You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: support/azure/azure-storage/files/security/files-client-other-errors.md
+89-32Lines changed: 89 additions & 32 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,22 +2,16 @@
2
2
title: Troubleshoot ClientOtherErrors in Azure Files
3
3
description: Troubleshoots ClientOtherErrors in SMB Azure file shares. ClientOtherErrors are requests that fail, but the system still behaves as expected.
4
4
ms.service: azure-file-storage
5
-
ms.date: 09/27/2023
5
+
ms.date: 12/12/2025
6
6
ms.reviewer: kendownie, v-weizhu
7
7
ms.custom: sap:Security
8
8
---
9
9
10
10
# Troubleshoot ClientOtherErrors in Azure Files
11
11
12
-
This article lists the ClientOtherErrors you might encounter when using SMB Azure file shares. In general, ClientOtherErrors are mostly harmless and expected errors. Requests fail, but the system continues to behave as expected. It's normal to see a significant amount of these errors logged.
This article lists the ClientOtherErrors you might encounter when using SMB Azure file shares. In general, ClientOtherErrors are mostly harmless and expected errors. Requests fail, but the system continues to behave as expected. It's normal to see a significant amount of these errors logged.
21
15
22
16
## What are ClientOtherErrors?
23
17
@@ -31,29 +25,92 @@ To troubleshoot ClientOtherErrors, you can create a diagnostic setting and use [
31
25
32
26
You can also collect a [ProcMon trace](/sysinternals/downloads/procmon) from a client that matches the IP address shown in the logs. Add a filter to see only traffic to Azure Files.
33
27
34
-
## Common ClientOtherErrors
35
-
36
-
The following table lists common ClientOtherErrors, along with an explanation of each error.
37
-
38
-
|**Operation**|**Status**|**Explanation of error**|
39
-
|-----------|--------|----------------------|
40
-
| QueryFullEaInformation | STATUS_NOT_IMPLEMENTED | This failure is returned because Azure Files doesn't implement this API. Azure Files [doesn't support](/rest/api/storageservices/features-not-supported-by-the-azure-file-service) extended attributes currently. |
41
-
| UnknownFileClass=48 | STATUS_NOT_SUPPORTED | This is the `FileNormalizedNameInformation` API call. This is new support for Windows Server, and currently Azure Files doesn't support this API. |
42
-
| FileOpen | 492 STATUS_ACCESS_DENIED | The caller doesn't have the required permissions to open the file. In the case of Kerberos access, the ACL denies the caller access. |
43
-
| FileOpen | 257 STATUS_OBJECT_NAME_INVALID | The path for the open request is invalid (for example, the path is too long or too deep). |
44
-
| FileOpen | 12 STATUS_FILE_IS_ADIRECTORY | The caller is opening a directory without using the correct `CreateFile` parameters (for example, Backup intent). |
45
-
| FileOpen | 8 STATUS_SHARING_VIOLATION | The caller is opening a file that's already opened with restrictions (for example, exclusive or others can only read). |
46
-
| FileOpen | 6 STATUS_OBJECT_NAME_NOT_FOUND | The caller is opening a file that doesn't exist. |
47
-
| FSCTL_QUERY_NETWORK_INTERFACE_INFO (IOCTL) | STATUS_INVALID_DEVICE_REQUEST | This is used only for Azure Files when customers have enabled the *multichannel* feature. In other cases, it's not needed, and we return an invalid device request when queried from the client. |
48
-
| QueryStreamInformation | STATUS_NOT_IMPLEMENTED | Some file systems have the concept of [alternate data streams](/windows/win32/fileio/file-streams?redirectedfrom=MSDN#stream-types) or other streams like reparse point stream. Azure Files doesn't have this concept, so we don't support the API. |
49
-
| Unexpected (IOCTL) | STATUS_INVALID_DEVICE_REQUEST | This is `FSCTL_QUERY_FILE_REGIONS`, a [region concept](/openspecs/windows_protocols/ms-fscc/4630b33f-a955-4ce0-91b6-fd4ba4aac1ce) that's specific to NTFS/refs and doesn't make sense in relation to Azure Files. So we don't implement this FSCTL code. |
50
-
| ChangeNotify | STATUS_CANCELLED | Applications like Windows Shell Explorer subscribe to change notifications for files. This way, when properties change on a file, Windows Shell Explorer automatically updates in the view. The client can choose to cancel this subscription (for example, if the user has changed views in Explorer and no longer needs it). In that case, we send `STATUS_CANCELLED` back to the client to acknowledge that the subscription has been canceled. |
51
-
| FSCTL_DFS_GET_REFERRALS (IOCTL) | STATUS_FS_DRIVER_REQUIRED | This is a DFS referral request. Azure Files doesn't support DFS, and this is the correct status to return when the system doesn't support DFS. |
52
-
| FileSupersede | STATUS_ACCESS_DENIED | File supersede is an operation where an existing file is deleted and a new file is put in its place. If the caller doesn't have permission to delete the existing file, the call will fail. |
53
-
| FileCreate | 7 STATUS_OBJECT_NAME_INVALID | This happens when a request to create a new file has an invalid requested name (for example, using unsupported characters). |
54
-
| FileCreate | 3 STATUS_OBJECT_NAME_COLLISION | This happens when a request to create a new file has a requested name that matches an existing file. |
55
-
| Read | STATUS_ACCESS_DENIED | This happens when a read request is done on a file with a handle that doesn't have the granted access of **read** (for example, the file was opened with the desired write access). |
56
-
| TreeConnect | STATUS_ACCESS_DENIED | In the context of Kerberos authentication, the caller doesn't have share-level permissions assigned via RBAC or the "Default Share Permissions" feature. If the "Default Share Permissions" feature isn't set, callers who are computer identities will consistently get this access failure on the share. |
28
+
## Query ClientOtherErrors in Log Analytics
29
+
30
+
Once you've enabled diagnostic logging for your storage account, you can query for specific ClientOtherErrors using Log Analytics. ClientOtherErrors are logged with a `StatusText` that starts with "ClientOtherError" and includes the specific error code.
| summarize Count = count() by StatusText, OperationName
47
+
| order by Count desc
48
+
```
49
+
50
+
## Common ClientOtherError codes and explanations
51
+
52
+
The following table maps specific error codes to their explanations. These errors appear in the `StatusText` field as "ClientOtherError;[ErrorCode];[ErrorName]" (for example, "ClientOtherError;492;STATUS_ACCESS_DENIED").
53
+
54
+
|**Operation**|**Status Code**|**Status Name**|**Explanation of error**|
| QueryFullEaInformation | 0xC00000BB | STATUS_NOT_IMPLEMENTED | This failure is returned because Azure Files doesn't implement this API. Azure Files [doesn't support](/rest/api/storageservices/features-not-supported-by-the-azure-file-service) extended attributes currently. |
57
+
| UnknownFileClass=48 | 0xC00000BB | STATUS_NOT_SUPPORTED | This is the `FileNormalizedNameInformation` API call. This is new support for Windows Server, and currently Azure Files doesn't support this API. |
58
+
| FileOpen | 0xC0000022 (492) | STATUS_ACCESS_DENIED | The caller doesn't have the required permissions to open the file. In the case of Kerberos access, the ACL denies the caller access. |
59
+
| FileOpen | 0xC0000033 (257) | STATUS_OBJECT_NAME_INVALID | The path for the open request is invalid (for example, the path is too long or too deep). |
60
+
| FileOpen | 0xC00000BA (12) | STATUS_FILE_IS_ADIRECTORY | The caller is opening a directory without using the correct `CreateFile` parameters (for example, Backup intent). |
61
+
| FileOpen | 0xC0000043 (8) | STATUS_SHARING_VIOLATION | The caller is opening a file that's already opened with restrictions (for example, exclusive or others can only read). |
62
+
| FileOpen | 0xC0000034 (6) | STATUS_OBJECT_NAME_NOT_FOUND | The caller is opening a file that doesn't exist. |
63
+
| FSCTL_QUERY_NETWORK_INTERFACE_INFO (IOCTL) | 0xC0000010 | STATUS_INVALID_DEVICE_REQUEST | This is used only for Azure Files when customers have enabled the *multichannel* feature. In other cases, it's not needed, and we return an invalid device request when queried from the client. |
64
+
| QueryStreamInformation | 0xC00000BB | STATUS_NOT_IMPLEMENTED | Some file systems have the concept of [alternate data streams](/windows/win32/fileio/file-streams?redirectedfrom=MSDN#stream-types) or other streams like reparse point stream. Azure Files doesn't have this concept, so we don't support the API. |
65
+
| Unexpected (IOCTL) | 0xC0000010 | STATUS_INVALID_DEVICE_REQUEST | This is `FSCTL_QUERY_FILE_REGIONS`, a [region concept](/openspecs/windows_protocols/ms-fscc/4630b33f-a955-4ce0-91b6-fd4ba4aac1ce) that's specific to NTFS/refs and doesn't make sense in relation to Azure Files. For this reason, we don't implement this FSCTL code. |
66
+
| ChangeNotify | 0xC0000120 | STATUS_CANCELLED | Applications like Windows Shell Explorer subscribe to change notifications for files. This way, when properties change on a file, Windows Shell Explorer automatically updates in the view. The client can choose to cancel this subscription (for example, if the user has changed views in Explorer and no longer needs it). In that case, we send `STATUS_CANCELLED` back to the client to acknowledge that the subscription has been canceled. |
67
+
| FSCTL_DFS_GET_REFERRALS (IOCTL) | 0xC000019C | STATUS_FS_DRIVER_REQUIRED | This is a DFS referral request. Azure Files doesn't support DFS, and this is the correct status to return when the system doesn't support DFS. |
68
+
| FileSupersede | 0xC0000022 | STATUS_ACCESS_DENIED | File supersede is an operation where an existing file is deleted and a new file is put in its place. If the caller doesn't have permission to delete the existing file, the call will fail. |
69
+
| FileCreate | 0xC0000033 (7) | STATUS_OBJECT_NAME_INVALID | This happens when a request to create a new file has an invalid requested name (for example, using unsupported characters). |
70
+
| FileCreate | 0xC0000035 (3) | STATUS_OBJECT_NAME_COLLISION | This happens when a request to create a new file has a requested name that matches an existing file. |
71
+
| Read | 0xC0000022 | STATUS_ACCESS_DENIED | This happens when a read request is done on a file with a handle that doesn't have the granted access of **read** (for example, the file was opened with the desired write access). |
72
+
| TreeConnect | 0xC0000022 | STATUS_ACCESS_DENIED | In the context of Kerberos authentication, the caller doesn't have share-level permissions assigned via RBAC or a default share-level permission. Computer identities will consistently get this access failure on the share if a share-level permission isn't set. |
73
+
74
+
## Query examples for common scenarios
75
+
76
+
The following are some examples of common Kusto queries that might be useful.
77
+
78
+
### Authentication and permission failures
79
+
80
+
```kusto
81
+
StorageFileLogs
82
+
| where StatusText has "STATUS_ACCESS_DENIED"
83
+
| where OperationName in ("FileOpen", "TreeConnect", "Read", "FileSupersede")
0 commit comments