Citrix Event IDs 2000 to 2102 to Monitor with Splunk

Citrix Event ID

Citrix Event ID 2000 to Citrix Event ID 2102

Citrix Event ID
Splunking Citrix? If you are or just need to figure out what the Event IDs are that Citrix is filling up your Windows Event Logs with here are Citrix Event IDs 2000 to 2102. These are more detailed than the earlier Event IDs and mainly have to do with the Citrix Broker Services. So if you are tracking down issues with XML services like the Citrix Broker Service this is range of Citrix Event IDs to look into.

Looking for Citrix Event IDs 1 to 509

Looking for Citrix Event IDs 1000 to 1201

Event ID to Monitor
Event Message Text
Event ID 2000
The Citrix Profile management Group Policy Extension has started. Cause: The Citrix Profile management Group Policy Extension has started to process policies for user ‘Domain\user’. Action: This message is informational and no action is required.
Event ID 2001
The Citrix Broker Service failed to initialize XML services. The services will attempt to initialize again in approximately 1 minute(s).Exception ‘Input string was not in a correct format.’ of type ‘System.FormatException’.
Event ID 2003
The Citrix Broker Service successfully started XML services.
Event ID 2004
Windows successfully diagnosed a low virtual memory condition. The following programs consumed the most virtual memory: WerFault.exe (15428) consumed 6796857344 bytes, BrokerService.exe (9432) consumed 722894848 bytes, and BrokerService.exe (9528) consumed 637378560 bytes.
Event ID 2007
The Citrix Broker Service is stopping XML HTTP services.
Event ID 2008
The Citrix Broker Service successfully stopped XML HTTP services.
Event ID 2012
The Citrix Broker Service was unable to send a response to the XML client.
Event ID 2012
The Citrix Broker Service was unable to send a response to the XML client. Details: Request URL: ‘/SCRIPTS/WPNBR.DLL’ Error Code: ‘1229’ Error Message: ‘An operation was attempted on a nonexistent network connection’ Exception Type: ‘System.Net.HttpListenerException’ Exception Call Stack: ‘ at System.Net.HttpResponseStream.Write(Byte[] buffer, Int32 offset, Int32 size) at Citrix.Cds.Xms.Multiplexer.XmlMultiplexer.HandleRequest(HttpListenerContext context, DateTime startTime)’
An unexpected exception occurred while the Citrix Broker Service processed an HTTP request. Error details: Request URL: ‘https://ddc.Domain.com/scripts/wpnbr.dll’ Exception Type: ‘Citrix.Cds.Broker.DAL.DALPowerActionIgnoredException’ Exception Call Stack: ‘ at Citrix.Xms.XmlSupport.XmlPerf.TimeoutAction(Int32 timeoutMs, Action action) at Citrix.Cds.Xms.Wpnbr.WpnbrServer.HandleRequest(HttpListenerRequest request, WindowsIdentity identity, DateTime startTime)’
Event ID 2100
The Citrix Broker Service failed to validate a user’s credentials on an XML service. Verify the trust relationships between your domains. Error details: User: ‘Domain\timothy.frazier.wa’ Error: ‘InvalidCredentials’ Message: ‘Failed Windows logon, error code 50’ Stack Trace: ”
Event ID 2101
The Citrix Broker Service failed to validate a user’s credentials on an XML service again. A previously detected problem still exists. To avoid excessive event logging, the service is suppressing related messages (event ID 2100) until the problem is resolved. Initialization attempts will continue.
Event ID 2102
The Citrix Broker Service successfully validated user credentials. It is no longer suppressing the related messages (event ID 2100).

Author: Logan Bingham

Designing IT solutions for 20 years.

4 thoughts on “Citrix Event IDs 2000 to 2102 to Monitor with Splunk”

Leave a Reply