many Kernel-EventTracing 0xC0000022 errors caused by SophosNtpService.exe on Windows Servers

Hi LHerzog

Error : Session "" failed to start with the following error: 0xC0000022 | Source: Kernel-EventTracing | Event ID: 2 |Level: Error |

From reviewing the logs and seeing the error, It seems that it is not a Sophos issue, but one that is outlined in the following KB by Microsoft. Let me know if it helps. 

https://docs.microsoft.com/en-us/troubleshoot/windows-server/networking/kernel-event-id-2-msft-netLbfoteamnic-class

Hi,

this issue is exclusively caused by the PID of the Sophos process: SophosNtpService.exe

I don't think this is a Microsoft issue. Maybe SophosNtpService triggering some Windows component or itself acting like a teaming device?

This is a standard VM with no teaming, just a virtual vmxnet3 adapter.

I am getting this on my server 2012 R2 systems as well.  Any progress on this problem?   I first noticed it on some servers which used MS Network Load Balancing, but I see it on others that don't have this.  All instances seem to have started on 3/7 in the early afternoon. 

Hi Moltron5k about the Start Date of the issue - in our case it is limited by the default size of the eventlog that contains them. it's only 1MB. It may have been there much longer.

LHerzog, I had that suspicion.  I restored an event file from a few weeks ago and yup its full of those events.  So, nothing new.  Thought it was because this is a newer thread, and it was just coincidence on our side we had an application issue start around the same time as the oldest entry of these logs.  Also, I don't see this happening on any 2019 servers.

LHerzog, I had that suspicion.  I restored an event file from a few weeks ago and yup its full of those events.  So, nothing new.  Thought it was because this is a newer thread, and it was just coincidence on our side we had an application issue start around the same time as the oldest entry of these logs.  Also, I don't see this happening on any 2019 servers.