Re: Application Eventlog Error message

Tech-Archive recommends: Fix windows errors by optimizing your registry

From: KM (konstmor_at_nospam_yahoo.com)
Date: 01/31/05 

Date: Mon, 31 Jan 2005 09:43:22 -0800

Jay,

> One thing I am wondering is that these events should be recorded by Eventlog
> in systems log yet I see them with the error message in Application log. On
> XP Pro these messages are in System log. Does it mean that Eventlog service
> had problem reporting this events and reported as application error messages ?

Most likely. (Although to be 100% sure I must see the Dll's source code :) which is unlilely possible )

> I had also copied all registry entry from relating to Eventlog (under
> HKLM\CurrentControlset\Services) from working XP Pro to my image and still
> got same errors which leads me to believe that one or more DLL may not be
> registered or missing. Dependency check and build is clean so missing dll
> is less likely than registering dll.
>
> I also checked my FBA log and found following entries which gives errors
>
> "" [FBARegQueue: DllInstall] C:\CNAE_XP\WINDOWS\System32\eventcls.dll
> (Error: 0x8000ffff)
> 11:00:12 AM - [FBARegQueue: DllInstall]
> C:\CNAE_XP\WINDOWS\System32\swprv.dll (Error: 0x8000ffff) ""

These Dlls belong to "Volume Shadow Copy Service" - you've already go this component in your image.
Could you also check if "COM+ Services" is in your configuration? ANd if the COM+ service is running fine at run time?

Btw, regarding these errors Microsoft input was : "These two errors are benign and can be ignored- they are att-empting to
register the dlls before another component has been installe-d. They get registered later successfully. "

http://groups-beta.google.com/group/microsoft.public.windowsxp.embedded/msg/f6a1c82cba279855

> Any Idea what these errors mean ( what is Dll Install) ? and what is
> missing in configuration?

They don't mean much beside the fact that there is a "Catastrophic failure" with those components (Dlls). The error description
(E_UNEXPECTED) is useless to us now :-(

KM

>> Jay,
>>
>> Previously I just showed you the list of components that are registered in
> Application log.
>> Since you saw the messages in System log too it would make sense to check
> all the components that are registered as Eventlog
>> sources:
>>
>> Auditing Resource DLLs [Version 5.1.2600, R620], [Visibility=200]
>> Base Performance Counters [Version 5.1.2600, R620], [Visibility=200]
>>
>> CompactPCI Hot Swap Support [Version 5.1.2600.1106, R1507],
> [Visibility=1000]
>> Device Update Agent [Version 5.1.2600.1106, R1507],
> [Visibility=1000]
>> Disk Management Basic Volume Runtime [Version 5.1.2600, R620],
> [Visibility=1000]
>> Disk Management Dynamic Volume Runtime [Version 5.1.2600, R620],
> [Visibility=1000]
>> Disk Management Services [Version 5.1.2600, R620], [Visibility=200]
>> Disk Performance Counters [Version 5.1.2600, R620],
> [Visibility=1000]
>> El Torito CD [Version 5.1.2600.1106, R1507], [Visibility=1000]
>>
>> Event Log [Version 5.1.2600.1106, R1507], [Visibility=1000]
>>
>> First Boot Agent (FBA) [Version 5.1.2600.1106, R1507],
> [Visibility=200]
>> Folder Redirection Group Policy Extension [Version 5.1.2600.1106,
> R1507], [Visibility=1000]
>>
>> Group Policy Client Core [Version 5.1.2600, R620], [Visibility=200]
>> IIS Common Libraries [Version 5.1.2600.1106, R1507],
> [Visibility=200]
>>
>> IIS Core Libraries [Version 5.1.2600.1106, R1507], [Visibility=200]
>>
>> IIS Core Libraries - Hotfix Q319733 [Version 5.1.2600.41.1, R624],
> [Visibility=200]
>> IIS FTP Server [Version 5.1.2600.1106, R1507], [Visibility=1000]
>>
>> IIS FTP Server - Hotfix Q319733 [Version 5.1.2600.41.1, R625],
> [Visibility=1000]
>> IIS Web Server [Version 5.1.2600.1106, R1507], [Visibility=1000]
>>
>>
>> IIS Web Server - Hotfix Q319733 [Version 5.1.2600.41.1, R649],
> [Visibility=1000]
>> Intel Microcode Update Driver [Version 5.1.2600, R620],
> [Visibility=200]
>> Internet Authentication Service (IAS) and Remote Access Common Files
> [Version 5.1.2600, R620], [Visibility=200]
>>
>> Local Security Authority Subsystem (LSASS) [Version 5.1.2600.1106,
> R1507], [Visibility=200]
>>
>> Message Queuing (MSMQ) Core [Version 5.1.2600.1106, R1507],
> [Visibility=1000]
>> Message Queuing (MSMQ) Trigger Service [Version 5.1.2600.1106,
> R1507], [Visibility=1000]
>>
>> MPS Multiprocessor PC [Version 5.1.2600.1106, R1507],
> [Visibility=1000]
>>
>>
>> MPS Uniprocessor PC [Version 5.1.2600.1106, R1507],
> [Visibility=1000]
>> Netmeeting [Version 5.1.2600.1106, R1507], [Visibility=200]
>>
>> Network Performance Counters [Version 5.1.2600, R620],
> [Visibility=200]
>> Performance Counter Configuration [Version 5.1.2600, R620],
> [Visibility=1000]
>>
>> Performance Logs and Alerts Service [Version 5.1.2600.1106, R1507],
> [Visibility=200]
>>
>> Performance Monitor [Version 5.1.2600.1106, R1507],
> [Visibility=1000]
>> Simple Network Management Protocol (SNMP) [Version 5.1.2600.1106,
> R1507], [Visibility=1000]
>>
>> Simple Network Management Protocol (SNMP) - Hotfix Q314147 [Version
> 5.1.2600.28.1, R622], [Visibility=1000]
>> SNMP Event Translator [Version 5.1.2600, R620], [Visibility=1000]
>>
>> Software Installation Group Policy Extension [Version 5.1.2600.1106,
> R1507], [Visibility=1000]
>> Software Installation Group Policy MMC Snap-In [Version
> 5.1.2600.1106, R1507], [Visibility=1000]
>>
>> System Restore Core [Version 5.1.2600.1106, R1507],
> [Visibility=1000]
>>
>>
>> Terminal Services Core [Version 5.1.2600.1106, R1507],
> [Visibility=200]
>> Volume Shadow Copy Service [Version 5.1.2600.1106, R1507],
> [Visibility=1000]
>>
>> Windows Backup Utility [Version 5.1.2600, R620], [Visibility=50]
>> Windows CE USB Serial Host Driver [Version 5.1.2600, R620],
> [Visibility=200]
>> Windows Image Acquisition Core [Version 5.1.2600.1106, R1507],
> [Visibility=200]
>>
>>
>> WMI Core [Version 5.1.2600.1106, R1507], [Visibility=1000]
>>
>>
>> Some information for you about the EventLog:
> http://www.codeguru.com/Cpp/Cpp/cpp_managed/threads/article.php/c8895/
>> And MDSN, of course.
>>
>> KM
>>
>> > Hi KM,
>> >
>> > Thanks for the information you provided. I checked the components that
> are
>> > listed and I have them in my image except 3, Net Meeting , message
> Queuing
>> > and windows backup utility.
>> >
>> > I also compared the Event log\Application branch of the registry with XP
> Pro
>> > and found except few application entries they match.( The application
>> > entries like NERO, SQLServer etc. are not needed in image and are not
> in)
>> > I had also tried to load Event log\Application registry key from XP
> Pro to
>> > the image registry but it still reported errors in event log (shotgun
>> > approach).
>> >
>> > One question I have is the Event ID 6009, 6006, 6005 which are recorded
> in
>> > Application Log on XPe Image, but the same entries are recorded in
> System
>> > Log on XP Pro (of course without any errors). Why is this different ?
>> >
>> > I am also suspecting that one or more DLL which event log uses is not
>> > getting registered.
>> >
>> > Is there any tool or command to find out what DLL are registered then I
> can
>> > compare it among image and XP Pro installation.
>> >
>> > I really appreciate all the help you are providing for this problem.
>> >
>> > Regards,
>> >
>> > Jay.
>> > "KM" <konstmor@nospam_yahoo.com> wrote in message
>> > news:%23gyKIyYBFHA.4028@TK2MSFTNGP15.phx.gbl...
>> >> Jay,
>> >>
>> >> Then you would probably want to debug it more deeply.
>> >> Go to [HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application] key
> on
>> > your target and compare its content to the same key
>> >> content on XP Pro. You will see all the different applications that are
>> > registered in app log.
>> >>
>> >> The following components listed from XPe database that have some Dll's
>> > registration for the Eventlog\Application branch:
>> >>
>> >> Base Performance Counters [Version 5.1.2600, R620],
> [Visibility=200]
>> >> Device Update Agent [Version 5.1.2600.1106, R1507],
>> > [Visibility=1000]
>> >> Disk Performance Counters [Version 5.1.2600, R620],
>> > [Visibility=1000]
>> >> Event Log [Version 5.1.2600, R620], [Visibility=1000]
>> >> Event Log [Version 5.1.2600.1106, R1507], [Visibility=1000]
>> >> Folder Redirection Group Policy Extension [Version 5.1.2600.1106,
>> > R1507], [Visibility=1000]
>> >> Folder Redirection Group Policy Extension [Version 5.1.2600,
> R620],
>> > [Visibility=1000]
>> >> Group Policy Client Core [Version 5.1.2600, R620],
> [Visibility=200]
>> >> IIS Core Libraries [Version 5.1.2600.1106, R1507],
> [Visibility=200]
>> >> IIS Core Libraries [Version 5.1.2600, R620], [Visibility=200]
>> >> IIS Core Libraries - Hotfix Q319733 [Version 5.1.2600.41.1,
> R624],
>> > [Visibility=200]
>> >> IIS FTP Server [Version 5.1.2600, R620], [Visibility=1000]
>> >> IIS FTP Server [Version 5.1.2600.1106, R1507], [Visibility=1000]
>> >> IIS FTP Server - Hotfix Q319733 [Version 5.1.2600.41.1, R625],
>> > [Visibility=1000]
>> >> IIS Web Server [Version 5.1.2600.1106, R1507], [Visibility=1000]
>> >> IIS Web Server [Version 5.1.2600, R620], [Visibility=1000]
>> >> IIS Web Server - Hotfix Q275657 [Version 5.1.2600, R641],
>> > [Visibility=1000]
>> >> IIS Web Server - Hotfix Q319733 [Version 5.1.2600.41.1, R649],
>> > [Visibility=1000]
>> >> Message Queuing (MSMQ) Core [Version 5.1.2600, R620],
>> > [Visibility=1000]
>> >> Message Queuing (MSMQ) Core [Version 5.1.2600.1106, R1507],
>> > [Visibility=1000]
>> >> Message Queuing (MSMQ) Trigger Service [Version 5.1.2600.1106,
>> > R1507], [Visibility=1000]
>> >> Message Queuing (MSMQ) Trigger Service [Version 5.1.2600, R620],
>> > [Visibility=1000]
>> >> Netmeeting [Version 5.1.2600.1106, R1507], [Visibility=200]
>> >> Netmeeting [Version 5.1.2600, R620], [Visibility=200]
>> >> Network Performance Counters [Version 5.1.2600, R620],
>> > [Visibility=200]
>> >> Performance Counter Configuration [Version 5.1.2600, R620],
>> > [Visibility=1000]
>> >> Performance Logs and Alerts Service [Version 5.1.2600, R620],
>> > [Visibility=200]
>> >> Performance Logs and Alerts Service [Version 5.1.2600.1106,
> R1507],
>> > [Visibility=200]
>> >> Performance Monitor [Version 5.1.2600, R620], [Visibility=1000]
>> >> Performance Monitor [Version 5.1.2600.1106, R1507],
>> > [Visibility=1000]
>> >> SNMP Event Translator [Version 5.1.2600, R620], [Visibility=1000]
>> >> Software Installation Group Policy Extension [Version 5.1.2600,
>> > R620], [Visibility=1000]
>> >> Software Installation Group Policy Extension [Version
> 5.1.2600.1106,
>> > R1507], [Visibility=1000]
>> >> Software Installation Group Policy MMC Snap-In [Version
>> > 5.1.2600.1106, R1507], [Visibility=1000]
>> >> Software Installation Group Policy MMC Snap-In [Version 5.1.2600,
>> > R620], [Visibility=1000]
>> >> Windows Backup Utility [Version 5.1.2600, R620], [Visibility=50]
>> >> WMI Core [Version 5.1.2600, R620], [Visibility=1000]
>> >> WMI Core [Version 5.1.2600.1106, R1507], [Visibility=1000]
>> >>
>> >>
>> >>
>> >> Try to include one-by-one (probalby leaving out or for the last some
>> > obviously heavy components like IIS, WMI).
>> >> Don't bother to search for components with old revisions (listed twice
> in
>> > the list above). Just include the components and it will
>> >> promise to use the latest ones.
>> >>
>> >> --
>> >> Regards,
>> >> KM, BSquare Corp.
>> >>
>> >>
>> >> > Hi KM,
>> >> >
>> >> > Yes I did.
>> >> >
>> >> > Regards,
>> >> >
>> >> > Jay
>> >> > "KM" <konstmor@nospam_yahoo.com> wrote in message
>> >> > news:%23hDZvLYBFHA.1004@TK2MSFTNGP15.phx.gbl...
>> >> > > Jay,
>> >> > >
>> >> > > Did you include "Group Policy Client Core" component?
>> >> > >
>> >> > > --
>> >> > > Regards,
>> >> > > KM, BSquare Corp.
>> >> > >
>> >> > >
>> >> > > > Hi KM,
>> >> > > >
>> >> > > > Your suggestion to include "Software Installation Group Policy
>> >> > Extension"
>> >> > > > in the image fixed Eventlog ID 6006 problem but still I have
> event
>> > ID
>> >> > 6005
>> >> > > > and 6009 which are also exhibiting same problem the detail
> follows
>> >> > > > "
>> >> > > > The description for Event ID ( 6009 ) in Source ( EventLog )
> cannot
>> > be
>> >> > > > found. The local computer may not have the necessary registry
>> >> > information or
>> >> > > > message DLL files to display messages from a remote computer. You
>> > may be
>> >> > > > able to use the /AUXSOURCE= flag to retrieve this description;
> see
>> > Help
>> >> > and
>> >> > > > Support for details. The following information is part of the
> event:
>> >> > 5.01.,
>> >> > > > 2600, , Multiprocessor Free.
>> >> > > >
>> >> > > >
>> >> > > >
>> >> > > > The description for Event ID ( 6005 ) in Source ( EventLog )
> cannot
>> > be
>> >> > > > found. The local computer may not have the necessary registry
>> >> > information or
>> >> > > > message DLL files to display messages from a remote computer. You
>> > may be
>> >> > > > able to use the /AUXSOURCE= flag to retrieve this description;
> see
>> > Help
>> >> > and
>> >> > > > Support for details. The following information is part of the
> event:
>> > .
>> >> > "
>> >> > > >
>> >> > > > Any thoughts ?
>> >> > > >
>> >> > > > Thanks
>> >> > > >
>> >> > > > Jay
>> >> > > > "KM" <konstmor@nospam_yahoo.com> wrote in message
>> >> > > > news:uf13PSMBFHA.3492@TK2MSFTNGP12.phx.gbl...
>> >> > > > > Jay,
>> >> > > > >
>> >> > > > > Just in case, make sure that "Software Installation Group
> Policy
>> >> > > > Extension" component is also included.
>> >> > > > >
>> >> > > > > --
>> >> > > > > Regards,
>> >> > > > > KM, BSquare Corp.
>> >> > > > >
>> >> > > > >
>> >> > > > > > Hi KM,
>> >> > > > > >
>> >> > > > > > I already have drvmain.sdb under AppPatch directory. I will
> try
>> >> > Q824704.
>> >> > > > > >
>> >> > > > > > Thanks for your help.
>> >> > > > > >
>> >> > > > > > Regards,
>> >> > > > > >
>> >> > > > > > Jay
>> >> > > > > > "KM" <konstmor@nospam_yahoo.com> wrote in message
>> >> > > > > > news:ug8Cm2LBFHA.3576@TK2MSFTNGP11.phx.gbl...
>> >> > > > > > > Jay,
>> >> > > > > > >
>> >> > > > > > > Either install Q824704 (it will bring the necessary hotfix
> to
>> >> > > > "Application
>> >> > > > > > Compatibility Core" component):
>> >> > > > > > >
>> >> > > > > >
>> >> > > >
>> >> >
>> >
> http://www.microsoft.com/downloads/details.aspx?FamilyID=2fc450e7-a2d9-4e75-b6ba-9570653f0891&DisplayLang=en
>> >> > > > > > >
>> >> > > > > > >
>> >> > > > > > > Or add drvmain.sdb file from XPe Repository to your image
>> > under
>> >> > > > > > \Windows\AppPatch on target:
>> >> > > > > > >
>> >> > > > > >
>> >> > > > >
>> >> > > >
>> >> > >
>> >> >
>> >>
>> >
> http://groups-beta.google.com/group/microsoft.public.windowsxp.embedded/search?group=microsoft.public.windowsxp.embedded&q=drvmain.sdb&qt_g=1&searchnow=Search+this+group
>> >> > > > > > >
>> >> > > > > > > --
>> >> > > > > > > Regards,
>> >> > > > > > > KM, BSquare Corp.
>> >> > > > > > >
>> >> > > > > > >
>> >> > > > > > > > Hi,
>> >> > > > > > > >
>> >> > > > > > > > I am getting following error in Application event log
>> >> > > > > > > >
>> >> > > > > > > >
>> >> > > > > > > > "The description for Event ID ( 6006 ) in Source (
>> > EventLog )
>> >> > cannot
>> >> > > > be
>> >> > > > > > > > found. The local computer may not have the necessary
>> > registry
>> >> > > > > > information or
>> >> > > > > > > > message DLL files to display messages from a remote
>> > computer.
>> >> > You
>> >> > > > may be
>> >> > > > > > > > able to use the /AUXSOURCE= flag to retrieve this
>> > description;
>> >> > see
>> >> > > > Help
>> >> > > > > > and
>> >> > > > > > > > Support for details. The following information is part of
>> > the
>> >> > event:
>> >> > > > . "
>> >> > > > > > > >
>> >> > > > > > > > Any clue what registry Entry/DLL could be missing??
>> >> > > > > > > >
>> >> > > > > > > > The image had clean dependency check and build had no
>> > errors.
>> >> > > > > > > >
>> >> > > > > > > > Thanks
>> >> > > > > > > >
>> >> > > > > > > > Jay
>> >> > > > > > > >
>> >> > > > > > > >
>> >> > > > > > >
>> >> > > > > > >
>> >> > > > > >
>> >> > > > > >
>> >> > > > >
>> >> > > > >
>> >> > > >
>> >> > > >
>> >> > >
>> >> > >
>> >> >
>> >> >
>> >>
>> >>
>> >
>> >
>>
>>
>
>

Relevant Pages

  • Re: d344bus error
    ... 100% CPU state, especially when network setting changes. ... I can only find one error message in the System log: ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: Cannot open any directory--very urgently
    ... Reg_Sz string value of; ... Microsoft MVP [Windows] ... | I check the application log, and find only one error message as below ... | No error in the system log. ...
    (microsoft.public.win2000.general)
  • Re: Suddenly big trouble..
    ... Review your system log for information and/or disable "auto-restart" ... give you the BSOD and error message. ... > and dropping some files to a different directory, the system reboots. ...
    (microsoft.public.windowsxp.hardware)
  • Re: Prefetch, MCSTRM, & Real Player
    ... Pete wrote: ... as the error message still appears in my system log. ... All of these files were installed from Real Player, ...
    (microsoft.public.windowsxp.setup_deployment)
  • SNMP Service
    ... I have installed the SNMP service on Win XP Pro but when I start the service ... it stops again straight away. ... The system log just show an event to indicate ...
    (microsoft.public.windowsxp.general)