Skip to content

Commit 94721a8

Browse files
khdowniekhdownie
authored
Update troubleshooting guide for ClientOtherErrors
Added new sections for querying ClientOtherErrors in Log Analytics, including Kusto query examples and common error codes.
1 parent 64cbef5 commit 94721a8

1 file changed

Lines changed: 89 additions & 32 deletions

File tree

‎support/azure/azure-storage/files/security/files-client-other-errors.md‎

Lines changed: 89 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -2,22 +2,16 @@
22
title: Troubleshoot ClientOtherErrors in Azure Files
33
description: Troubleshoots ClientOtherErrors in SMB Azure file shares. ClientOtherErrors are requests that fail, but the system still behaves as expected.
44
ms.service: azure-file-storage
5-
ms.date: 09/27/2023
5+
ms.date: 12/12/2025
66
ms.reviewer: kendownie, v-weizhu
77
ms.custom: sap:Security
88
---
99

1010
# Troubleshoot ClientOtherErrors in Azure Files
1111

12-
This article lists the ClientOtherErrors you might encounter when using SMB Azure file shares. In general, ClientOtherErrors are mostly harmless and expected errors. Requests fail, but the system continues to behave as expected. It's normal to see a significant amount of these errors logged.
13-
14-
## Applies to
12+
**Applies to:** :heavy_check_mark: SMB Azure file shares
1513

16-
| File share type | SMB | NFS |
17-
|-|:-:|:-:|
18-
| Standard file shares (GPv2), LRS/ZRS | :::image type="icon" source="media/files-client-other-errors/yes-icon.png" border="false"::: | :::image type="icon" source="media/files-client-other-errors/no-icon.png" border="false"::: |
19-
| Standard file shares (GPv2), GRS/GZRS | :::image type="icon" source="media/files-client-other-errors/yes-icon.png" border="false"::: | :::image type="icon" source="media/files-client-other-errors/no-icon.png" border="false"::: |
20-
| Premium file shares (FileStorage), LRS/ZRS | :::image type="icon" source="media/files-client-other-errors/yes-icon.png" border="false"::: | :::image type="icon" source="media/files-client-other-errors/no-icon.png" border="false"::: |
14+
This article lists the ClientOtherErrors you might encounter when using SMB Azure file shares. In general, ClientOtherErrors are mostly harmless and expected errors. Requests fail, but the system continues to behave as expected. It's normal to see a significant amount of these errors logged.
2115

2216
## What are ClientOtherErrors?
2317

@@ -31,29 +25,92 @@ To troubleshoot ClientOtherErrors, you can create a diagnostic setting and use [
3125

3226
You can also collect a [ProcMon trace](/sysinternals/downloads/procmon) from a client that matches the IP address shown in the logs. Add a filter to see only traffic to Azure Files.
3327

34-
## Common ClientOtherErrors
35-
36-
The following table lists common ClientOtherErrors, along with an explanation of each error.
37-
38-
| **Operation** | **Status** | **Explanation of error** |
39-
|-----------|--------|----------------------|
40-
| QueryFullEaInformation | STATUS_NOT_IMPLEMENTED | This failure is returned because Azure Files doesn't implement this API. Azure Files [doesn't support](/rest/api/storageservices/features-not-supported-by-the-azure-file-service) extended attributes currently. |
41-
| UnknownFileClass=48 | STATUS_NOT_SUPPORTED | This is the `FileNormalizedNameInformation` API call. This is new support for Windows Server, and currently Azure Files doesn't support this API. |
42-
| FileOpen | 492 STATUS_ACCESS_DENIED | The caller doesn't have the required permissions to open the file. In the case of Kerberos access, the ACL denies the caller access. |
43-
| FileOpen | 257 STATUS_OBJECT_NAME_INVALID | The path for the open request is invalid (for example, the path is too long or too deep). |
44-
| FileOpen | 12 STATUS_FILE_IS_ADIRECTORY | The caller is opening a directory without using the correct `CreateFile` parameters (for example, Backup intent). |
45-
| FileOpen | 8 STATUS_SHARING_VIOLATION | The caller is opening a file that's already opened with restrictions (for example, exclusive or others can only read). |
46-
| FileOpen | 6 STATUS_OBJECT_NAME_NOT_FOUND | The caller is opening a file that doesn't exist. |
47-
| FSCTL_QUERY_NETWORK_INTERFACE_INFO (IOCTL) | STATUS_INVALID_DEVICE_REQUEST | This is used only for Azure Files when customers have enabled the *multichannel* feature. In other cases, it's not needed, and we return an invalid device request when queried from the client. |
48-
| QueryStreamInformation | STATUS_NOT_IMPLEMENTED | Some file systems have the concept of [alternate data streams](/windows/win32/fileio/file-streams?redirectedfrom=MSDN#stream-types) or other streams like reparse point stream. Azure Files doesn't have this concept, so we don't support the API. |
49-
| Unexpected (IOCTL) | STATUS_INVALID_DEVICE_REQUEST | This is `FSCTL_QUERY_FILE_REGIONS`, a [region concept](/openspecs/windows_protocols/ms-fscc/4630b33f-a955-4ce0-91b6-fd4ba4aac1ce) that's specific to NTFS/refs and doesn't make sense in relation to Azure Files. So we don't implement this FSCTL code. |
50-
| ChangeNotify | STATUS_CANCELLED | Applications like Windows Shell Explorer subscribe to change notifications for files. This way, when properties change on a file, Windows Shell Explorer automatically updates in the view. The client can choose to cancel this subscription (for example, if the user has changed views in Explorer and no longer needs it). In that case, we send `STATUS_CANCELLED` back to the client to acknowledge that the subscription has been canceled. |
51-
| FSCTL_DFS_GET_REFERRALS (IOCTL) | STATUS_FS_DRIVER_REQUIRED | This is a DFS referral request. Azure Files doesn't support DFS, and this is the correct status to return when the system doesn't support DFS. |
52-
| FileSupersede | STATUS_ACCESS_DENIED | File supersede is an operation where an existing file is deleted and a new file is put in its place. If the caller doesn't have permission to delete the existing file, the call will fail. |
53-
| FileCreate | 7 STATUS_OBJECT_NAME_INVALID | This happens when a request to create a new file has an invalid requested name (for example, using unsupported characters). |
54-
| FileCreate | 3 STATUS_OBJECT_NAME_COLLISION | This happens when a request to create a new file has a requested name that matches an existing file. |
55-
| Read | STATUS_ACCESS_DENIED | This happens when a read request is done on a file with a handle that doesn't have the granted access of **read** (for example, the file was opened with the desired write access). |
56-
| TreeConnect | STATUS_ACCESS_DENIED | In the context of Kerberos authentication, the caller doesn't have share-level permissions assigned via RBAC or the "Default Share Permissions" feature. If the "Default Share Permissions" feature isn't set, callers who are computer identities will consistently get this access failure on the share. |
28+
## Query ClientOtherErrors in Log Analytics
29+
30+
Once you've enabled diagnostic logging for your storage account, you can query for specific ClientOtherErrors using Log Analytics. ClientOtherErrors are logged with a `StatusText` that starts with "ClientOtherError" and includes the specific error code.
31+
32+
### Query to view ClientOtherErrors
33+
34+
```kusto
35+
StorageFileLogs
36+
| where StatusText startswith "ClientOtherError"
37+
| project TimeGenerated, StatusText, StatusCode, OperationName, Uri, CallerIpAddress
38+
| order by TimeGenerated desc
39+
```
40+
41+
### Query to count errors by type
42+
43+
```kusto
44+
StorageFileLogs
45+
| where StatusText startswith "ClientOtherError"
46+
| summarize Count = count() by StatusText, OperationName
47+
| order by Count desc
48+
```
49+
50+
## Common ClientOtherError codes and explanations
51+
52+
The following table maps specific error codes to their explanations. These errors appear in the `StatusText` field as "ClientOtherError;[ErrorCode];[ErrorName]" (for example, "ClientOtherError;492;STATUS_ACCESS_DENIED").
53+
54+
| **Operation** | **Status Code** | **Status Name** | **Explanation of error** |
55+
|-----------|--------|--------|----------------------|
56+
| QueryFullEaInformation | 0xC00000BB | STATUS_NOT_IMPLEMENTED | This failure is returned because Azure Files doesn't implement this API. Azure Files [doesn't support](/rest/api/storageservices/features-not-supported-by-the-azure-file-service) extended attributes currently. |
57+
| UnknownFileClass=48 | 0xC00000BB | STATUS_NOT_SUPPORTED | This is the `FileNormalizedNameInformation` API call. This is new support for Windows Server, and currently Azure Files doesn't support this API. |
58+
| FileOpen | 0xC0000022 (492) | STATUS_ACCESS_DENIED | The caller doesn't have the required permissions to open the file. In the case of Kerberos access, the ACL denies the caller access. |
59+
| FileOpen | 0xC0000033 (257) | STATUS_OBJECT_NAME_INVALID | The path for the open request is invalid (for example, the path is too long or too deep). |
60+
| FileOpen | 0xC00000BA (12) | STATUS_FILE_IS_ADIRECTORY | The caller is opening a directory without using the correct `CreateFile` parameters (for example, Backup intent). |
61+
| FileOpen | 0xC0000043 (8) | STATUS_SHARING_VIOLATION | The caller is opening a file that's already opened with restrictions (for example, exclusive or others can only read). |
62+
| FileOpen | 0xC0000034 (6) | STATUS_OBJECT_NAME_NOT_FOUND | The caller is opening a file that doesn't exist. |
63+
| FSCTL_QUERY_NETWORK_INTERFACE_INFO (IOCTL) | 0xC0000010 | STATUS_INVALID_DEVICE_REQUEST | This is used only for Azure Files when customers have enabled the *multichannel* feature. In other cases, it's not needed, and we return an invalid device request when queried from the client. |
64+
| QueryStreamInformation | 0xC00000BB | STATUS_NOT_IMPLEMENTED | Some file systems have the concept of [alternate data streams](/windows/win32/fileio/file-streams?redirectedfrom=MSDN#stream-types) or other streams like reparse point stream. Azure Files doesn't have this concept, so we don't support the API. |
65+
| Unexpected (IOCTL) | 0xC0000010 | STATUS_INVALID_DEVICE_REQUEST | This is `FSCTL_QUERY_FILE_REGIONS`, a [region concept](/openspecs/windows_protocols/ms-fscc/4630b33f-a955-4ce0-91b6-fd4ba4aac1ce) that's specific to NTFS/refs and doesn't make sense in relation to Azure Files. For this reason, we don't implement this FSCTL code. |
66+
| ChangeNotify | 0xC0000120 | STATUS_CANCELLED | Applications like Windows Shell Explorer subscribe to change notifications for files. This way, when properties change on a file, Windows Shell Explorer automatically updates in the view. The client can choose to cancel this subscription (for example, if the user has changed views in Explorer and no longer needs it). In that case, we send `STATUS_CANCELLED` back to the client to acknowledge that the subscription has been canceled. |
67+
| FSCTL_DFS_GET_REFERRALS (IOCTL) | 0xC000019C | STATUS_FS_DRIVER_REQUIRED | This is a DFS referral request. Azure Files doesn't support DFS, and this is the correct status to return when the system doesn't support DFS. |
68+
| FileSupersede | 0xC0000022 | STATUS_ACCESS_DENIED | File supersede is an operation where an existing file is deleted and a new file is put in its place. If the caller doesn't have permission to delete the existing file, the call will fail. |
69+
| FileCreate | 0xC0000033 (7) | STATUS_OBJECT_NAME_INVALID | This happens when a request to create a new file has an invalid requested name (for example, using unsupported characters). |
70+
| FileCreate | 0xC0000035 (3) | STATUS_OBJECT_NAME_COLLISION | This happens when a request to create a new file has a requested name that matches an existing file. |
71+
| Read | 0xC0000022 | STATUS_ACCESS_DENIED | This happens when a read request is done on a file with a handle that doesn't have the granted access of **read** (for example, the file was opened with the desired write access). |
72+
| TreeConnect | 0xC0000022 | STATUS_ACCESS_DENIED | In the context of Kerberos authentication, the caller doesn't have share-level permissions assigned via RBAC or a default share-level permission. Computer identities will consistently get this access failure on the share if a share-level permission isn't set. |
73+
74+
## Query examples for common scenarios
75+
76+
The following are some examples of common Kusto queries that might be useful.
77+
78+
### Authentication and permission failures
79+
80+
```kusto
81+
StorageFileLogs
82+
| where StatusText has "STATUS_ACCESS_DENIED"
83+
| where OperationName in ("FileOpen", "TreeConnect", "Read", "FileSupersede")
84+
| project TimeGenerated, OperationName, Uri, CallerIpAddress, AuthenticationType, RequesterUpn
85+
| order by TimeGenerated desc
86+
```
87+
88+
### File not found errors
89+
90+
```kusto
91+
StorageFileLogs
92+
| where StatusText has "STATUS_OBJECT_NAME_NOT_FOUND"
93+
| project TimeGenerated, Uri, CallerIpAddress, OperationName
94+
| order by TimeGenerated desc
95+
```
96+
97+
### Invalid file operations such as naming, paths, and sharing violations
98+
99+
```kusto
100+
StorageFileLogs
101+
| where StatusText has_any ("STATUS_OBJECT_NAME_INVALID", "STATUS_SHARING_VIOLATION", "STATUS_OBJECT_NAME_COLLISION")
102+
| project TimeGenerated, StatusText, OperationName, Uri, CallerIpAddress
103+
| order by TimeGenerated desc
104+
```
105+
106+
### Top clients generating ClientOtherErrors
107+
108+
```kusto
109+
StorageFileLogs
110+
| where StatusText startswith "ClientOtherError"
111+
| summarize ErrorCount = count() by CallerIpAddress, bin(TimeGenerated, 1h)
112+
| order by ErrorCount desc
113+
```
57114

58115
## See also
59116

0 commit comments

Comments
 (0)