I have a SQL Server 2008 R2 Enterprise (SP2) cluster (2 nodes Windows Server 2008 R2 SP1, NetApp Shared storage).
There are 5 instances all running on this cluster in an active passive configuration and we have found that occasionally during the time that the weekly antivirus scan runs, one of the instances starts to drop connections and becomes inaccessible for about an hour (the scan runs for 2 hours), all the other instances are fine.
In the error log, we see the following messages when the server is inaccessible:
TCP connection closed but a child process of SQL Server may be holding a duplicate of the connection's socket. Consider enabling the TcpAbortiveClose SQL Server registry setting and restarting SQL Server. If the problem persists contact Technical Support.
Error: 26073 Severity: 16 State: 1.
They are also accompanied by the following error (although not all the time):
Process 0:0:0 (0x15540) Worker 0x0000000E721041A0 appears to be non-yielding on Scheduler 20. Thread creation time: 13025544955370. Approx Thread CPU Used: kernel 0 ms user 0 ms. Process Utilization 0%. System Idle 91%. Interval: 119402 ms.
During this time there are also some warnings with IO operations taking longer than 15 seconds to complete.
What I'd like to know is:
We have excluded all the locations recommended by Microsoft from scanning, so why is this only happening during the scan, can these issues just be caused by the extra load of the scan, they're pretty powerful boxes so I wouldn't have thought that the extra load would cause a problem, and the time at which this runs, the server is not busy, also if it is caused by the scan why does the problem only stay for 1 hour rather than the full 2?
What is the TcpAbortiveClose registry setting and what are the implications of this setting, I know how to set it from the Microsoft KB article(http://support.microsoft.com/kb/2491214), but I can't find any documentation on this setting anywhere on what it does or whether it is a good idea.