed .This line is showed if the registry monitor can’t open the registry.
C0090002RegKey NotifyChangeKeyValue failed .This line is showed if the registry monitor failed to register the notification to receive registry changes.
400A0001Setting service recovery option.This message is displayed on startup and shows that the service is going to register recovery options so that it restarts if it would crash.
400A0002Could not open the service.This message is display if the TSAgentSvc could not open the TSAgentSvc service object. This can happen if the TSAgentSvc is not installed.
400A0003Could not open the service manager.This can happen if the TSAgentSvc does not run with enough excess permissions.
C00B0001Failed to get domain name from session ID .This happens if the OS failed to map a logon session ID to the domain name of the user.
C00B0002Failed to get user name from session ID .This happens if the OS failed to map a logon session ID to the user name of the user.
C00B0003Load account SID failed with error .This message is displayed if we could not get the SID of a domain/user.
400C0001Service is starting.This log message shows that the “TSAgentSvc “ service is starting, this means that the current log file is not truncated.
400C0002Service start finished.This line is displayed if the service initialization has finished.
C00C0003Could not find user for session id .This line is displayed if we could not find the username of a user which logged on.
400C0006User '\' logged off.Displayed whenever a user logs off the server (either by RDP or physically).
400C0007Could not remove user ''.A user logged of but the Agent could not set the port range to unused. It is highly possible this is because some ports are still in TCP_WAIT state and it will take a few minutes until the user can and will be removed.
400C0008Service has version: .Show the version number of the TSAgentSvc component.
400C0009Config application has version: .Show the version number of the TSAgentConfig component.
400C000ADriver has version: .Show the version number of the TSAgentDrv component.
400C000BOS Release: SP: .Shows operating system version and installed service pack release number.
400C000COS Type: Suite: .Displays the Windows product type and suite.
400C000DFile '' exists, marking for removal on next system start.This line is displayed if a specific file exists but should be deleted on system restart.
800C000EFull functionality of the Terminal Server Agent requires a system reboot!This line is displayed if there was a configuration change which needs a restart to take effect or the TSAgent got installed/updated but the restart was not made.
400C000FMarking '' for removal failed, error .If this happens and you restart the system and the TSAgent still displays that you need to reboot to activate changes, you have to delete the “reboot_required” file which you can find in the installation directory.
400C0010File '' successfully marked for removal at next system start.The indicated file got successfully marked for removal at next system start.
400C0011File '' failed to open, error .This line is displayed if the specified file could not get read in for example because it does not exist.
C00D0001User '' exists already.This lines is displayed if the user with the displayed SID already has a port range assigned.
C00D0002Could not find a unused system port range. Please try increasing the system port range size.This line is displayed if the system port range is too small. Please increase the range in the config application. Otherwise the TSAgent fill not work correctly.
C00D0003Could not find a unused port range. Please try increasing the user port range size and if necessary decrease the number of ports per user.This line is displayed if there are more users logged on at the same time than user port ranges available. Please try increasing the user port range size and if necessary decrease the number of ports per user. This can also happen if you have configured a large range of reserved ports which reduce the size of the user port range.
C00D0005Can not remove user '' it does not exist.Should remove the user with the indicated SID but the user does not have a port range assigned.
400D0006User '\' removed. Port range freed.The port range assigned to the indicated user is now free for assignment to another user because all ports in the range are unused.
400D0007Port range assigned for existing user '\' ().This line shows if the service gets restarted and the driver notifies the service of the existing users and there port ranges.
Last updated on