KERNELBASE.DLL ERROR in BO SYSTEM
Hi,
Our BO system version is 3.1 SP6 Patch 1 and our operating system is Windows Server Enterprise 2008 R2 SP1.
When we look at the Windows Logs from Event Viewer, we see KERNELBASE.dll errors related with BO.
After KERNELBASE.dll error, Some Webi Processing Servers stop. For example, we get error message; WebIntelligenceProcessingServer10 stopped with exit code = 255 (0xff).
Have you ever encountered with KERNELBASE.dll error?
What is the solution to prevent KERNELBASE.dll error?
Best Wishes,
Cihangir
Hi Cihangir,
I guess this issue is caused by incompatible between 32bit application [BOXI 3.1]and 64bit Operating System.
You can resolve this issue by "Performance Logs & Alerts" to automatic and starting.
Checkout the steps below for starting "Performance Logs & Alerts":
http://computerstepbystep.com/performance_logs_&_alerts_service.html
Good Luck!!!
Regards,
Mahesh Chaudhari
Similar Messages
-
We installed a new Server 2008 R2 server this spring. It is configured as a Terminal Server with 16 Wyse t10 thin clients connecting with RDP. We are a small resort so we run Springer Miller Host and SpaSoft. Ever since moving from PCs to the thin clients
and TS we have been seeing SpaSoft randomly crash with KERNELBASE.dll errors and also a lot of c0000005 and c0000006 errors. Springer Miller support says its a Microsoft Networking issue so no help there. The company we worked with to install this has no clue
so I hope to reach out to this community to solve this. I can also open support case with Microsoft Support but I am not sure if they will be of any help. Here are some examples of the errors:
"Event 1000
Faulting application name: SpaWin.exe, version: 3.4.0.0, time stamp: 0x2a425e19
Faulting module name: KERNELBASE.dll, version: 6.1.7601.18409, time stamp: 0x53159a86
Exception code: 0x0eedfade
Fault offset: 0x0000c42d
Faulting process id: 0x3718
Faulting application start time: 0x01cf9ac7922487e9
Faulting application path: \\spasoft\spaapps\TermServ\SpaWin.exe
Faulting module path: C:\Windows\syswow64\KERNELBASE.dll
Report Id: cfdcf9a9-06ba-11e4-a5af-000c298d9aa5"
Also:
"Faulting application name: VH.EXE, version: 18.80.430.0, time stamp: 0x3f73b447
Faulting module name: VFP8R.DLL, version: 8.0.0.3117, time stamp: 0x3f73c232
Exception code: 0xc0000006
Fault offset: 0x0001d598
Faulting process id: 0x2bc8
Faulting application start time: 0x01cf99297ee1742f
Faulting application path: J:\HOSTPLUS\fxp32\VH.EXE
Faulting module path: J:\HOSTPLUS\fxp32\VFP8R.DLL
Report Id: 5fbc65c4-055c-11e4-a5af-000c298d9aa5"
And:
"Faulting application name: SpaWin.exe, version: 3.4.0.0, time stamp: 0x2a425e19
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xc0000005
Fault offset: 0x00000000
Faulting process id: 0x2aa0
Faulting application start time: 0x01cf988e6770e619
Faulting application path: \\spasoft\spaapps\TermServ\SpaWin.exe
Faulting module path: unknown
Report Id: 01029179-04b9-11e4-a5af-000c298d9aa5"
There are no network specific errors in any of the logs. I am thinking that SpaSoft needs to be run as an administrator but I am not sure how to do that in this environment. We have disabled DEP for all but essential Windows processes. All of the firewall
and AV has been completely disabled, and still getting these errors. Is there a way to run these applications as admin without the user actually being an admin? Should I go ahead and open a Microsoft support case? ThanksHi,
Thank you for posting in Windows Server Forum.
Explanation
The indicated program stopped unexpectedly. The message contains details on which program and module stopped. A matching event with Event ID 1001 might also appear in the event log. This matching event displays information about the specific error that occurred.
User Action
If an error report was generated for this error, you might be able to obtain more information about the error by sending the report to Microsoft for analysis.
Yeah, you can open a support case with Microsoft as they will help and guide you for proper solution. You can go through
this source article.
Hope it helps!
Thanks.
Dharmesh Solanki -
I Keep Getting An Error During The Release Build Of My App That Says Its A Kernelbase.dll Error In Flash Builder 4.6. Anyone Know How To Get Rid Of This?
I have the same error.
The wierd is that the log file doesn't exists.
Anyway I try everything... to reinstal my Flash Builder, reinstall all versions of java. I even try to make Xmx and Xms bigger size.. but nothing... still got the error.
If I create new project... then everything works fine... Export Release Build work very well,
but if I try to Export Release Build for my large project... then this error comes up.
I look at my code and no find any errors...
Build for android works as well, the error comes up when I try to build for iOS.
Please Adobe - give us help how to fix this.
Thank you -
ScanEngineTest.exe and KERNELBASE.dll Errors
I have a new install of Exchange 2013 (SP1, CU6) and I am receiving errors every 30 minutes. They appear to be happening when Exchange tries to test the scan engine update. Here are the errors: Any suggestions would be appreciated!
Chris
Log Name: Application
Source: Application Error
Date: 9/22/2014 11:03:43 AM
Event ID: 1000
Task Category: (100)
Level: Error
Keywords: Classic
User: N/A
Computer: removed
Description:
Faulting application name: ScanEngineTest.exe, version: 15.0.995.21, time stamp: 0x53d065d3
Faulting module name: KERNELBASE.dll, version: 6.2.9200.17046, time stamp: 0x53b4864c
Exception code: 0xc0000142
Fault offset: 0x00000000000e2000
Faulting process id: 0x3b2c
Faulting application start time: 0x01cfd67ec8a828c8
Faulting application path: C:\Program Files\Microsoft\Exchange Server\V15\FIP-FS\Bin\ScanEngineTest.exe
Faulting module path: KERNELBASE.dll
Report Id: 0667c791-4272-11e4-93f9-00155d641207
Faulting package full name:
Faulting package-relative application ID:
Log Name: Application
Source: Microsoft-Filtering-FIPFS
Date: 9/22/2014 11:03:44 AM
Event ID: 6035
Task Category: None
Level: Warning
Keywords:
User: NETWORK SERVICE
Computer: vm-vhex.vbartlett.org
Description:
MS Filtering Engine Update process was unsuccessful in testing an engine update.
Engine: Microsoft
LastCheckedTime:2014-09-22T16:03:44.000ZHi
Try disabling/re-enabling the malware scanning component.
Hope this helps. Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread. -
IE 10, EMET 4.0, Win7 SP1 kernelbase.dll error
I am really not sure what on my Win 7 SP1 system is causing this issue, but with EMET 3.0 everything runs fine, when I upgrade it to EMET 4.0 it initiallly does not show anything "Running EMET" even though it has settings from a large number of
programs via GPO. If I manually add IE to the list it suddenly starts to recognize that it is protecting programs that it is configured to protect, but IE crashes creating this Event Log:
Faulting application name: IEXPLORE.EXE, version: 10.0.9200.16660, time stamp: 0x51f1c5f3
Faulting module name: KERNELBASE.dll, version: 6.1.7601.18015, time stamp: 0x50b83c8a
Exception code: 0xe06d7363
Fault offset: 0x0000c41f
Faulting process id: 0x3184
Faulting application start time: 0x01cebae8faca6d78
Faulting application path: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
Faulting module path: C:\Windows\syswow64\KERNELBASE.dll
Report Id: d7d24822-26df-11e3-a425-02d0bbf30701
There was some suggestions that Sophos Antivirus's Buffer Overflow protection might not be compatible with EMET 4.0, but disabling that feature in Sophos has not helped.I recently downloaded the EMET 5.0 Technical Preview 2 and encountered similar results.
With all EMET protections enabled and Sophos Endpoint 10.3 running, IE would 'crash' nearly instantaneously. I found corollary Events (in this case, from Source: Sophos) stating:
Process "C:\Program Files (x86)\Internet Explorer\iexplore.exe" exhibiting suspicious behavior pattern 'Buffer Overflow'. Operation suspended.
Removing all EMET protections (with no other chnages) allowed IE to launch successfully again.
Side-note: I also noticed Events logged at a similar time, suggesting DistributedCOM delays: "The server {D5E8041D-920F-45E9-B8FB-B1DEB82C6E5E} did not register with DCOM within the required timeout".
Bryan Dady System Center Architect Denali Advanced Integration a division of 3MD, Inc. www.denaliai.com [email protected] -
Hi there,
Some of my Toshiba applications like Toshiba bulletin board, toshiba reeltime, toshiba blu-ray disc player and more have stopped working...
here what it says
<?xml version="1.0" encoding="UTF-16"?>
-<WERReportMetadata> -<OSVersionInformation> <WindowsNTVersion>6.1</WindowsNTVersion> <Build>7601 Service Pack 1</Build> <Product>(0x3): Windows 7 Home Premium</Product> <Edition>HomePremium</Edition> <BuildString>7601.17835.amd64fre.win7sp1_gdr.120503-2030</BuildString> <Revision>1130</Revision> <Flavor>Multiprocessor Free</Flavor> <Architecture>X64</Architecture> <LCID>1033</LCID> </OSVersionInformation> -<ParentProcessInformation> <ParentProcessId>4600</ParentProcessId> <ParentProcessPath>C:\Windows\System32\wscript.exe</ParentProcessPath> <ParentProcessCmdLine>"C:\windows\System32\WScript.exe" "BDPlayerSetup.vbs" </ParentProcessCmdLine> </ParentProcessInformation> -<ProblemSignatures> <EventType>APPCRASH</EventType> <Parameter0>SMIPlayerSetup.exe</Parameter0> <Parameter1>1.0.0.0</Parameter1> <Parameter2>4d91350c</Parameter2> <Parameter3>KERNELBASE.dll</Parameter3> <Parameter4>6.1.7601.17651</Parameter4> <Parameter5>4e21213c</Parameter5> <Parameter6>e0434f4d</Parameter6> <Parameter7>000000000000cacd</Parameter7> </ProblemSignatures> -<DynamicSignatures> <Parameter1>6.1.7601.2.1.0.768.3</Parameter1> <Parameter2>1033</Parameter2> </DynamicSignatures> -<SystemInformation> <MID>DA47475B-D863-44CB-A0B8-F15FD9CF7ADD</MID> <MarkerFile>1179_TOSHIBA_na_Qosmio_F750_TI30785300B</MarkerFile> <SystemManufacturer>TOSHIBA</SystemManufacturer> <SystemProductName>Qosmio F750</SystemProductName> <BIOSVersion>Version 2.00</BIOSVersion> </SystemInformation> </WERReportMetadata>
Please help me anyone... it's a new laptop and I need it to watch 3D with my toshiba blu-ray disc player
Thanks.All of those applications have problems? Do you know what triggered this? What model number is it?
- Peter -
LogonUI.exe bad image - authui.dll error. Cant system restore or restore to factory settings
Hi,
My notebook which is a HP pavilion dm4 beats edition computer which runs WIndows 7 home premium, was just bought 2 months and I've been using it just for 2 months.
Yesterday morning it was working fine, and I didnt download any new software or do any changes but in the evening when i turned it on,
after the 'starting windows' screen, it was this error message
LogonUI.exe - Bad Image
C:\Windows\system32\authui.dll is either not designed to run on Windows or it contains an error. Try installing the program again using the original installation media or contact your system administrator the software vendor for support.
I tried safe mode, it goes back to the same error screen.
When i try pressing f8 and go to 'last known good configuration' it goes to the error screen as well.
I tried pressing f8 and going to HP recovery manager and selecting system restore but it says no system restore points have been created, when I try to create one or go forward, it says the computer is running in a limited state and its not possible.
The option 'restore to factory settings' can not be selected, I dont know why. The cursor does not change colour of the option when it goes above it, and that option cant be selected.
My recovery partition is there and I have not done any adjustments to it.
The only thing that opens is a command prompt window, could you assist me on how to restore to factory settings through this? Because typing rstui.exe brings the same message saying no restore points have been created.I cant chose system recovery, the option cant be selected.
When I can go onto command prompt after going to 'advanced boot options' but then typing sfc /scannow says the computer needs a reboot, once you reboot, its just the same thing.
Normally starting windows or starting windows in safe mode gives the LogoUI.exe bad image error just before when I would normally scan my fingerprint or enter the password.
I tried putting in a windows cd, but it wont let it 'repair the computer' but trying to reinstall windows, no hard disks are visible. Its like I dont have a hard drive.
But you can go to command prompt and go into dir you can view all my files. But just searching for C, it says directory of C was not found.
Its just really strange because the laptop worked fine in the morning, and in the evening, as soon as I turned it on, it was just this black screen and an error msg -
Application Error - Faulting module name: KERNELBASE.dll, version: 6.1.7600.16385
Hi,
we have one Visual C++ application and this application also using few external dlls. while exiting from application, getting following error. This
is happened in Windows 7.
Please help us to resolve this issue.
Log Name:
Application
Source:
Application Error
Date:
28/07/2010 11:44:16 AM
Event ID:
1000
Task Category: (100)
Level:
Error
Keywords:
Classic
User:
N/A
Computer:
CRIWKS12.crillylaw.local
Description:
Faulting application name: WinTest.exe, version: 2.7.1.0, time stamp: 0x4b78d5b8
Faulting module name: KERNELBASE.dll, version: 6.1.7600.16385, time stamp: 0x4a5bdaae
Exception code: 0x0eedfade
Fault offset: 0x00009617
Faulting process id: 0x10b8
Faulting application start time: 0x01cb2df647dfd847
Faulting application path: C:\Program Files\xxx\xxx\xxx\ WinTest.exe
Faulting module path: C:\Windows\system32\KERNELBASE.dll
Report Id: a17377fd-99e9-11df-8941-90fba60d7539
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Application Error" />
<EventID Qualifiers="0">1000</EventID>
<Level>2</Level>
<Task>100</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2010-07-28T01:44:16.000000000Z" />
<EventRecordID>3773</EventRecordID>
<Channel>Application</Channel>
<Computer>CRIWKS12.crillylaw.local</Computer>
<Security />
</System>
<EventData>
<Data> WinTest.exe</Data>
<Data>2.7.1.0</Data>
<Data>4b78d5b8</Data>
<Data>KERNELBASE.dll</Data>
<Data>6.1.7600.16385</Data>
<Data>4a5bdaae</Data>
<Data>0eedfade</Data>
<Data>00009617</Data>
<Data>10b8</Data>
<Data>01cb2df647dfd847</Data>
<Data>C:\Program Files\xxx\xxx\xxx\ WinTest.exe</Data>
<Data>C:\Windows\system32\KERNELBASE.dll</Data>
<Data>a17377fd-99e9-11df-8941-90fba60d7539</Data>
</EventData>
</Event>
PS. I apologise for not being able to provide the application's name.Hi Jesse ,
I am pasting the entire module where the code fails:
/// <summary>
/// Pool the job execution status
/// </summary>
private void PoolJobExecutionStatus()
int waitIndex = 0;
while (true)
try
lock (this.lockingObject)
this.ReOpenRegistryConnection();
currentJob = SR.Job.Load(this.currentJobId, this.poolingConnection);
JobStatusEventArgs jobStatusArg = (currentJob.Status == SR.JobStatus.Aborted) ?
new JobStatusEventArgs(currentJob.Name, currentJob.Status, currentJob.ErrorMessage) :
new JobStatusEventArgs(currentJob.Name, currentJob.Status);
this.dispatcher.BeginInvoke(new EventHandler<JobStatusEventArgs>(RaiseUpdateStatus), DispatcherPriority.Normal, new object[] { this, jobStatusArg });
if (currentJob.Status == JobStatus.Aborted || currentJob.Status == JobStatus.Completed)
this.PoolJobThread.Abort();
break;
catch (ThreadAbortException)
catch (ConnectionFailure ex)
TridentErrorHandler.HandleUIException(ex);
// If reconnection fails more than the max reconnection value then exit.
if (this.connectionAttempts >= this.maxConnectionAttempts)
break;
this.connectionAttempts++;
catch (BackendStorageException ex)
TridentErrorHandler.HandleUIException(ex);
// If reconnection fails 5 times then exit.
if (this.connectionAttempts >= this.maxConnectionAttempts)
break;
this.connectionAttempts++;
catch (Exception ex)
TridentErrorHandler.HandleUIException(ex);
break;
try
Thread.Sleep(500);
// If job is in waiting state, every 3 min show the user retry message.
// (waitIndex == 360) Specifes 3 min.
if (currentJob.Status == JobStatus.Waiting && waitIndex == 360)
waitIndex = 0;
JobStatusEventArgs jobStatusArg = new JobStatusEventArgs(this.currentJob.Name, this.currentJob.Status, TridentResourceManager.GetString("JobTerminatedByUserMessage"));
this.dispatcher.BeginInvoke(new EventHandler<JobStatusEventArgs>(RaiseUpdateStatus), DispatcherPriority.Normal, new object[] { this, jobStatusArg });
catch (Exception ex)
TridentErrorHandler.HandleUIException(ex);
waitIndex++;
public void StartDataProductService(Guid jobId, Connection poolConnection)
this.currentJobId = jobId;
this.poolingConnection = poolConnection;
this.ClearTempData();
this.HaltService();
this.PoolJobThread = new Thread(this.PoolJobExecutionStatus);
this.PoolJobThread.Start();
Hope this helps
Regards,
Rahul -
Mmc is getting crashed with error Faulting module name: KERNELBASE.dll on windows server 2012 r2
I am facing issue with BizTalk admin console, getting below error,
i thought it will be due to sql server or WMI so restarted sql services as well WMIS services but no luck. restarted Distributed transaction services as well as restarted machine but it did not solve.
also when i tried with other MMC's i am getting below error in event viewer,
Faulting application name: mmc.exe, version: 6.3.9600.16384, time stamp: 0x52158765
Faulting module name: KERNELBASE.dll, version: 6.3.9600.17055, time stamp: 0x532943a3
Exception code: 0xe0434352
Fault offset: 0x00011d4d
Faulting process id: 0x215c
Faulting application start time: 0x01d004a6e0c31506
Faulting application path: C:\windows\SysWOW64\mmc.exe
Faulting module path: C:\windows\SYSTEM32\KERNELBASE.dll
Report Id: 3d994be7-709f-11e4-80ee-00505689506c
Faulting package full name:
Faulting package-relative application ID:
Application: mmc.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: System.Reflection.TargetInvocationException
Stack:
at Microsoft.ManagementConsole.Internal.SnapInMessagePumpProxy.OnThreadException(System.Object,
System.Threading.ThreadExceptionEventArgs)
at System.Windows.Forms.Application+ThreadContext.OnThreadException(System.Exception)
at System.Windows.Forms.Control.WndProcException(System.Exception)
at System.Windows.Forms.Control+ControlNativeWindow.OnThreadException(System.Exception)
at System.Windows.Forms.NativeWindow.Callback(IntPtr, Int32, IntPtr, IntPtr)
at System.Windows.Forms.UnsafeNativeMethods.IntDestroyWindow(System.Runtime.InteropServices.HandleRef)
at System.Windows.Forms.UnsafeNativeMethods.DestroyWindow(System.Runtime.InteropServices.HandleRef)
at System.Windows.Forms.NativeWindow.DestroyHandle()
at System.Windows.Forms.Control.DestroyHandle()
at System.Windows.Forms.Control.Dispose(Boolean)
at Microsoft.BizTalk.Administration.SnapIn.Forms.GroupHub.OperationsCtrl.Dispose(Boolean)
at System.ComponentModel.Component.Dispose()
at Microsoft.ManagementConsole.FormView.InternalShutdown()
at Microsoft.ManagementConsole.View.HandleShutdownRequest(Microsoft.ManagementConsole.Internal.IRequestStatus)
at Microsoft.ManagementConsole.View.ProcessRequest(Microsoft.ManagementConsole.Internal.Request)
at Microsoft.ManagementConsole.ViewMessageClient.ProcessRequest(Microsoft.ManagementConsole.Internal.Request)
at Microsoft.ManagementConsole.Internal.IMessageClient.ProcessRequest(Microsoft.ManagementConsole.Internal.Request)
at Microsoft.ManagementConsole.Executive.RequestStatus.BeginRequest(Microsoft.ManagementConsole.Internal.IMessageClient,
Microsoft.ManagementConsole.Internal.RequestInfo)
at Microsoft.ManagementConsole.Executive.SnapInRequestOperation.ProcessRequest()
at Microsoft.ManagementConsole.Executive.Operation.OnThreadTransfer(Microsoft.ManagementConsole.Executive.SimpleOperationCallback)
at System.RuntimeMethodHandle.InvokeMethod(System.Object, System.Object[], System.Signature,
Boolean)
at System.Reflection.RuntimeMethodInfo.UnsafeInvokeInternal(System.Object, System.Object[], System.Object[])
at System.Reflection.RuntimeMethodInfo.UnsafeInvoke(System.Object, System.Reflection.BindingFlags,
System.Reflection.Binder, System.Object[], System.Globalization.CultureInfo)
at System.Delegate.DynamicInvokeImpl(System.Object[])
at Microsoft.ManagementConsole.Executive.DelegateMessage.OnExecute()
at Microsoft.ManagementConsole.Executive.Message.Execute()
at Microsoft.ManagementConsole.Executive.SnapInThread.DispatchPendingSnapInMessages()
at Microsoft.ManagementConsole.Executive.SnapInThread.OnDataReadyAsync(System.Object, System.EventArgs)
at Microsoft.ManagementConsole.Executive.MmcThreadMessageWindow.WndProc(System.Windows.Forms.Message
ByRef)
at System.Windows.Forms.NativeWindow.Callback(IntPtr, Int32, IntPtr, IntPtr)
at System.Windows.Forms.UnsafeNativeMethods.DispatchMessageW(MSG ByRef)
at System.Windows.Forms.Application+ComponentManager.System.Windows.Forms.UnsafeNativeMethods.IMsoComponentManager.FPushMessageLoop(IntPtr,
Int32, Int32)
at System.Windows.Forms.Application+ThreadContext.RunMessageLoopInner(Int32, System.Windows.Forms.ApplicationContext)
at System.Windows.Forms.Application+ThreadContext.RunMessageLoop(Int32, System.Windows.Forms.ApplicationContext)
at System.Windows.Forms.Application.Run()
at Microsoft.ManagementConsole.Internal.SnapInMessagePumpProxy.Microsoft.ManagementConsole.Internal.ISnapInMessagePumpProxy.Run()
at Microsoft.ManagementConsole.Internal.ISnapInMessagePumpProxy.Run()
at Microsoft.ManagementConsole.Executive.SnapInThread.OnThreadStart()
at System.Threading.ThreadHelper.ThreadStart_Context(System.Object)
at System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback,
System.Object, Boolean)
at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback,
System.Object, Boolean)
at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback,
System.Object)
at System.Threading.ThreadHelper.ThreadStart()
does any one face similar issue if yes can you please help me to solve this?
Regards,
Amit
Regards, Amit MoreIf its only this MMC might try them over here.
https://social.msdn.microsoft.com/Forums/en-US/home?forum=biztalkgeneral
Regards, Dave Patrick ....
Microsoft Certified Professional
Microsoft MVP [Windows]
Disclaimer: This posting is provided "AS IS" with no warranties or guarantees , and confers no rights. -
Backup error due to System Writer missing (enumeration of system32 printer dlls takes too long)
Hi,
On a Windows 2008 R2 we get a Windows Backup error while backupping System State (event id: 5, error code: '2155347997').
We tried *ALL* solutions found on Internet regarding the same issue (and we also applied the suggested hotfix KB2807849) but without success. So we DIGGED INTO VSS to see what is happening.
***1) First we saw that an USB printer had a problem and this resulted in
hundreds of entries in the following registry keys:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\StillImage\DeviceNameStore\Canon MF6500 Series #100010]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\StillImage\DeviceNameStore\Canon MF6500 Series #100011]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\StillImage\DeviceNameStore\Canon MF6500 Series #100012]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\StillImage\DeviceNameStore\{6BDD1FC6-810F-11D0-BEC7-08002BE2092F}\79590]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\StillImage\DeviceNameStore\{6BDD1FC6-810F-11D0-BEC7-08002BE2092F}\79591]
***2) We completely removed ALL drivers/devices related to that printer (now the DeviceNameStore is empty and
pnputil -e returns no driver related to the printer)
***3) Using process monitor we saw that during vssadmin list writers the system is searching for the DLLs related to that printer AND SEEMS CAUGHT IN AN ENDLESS LOOP: this is an excerpt of the scan:
09:56:34,5205954 svchost.exe 324 RegSetValue HKLM\System\CurrentControlSet\services\VSS\Diag\System Writer\IDENTIFY (Enter) SUCCESS
09:57:18,2310377 svchost.exe 324 QueryDirectory C:\Windows\System32\spool\drivers\color\cnz005.icc NO SUCH FILE Filter: cnz005.icc
09:57:18,2312877 svchost.exe 324 QueryDirectory C:\Windows\System32\spool\drivers\color\cnf6500m.icc NO SUCH FILE Filter: cnf6500m.icc
09:57:18,2314854 svchost.exe 324 QueryDirectory C:\Windows\System32\cncmfp20.ini NO SUCH FILE Filter: cncmfp20.ini
09:57:18,2316416 svchost.exe 324 QueryDirectory C:\Windows\System32\cnclsi20.dll NO SUCH FILE Filter: cnclsi20.dll
... and so on
.... THE SAME FILES ARE REPEATED HUNDREDS OF TIMES!!!! ...
It seems that somewhere there is a catalog of system files which still contains the references to the (same) files used by the hundreds of devices that WERE present in the DeviceNameStore (see point ***1 above, but now it is empty), and the System
Writer continues to search/enumerate those files and fails.
How can I fix it ? Is there a way to "reset" the System Writer and "rebuild" (???) the correct files that it should backup? (in order to complete a successfull system state backup)
Can you help me?
Thank you in advance.
EDIT: some additional (useful?) information:
* we also ran chkdsk /f C:
* sfc /scannow completes without errors
* in the vssadmin list writers the "system writer" is missing (but - as said above - when we run it the associated process repeatedly search printer dll files in the System32 directory)
* perhaps those file are contained is some filemaps catalog ?!? Is there a way to "reset" them?!?
***EDIT 2***:
I found that the reference to those missing DLLs are in ***C:\Windows\inf\setupapi.ev3*** but if I move the file away the System Writer continues not being listed in vssadmin list writer (though the vssadmin command complete very fast).
This is what is happening:
svchost.exe 324 CloseFile C:\Windows\inf SUCCESS
svchost.exe 324 CloseFile C:\Windows\System32\DriverStore\infpub.dat SUCCESS
svchost.exe 324 CreateFile C:\Windows\System32\DriverStore\infpub.dat ACCESS DENIED
svchost.exe 324 CreateFile C:\Windows\System32\DriverStore\infstor.dat ACCESS DENIED
svchost.exe 324 CreateFile C:\Windows\System32\DriverStore\infstrng.dat ACCESS DENIED
svchost.exe 324 CreateFile C:\Windows\System32\DriverStore\drvindex.dat ACCESS DENIED
svchost.exe 324 CreateFile C:\Windows\System32\DriverStore\INFCACHE.0 NAME NOT FOUND
svchost.exe 324 CreateFile C:\Windows\System32\DriverStore\INFCACHE.1 ACCESS DENIED
svchost.exe 324 CreateFile C:\Windows\System32\DriverStore\INFCACHE.2 NAME NOT FOUND
svchost.exe 324 CreateFile C:\Windows\inf SUCCESS
svchost.exe 324 QueryBasicInformationFile C:\Windows\inf SUCCESS
svchost.exe 324 RegCloseKey HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup SUCCESS
svchost.exe 324 CreateFile C:\Windows\inf\setupapi.ev1 SUCCESS
svchost.exe 324 QueryStandardInformationFile C:\Windows\inf\setupapi.ev1 SUCCESS
svchost.exe 324 CreateFileMapping C:\Windows\inf\setupapi.ev1
svchost.exe 324 QueryStandardInformationFile C:\Windows\inf\setupapi.ev1 SUCCESS
svchost.exe 324 CreateFileMapping C:\Windows\inf\setupapi.ev1
svchost.exe 324 CreateFile C:\Windows\inf\setupapi.ev2 SUCCESS
svchost.exe 324 QueryStandardInformationFile C:\Windows\inf\setupapi.ev2
svchost.exe 324 CreateFileMapping C:\Windows\inf\setupapi.ev2
svchost.exe 324 QueryStandardInformationFile C:\Windows\inf\setupapi.ev2 SUCCESS
svchost.exe 324 CreateFileMapping C:\Windows\inf\setupapi.ev2
svchost.exe 324 CreateFile C:\Windows\inf\setupapi.ev3 SUCCESS
svchost.exe 324 QueryStandardInformationFile C:\Windows\inf\setupapi.ev3
svchost.exe 324 CreateFileMapping C:\Windows\inf\setupapi.ev3
svchost.exe 324 QueryStandardInformationFile C:\Windows\inf\setupapi.ev3
svchost.exe 324 CreateFileMapping C:\Windows\inf\setupapi.ev3 SUCCESS
svchost.exe 324 CreateFile C:\Windows\System32\drivers SUCCESS
svchost.exe 324 QueryDirectory C:\Windows\System32\drivers\acpi.sys SUCCESS
svchost.exe 324 QueryDirectory C:\Windows\System32\drivers\rdpbus.sys SUCCESS
svchost.exe 324 QueryDirectory C:\Windows\System32\drivers\i8042prt.sys SUCCESS
.... EVERYTHING IS OK UP TO HERE ...
svchost.exe 324 CloseFile C:\Windows\System32\drivers SUCCESS
svchost.exe 324 CreateFile C:\Windows\System32 SUCCESS
svchost.exe 324 QueryDirectory C:\Windows\System32\cncc6500.dll NO SUCH FILE Filter: cncc6500.dll
svchost.exe 324 QueryDirectory C:\Windows\System32\cnci6500.dll NO SUCH FILE Filter: cnci6500.dll
svchost.exe 324 QueryDirectory C:\Windows\System32\cncc6500.dll NO SUCH FILE Filter: cncc6500.dll
svchost.exe 324 QueryDirectory C:\Windows\System32\cnci6500.dll NO SUCH FILE Filter: cnci6500.dll
... !!!!!GET CAUGHT IN AN ENDLESS LOOP!!!!!!!! (System Writer probably ends for timeout)...
Is there a way to rebuild/modify that file C:\Windows\inf\setupapi.ev3
Perhaps I can delete the catroot2 directory?Hi,
Please check if there are number of files in Temporary ASP.NET folders under "C:\Windows\Microsoft.Net\Framework". If so, clear these files then restart the server to check the results.
In additional, you could try the steps below to troubleshoot the issue:
1. Give NETWORK SERVICE Read permissions on COM+ Event System.
a. Open the registry editor and navigate to HKLM\CurrentControlSet\Services\EventSystem.
b. Right click on the EventSystem and then select ‘Permissions’
c. Click on ‘ADD’ button and then type in ‘NETWORK SERVICE’ and give it READ permission.
d. Reboot the machine and then run the 'VSS admin list writers' to check if it shows up the 'system writer'.
2. If the step 1 doesn't work then move the contents of C:\Windows\winsxs\FileMaps to an alternate location. Then run the command 'VSS admin list writers' to check if it shows up the 'system writer'. Is so, some of those files maybe corrupted and we
need to identify them and replace the files from a healthy machine.
Regards,
Mandy
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place. -
Hello Guys,
While running a web application am getting an error like: Remote server not responding. Below are the details of event viewers which been captured at the same time when this error happened:
Event 1000, Application Error
Faulting application name: w3wp.exe, version: 7.5.7600.16385, time stamp: 0x4a5bd0eb
Faulting module name: KERNELBASE.dll, version: 6.1.7600.16850, time stamp: 0x4e211da1
Exception code: 0xe053534f
Fault offset: 0x000000000000a88d
Faulting process id: 0x%9
Faulting application start time: 0x%10
Faulting application path: %11
Faulting module path: %12
Report Id: %13
Event 1001, Windows Error Reporting
Fault bucket , type 0
Event Name: APPCRASH
Response: Not available
Cab Id: 0
Problem signature:
P1: w3wp.exe
P2: 7.5.7600.16385
P3: 4a5bd0eb
P4: KERNELBASE.dll
P5: 6.1.7600.16850
P6: 4e211da1
P7: e053534f
P8: 000000000000a88d
P9:
P10:
Attached files:
C:\Windows\Temp\WERC9CD.tmp.WERInternalMetadata.xml
C:\Windows\Temp\WERC9CE.tmp.hdmp
C:\Windows\Temp\WEREE30.tmp.mdmp
These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_w3wp.exe_30877924d6b2c607fe88a8718915f25fb79093_cab_e905f2b0
Analysis symbol:
Rechecking for solution: 0
Report Id: d46a6849-8f6a-11e1-98af-00215e6e4855
Report Status: 4
This is an priority issue which we are facing in IIS. IIS is configured for Framework 2.0 and underlying OS is - Windows
Server 2008 R2 Standard.This issue is replicable and occurring frequently Please suggest how to resolve it. Any input related to above issue is appreciable.Please refer similar discussions and see if they help
Faulting application name: w3wp.exe
http://telligent.com/support/communityserver/community_server_2008/f/288/t/1067447.aspx
Event ID: 1000, Faulting application w3wp.exe, faulting module unknown,
http://social.msdn.microsoft.com/forums/en-US/clr/thread/9be88a2f-c8cc-4a73-9371-45ab73982123
For IIS related queries, please post them in IIS forum - http://forums.iis.net/
A UNIVERSE without WINDOWS is CHAOS !
This posting is provided "AS IS" with no warranties or guarantees and confers no rights.
About Me !!! -
my reinstallation of itunes is failed, error code is error 7 (windows error 126) the system find not msvcr80.dll script
https://discussions.apple.com/thread/5817040?tstart=0
....try everything in that thread, should fix the issue. -
Event 1000,Application Error Faulting module name: KERNELBASE.dll
I develop one tool using C#.But it will stop working intermittently.The failure information is as below.I don't know what's wrong with it.
Faulting application name: TVSUAuto.exe, version: 1.0.5294.41796, time stamp: 0x53b25f89
Faulting module name: KERNELBASE.dll, version: 6.3.9600.16384, time stamp: 0x5215fa76
Exception code: 0xe0434352
Fault offset: 0x0000000000008384
Faulting process id: 0x8d4
Faulting application start time: 0x01cf96029eff97c7
Faulting application path: C:\TVSUAuto.exe
Faulting module path: C:\Windows\system32\KERNELBASE.dll
Report Id: 0503be2e-01f7-11e4-825d-5c514f0bf2b5Hi，
That exception code indicates a .NET exception has been thrown and was not handled. You probably want to add some exception handling and logging code to your application so you get an idea about what happens. Otherwise you'll need to post your codes to oneDrive
so that we can test it.
Best Wishes!
We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time. Thanks for helping make community forums a great place. <br/> Click <a
href="http://support.microsoft.com/common/survey.aspx?showpage=1&scid=sw%3Ben%3B3559&theme=tech"> HERE</a> to participate the survey. -
Faulting application name: w3wp.exe - and Faulting module path: C:\Windows\system32\KERNELBASE.dll
The environment is aSharepoint2010 and ProjectServer2010we hadlast nighta crach ofapplication poolwithan error on thew3wpandkernelbase.
We canrevivetheappbutthe firstaccess to the sitewe have thew3wpcrash.
we did adumpand here are thedetails.
Information 12/08/2014 15:28:45 Windows Error Reporting 1001 None
Fault bucket , type 0
Event Name: APPCRASH
Response: Not available
Cab Id: 0
Problem signature:
P1: w3wp.exe
P2: 7.5.7601.17514
P3: 4ce7afa2
P4: KERNELBASE.dll
P5: 6.1.7601.18409
P6: 5315a05a
P7: c06d007e
P8: 000000000000940d
P9:
P10:
Attached files:
These files may be available here:
Analysis symbol:
Rechecking for solution: 0
Report Id: 9561bd5d-2224-11e4-9566-0050569a0110
Report Status: 0
Error 12/08/2014 15:28:46 Application Error 1000 (100)
Faulting application name: w3wp.exe, version: 7.5.7601.17514, time stamp:
0x4ce7afa2
Faulting module name: KERNELBASE.dll, version: 6.1.7601.18409, time stamp: 0x5315a05a
Exception code: 0xc06d007e
Fault offset: 0x000000000000940d
Faulting process id: 0x15d0
Faulting application start time: 0x01cfb6315831ebbb
Faulting application path: c:\windows\system32\inetsrv\w3wp.exe
Faulting module path: C:\Windows\system32\KERNELBASE.dll
Report Id: 95eaafc7-2224-11e4-9566-0050569a0110
Warning 12/08/2014 15:28:51 WAS 5011 None
A process serving application pool 'SharePoint Central Administration v4'
suffered a fatal communication error with the Windows Process Activation
Service. The process id was '2448'. The data field contains the error number
Error 12/08/2014 15:28:51 WAS 5002 None
Application pool 'SharePoint Central Administration v4' is being automatically
disabled due to a series of failures in the process(es) serving that
application pool.
Le dump du crach donne les informations suivantes
(990.fb4): Unknown exception - code c06d007e (first/second chance not
available)
KERNELBASE!RaiseException+0x39:
000007fe`fda5940d 4881c4c8000000 add rsp,0C8h
0:004> .loadby sos clr
Unable to find module 'clr'
0:004> .loadby sos clr
Unable to find module 'clr'
0:004> !analyze -v
* Exception Analysis *
GetPageUrlData failed, server returned HTTP status 404
URL requested:
http://watson.microsoft.com/StageOne/w3wp_exe/7_5_7601_17514/4ce7afa2/KERNELBASE_dll/6_1_7601_18409/5315a05a/c06d007e/0000940d.htm?Retriage=1
FAULTING_IP:
KERNELBASE!RaiseException+39
000007fe`fda5940d 4881c4c8000000 add rsp,0C8h
EXCEPTION_RECORD: ffffffffffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 000007fefda5940d (KERNELBASE!RaiseException+0x0000000000000039)
ExceptionCode: c06d007e
ExceptionFlags: 00000000
NumberParameters: 1
Parameter[0]: 000000000092e820
DEFAULT_BUCKET_ID: APPLICATION_FAULT
PROCESS_NAME: w3wp.exe
ERROR_CODE: (NTSTATUS) 0xc06d007e -
<unable code="" error="" get="" text="" to="">
EXCEPTION_CODE: (NTSTATUS) 0xc06d007e -
<unable code="" error="" get="" text="" to="">
EXCEPTION_PARAMETER1: 000000000092e820
MOD_LIST:
<analysis>
NTGLOBALFLAG: 0
APPLICATION_VERIFIER_FLAGS: 0
MANAGED_STACK: !dumpstack -EE
OS Thread Id: 0xfb4 (4)
Child-SP RetAddr Call Site
FAULTING_THREAD: 0000000000000fb4
PRIMARY_PROBLEM_CLASS: APPLICATION_FAULT
BUGCHECK_STR: APPLICATION_FAULT_APPLICATION_FAULT
LAST_CONTROL_TRANSFER: from 000007fee99ed41d to 000007fefda5940d
STACK_TEXT:
00000000`0092e730 000007fe`e99ed41d : 00000000`00000000 00000000`00000000
00000000`00000391 000007fe`e9b40cd0 : KERNELBASE!RaiseException+0x39
00000000`0092e800 000007fe`e996d57f : 000007fe`e9c78e70 00000000`0092e820
00000000`00000000 00000000`00000000 : OWSSVR!DllCanUnloadNow+0x8cfad
00000000`0092e8b0 000007fe`e96c5244 : 00000000`0000000d 00000000`010dd4f0
0000000f`001d000b 00000010`001a000c : OWSSVR!DllCanUnloadNow+0xd10f
00000000`0092e920 000007fe`e96c5313 : 00000000`00000000 00000000`00328ad0
00000000`778d4564 000007fe`e9c78e28 : OWSSVR!TerminateExtension+0x158
00000000`0092eaa0 000007fe`e96c5379 : 00000000`0128fcd0 00000000`000000a4
00000000`00000024 000007fe`faf11827 : OWSSVR!TerminateExtension+0x227
00000000`0092ebf0 000007fe`e96c18d8 : 00000000`00000000 00000000`00000000
00000000`01290840 00000000`00000021 : OWSSVR!TerminateExtension+0x28d
00000000`0092ec20 000007fe`cf5cf94a : 00000000`00000000 00000000`01290840
00000000`01290840 00000000`0128f800 : OWSSVR!RegisterModule+0x1c
00000000`0092ec50 000007fe`cf5d9aa4 : 00000000`00000000 00000000`00000000
00000000`00000000 00000000`00000000 : iiscore!VIRTUAL_MODULE::RegisterModule+0x2a
00000000`0092ec80 000007fe`cf5daeeb : 00000000`00000078 000007fe`cf5ba944
00000000`0128f800 000007fe`cf5e87b8 :
iiscore!W3_SERVER::LoadModulesFromConfig+0x394
00000000`0092eda0 000007fe`cf5dc2ff : 00000000`0128f800 000007fe`cf5e87b8
00000000`00000000 00000000`0121fb10 :
iiscore!W3_SERVER::InitializeGlobalModules+0x3b
00000000`0092ede0 000007fe`cf5e234d : 00000000`0128f800 00000000`00000002
00000000`0121fb10 00000000`0000017c : iiscore!W3_SERVER::Initialize+0xaaf
00000000`0092f040 000007fe`cf5e2405 : 00000000`0128f6b0 00000000`00000000
00000000`00000000 00000000`0000000c :
iiscore!IISCORE_PROTOCOL_MANAGER::InitializeGlobals+0x1fd
00000000`0092f2e0 000007fe`e27a9316 : 00000000`00000000 00000000`00000000
00000000`005fa7e0 00000000`00000000 :
iiscore!IISCORE_PROTOCOL_MANAGER::PreloadApplication+0x45
00000000`0092f320 000007fe`e27a7dd2 : 00000000`005ff4b0 00000000`77997ef5
00000000`0128f6b0 00000000`0021f070 :
w3wphost!WP_IPM::HandlePreloadApplications+0xc2
00000000`0092f370 000007fe`faf141f3 : 00000000`005ff508 00000000`00000000
00000000`00000000 00000000`00000000 : w3wphost!WP_IPM::AcceptMessage+0x16e
00000000`0092f3b0 00000000`77bbc251 : 00000000`00000000 00000000`003b3bf0
00000000`00000000 00000000`0000000c : iisutil!IPM_MESSAGE_PIPE::MessagePipeCompletion+0x44f
00000000`0092f430 00000000`77bc658c : 00000000`003b3b40 00000000`003693f0
00000000`0092f5e8 00000000`00000000 : ntdll!RtlpTpWaitCallback+0x92
00000000`0092f480 00000000`77bd0c56 : 00000000`0035d110 00000000`77cb45e8 00000000`00000000
00000000`77cb4610 : ntdll!TppWaitpExecuteCallback+0x10c
00000000`0092f4e0 00000000`779a59ed : 00000000`00000000 00000000`00000000
00000000`00000000 00000000`00000000 : ntdll!TppWorkerThread+0x5ff
00000000`0092f7e0 00000000`77bdc541 : 00000000`00000000 00000000`00000000
00000000`00000000 00000000`00000000 : kernel32!BaseThreadInitThunk+0xd
00000000`0092f810 00000000`00000000 : 00000000`00000000 00000000`00000000
00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x1d
STACK_COMMAND: ~4s; .ecxr ; kb
FOLLOWUP_IP:
OWSSVR!DllCanUnloadNow+8cfad
000007fe`e99ed41d 488b442458 mov rax,qword ptr [rsp+58h]
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: owssvr!DllCanUnloadNow+8cfad
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: OWSSVR
IMAGE_NAME: OWSSVR.DLL
DEBUG_FLR_IMAGE_TIMESTAMP: 51c91cf5
FAILURE_BUCKET_ID: APPLICATION_FAULT_c06d007e_OWSSVR.DLL!DllCanUnloadNow
BUCKET_ID: X64_APPLICATION_FAULT_APPLICATION_FAULT_owssvr!DllCanUnloadNow+8cfad
WATSON_STAGEONE_URL:
http://watson.microsoft.com/StageOne/w3wp_exe/7_5_7601_17514/4ce7afa2/KERNELBASE_dll/6_1_7601_18409/5315a05a/c06d007e/0000940d.htm?Retriage=1
Followup: MachineOwner </analysis></unable></unable>Hello Roland_Zeki,
Can you check System in the Windows Log of Event Viewer? Maybe you have some logon failure for one of the services, like in this blog:
http://www.shareesblog.com/?p=363
- Dennis | Netherlands | Blog |
Twitter
Yes I have verify this point I suspected to be the origine of the problem. But no, the accounts have fixed password and are not locked. I test this point with a valide login on the server, and I reenter the login password for each app pool. -
Resource Hosting Subsystem process crashes from KERNELBASE.dll
Hi,
I have 2 2013 Exchange servers in a DAG configuration. The passive member (I'll refer to it as EX02) is experiencing an issue where the Cluster Service crashes almost immediately after it is started. I've experienced this with this particular DAG before
and ultimately ended up rebuilding the entire DAG from scratch to fix the issue, however it seems to have returned and now need a root cause analysis and fix. I've attached 4 Event Logs that have allowed me to drill down to the problem component but am at
a loss on how to proceed next. Initially, when checking the cluster using Failover Cluster Manager, the EX02 node goes back and forth between "Joining" and "Down". This is a result of the Cluster Service constantly crashing and restarting
since it is set to auto restart after an unexpected termination.
Looking at the 1146 Event ID, I saw this points to the Resource Hosting Subsystem as part of the issue and that this process experienced an issue with a .dll it's using. I then discovered this was the KERNELBASE.dll via the various other log entries
I've included below. I haven't been able to find anyone else that's ran into this particular scenario and am not sure what needs to be done to correct this behavior. If anyone has any insight to this issue, it would be greatly appreciated. If any additional
information is needed from me, please let me know as well.
Log Name: System
Source: Microsoft-Windows-FailoverClustering
Date: 3/3/2015 2:34:59 PM
Event ID: 1146
Task Category: Resource Control Manager
Level: Critical
Keywords:
User: SYSTEM
Computer: ****-EX02.****.com
Description:
The cluster Resource Hosting Subsystem (RHS) process was terminated and will be restarted. This is typically associated with cluster health detection and recovery of a resource. Refer to the System event log to determine which resource and resource DLL is causing the issue.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-FailoverClustering" Guid="{BAF908EA-3421-4CA9-9B84-6689B8C6F85F}" />
<EventID>1146</EventID>
<Version>0</Version>
<Level>1</Level>
<Task>3</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2015-03-03T20:34:59.261068900Z" />
<EventRecordID>286364</EventRecordID>
<Correlation />
<Execution ProcessID="4716" ThreadID="4996" />
<Channel>System</Channel>
<Computer>****-EX02.****.com</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="NodeName">****-EX02</Data>
</EventData>
</Event>
Log Name: Application
Source: Application Error
Date: 3/3/2015 2:36:13 PM
Event ID: 1000
Task Category: (100)
Level: Error
Keywords: Classic
User: N/A
Computer: ****-EX02.****.com
Description:
Faulting application name: clussvc.exe, version: 6.3.9600.17396, time stamp: 0x5434db7b
Faulting module name: KERNELBASE.dll, version: 6.3.9600.17415, time stamp: 0x54505737
Exception code: 0x80000003
Fault offset: 0x00000000000de002
Faulting process id: 0x31c8
Faulting application start time: 0x01d055f1a860f6f2
Faulting application path: C:\Windows\Cluster\clussvc.exe
Faulting module path: C:\Windows\system32\KERNELBASE.dll
Report Id: ee64313c-c1e4-11e4-80da-005056010d14
Faulting package full name:
Faulting package-relative application ID:
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Application Error" />
<EventID Qualifiers="0">1000</EventID>
<Level>2</Level>
<Task>100</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2015-03-03T20:36:13.000000000Z" />
<EventRecordID>264219</EventRecordID>
<Channel>Application</Channel>
<Computer>****-EX02.****.com</Computer>
<Security />
</System>
<EventData>
<Data>clussvc.exe</Data>
<Data>6.3.9600.17396</Data>
<Data>5434db7b</Data>
<Data>KERNELBASE.dll</Data>
<Data>6.3.9600.17415</Data>
<Data>54505737</Data>
<Data>80000003</Data>
<Data>00000000000de002</Data>
<Data>31c8</Data>
<Data>01d055f1a860f6f2</Data>
<Data>C:\Windows\Cluster\clussvc.exe</Data>
<Data>C:\Windows\system32\KERNELBASE.dll</Data>
<Data>ee64313c-c1e4-11e4-80da-005056010d14</Data>
<Data>
</Data>
<Data>
</Data>
</EventData>
</Event>
Log Name: Application
Source: Windows Error Reporting
Date: 3/3/2015 2:36:14 PM
Event ID: 1001
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: ****-EX02.****.com
Description:
Fault bucket , type 0
Event Name: APPCRASH
Response: Not available
Cab Id: 0
Problem signature:
P1: clussvc.exe
P2: 6.3.9600.17396
P3: 5434db7b
P4: KERNELBASE.dll
P5: 6.3.9600.17415
P6: 54505737
P7: 80000003
P8: 00000000000de002
P9:
P10:
Attached files:
These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_clussvc.exe_fcdf2bbcddca922c916880dbb49ce3cd5175efef_f6feed2e_3a22d925
Analysis symbol:
Rechecking for solution: 0
Report Id: ee64313c-c1e4-11e4-80da-005056010d14
Report Status: 4100
Hashed bucket:
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Windows Error Reporting" />
<EventID Qualifiers="0">1001</EventID>
<Level>4</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2015-03-03T20:36:14.000000000Z" />
<EventRecordID>264220</EventRecordID>
<Channel>Application</Channel>
<Computer>****-EX02.****.com</Computer>
<Security />
</System>
<EventData>
<Data>
</Data>
<Data>0</Data>
<Data>APPCRASH</Data>
<Data>Not available</Data>
<Data>0</Data>
<Data>clussvc.exe</Data>
<Data>6.3.9600.17396</Data>
<Data>5434db7b</Data>
<Data>KERNELBASE.dll</Data>
<Data>6.3.9600.17415</Data>
<Data>54505737</Data>
<Data>80000003</Data>
<Data>00000000000de002</Data>
<Data>
</Data>
<Data>
</Data>
<Data>
</Data>
<Data>C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_clussvc.exe_fcdf2bbcddca922c916880dbb49ce3cd5175efef_f6feed2e_3a22d925</Data>
<Data>
</Data>
<Data>0</Data>
<Data>ee64313c-c1e4-11e4-80da-005056010d14</Data>
<Data>4100</Data>
<Data>
</Data>
</EventData>
</Event>
Version=1
EventType=APPCRASH
EventTime=130698881964369580
ReportType=2
Consent=1
ReportIdentifier=0d8e824c-c1e4-11e4-80da-005056010d14
IntegratorReportIdentifier=0d8e824b-c1e4-11e4-80da-005056010d14
NsAppName=clussvc.exe
Response.type=4
Sig[0].Name=Application Name
Sig[0].Value=clussvc.exe
Sig[1].Name=Application Version
Sig[1].Value=6.3.9600.17396
Sig[2].Name=Application Timestamp
Sig[2].Value=5434db7b
Sig[3].Name=Fault Module Name
Sig[3].Value=KERNELBASE.dll
Sig[4].Name=Fault Module Version
Sig[4].Value=6.3.9600.17415
Sig[5].Name=Fault Module Timestamp
Sig[5].Value=54505737
Sig[6].Name=Exception Code
Sig[6].Value=80000003
Sig[7].Name=Exception Offset
Sig[7].Value=00000000000de002
DynamicSig[1].Name=OS Version
DynamicSig[1].Value=6.3.9600.2.0.0.272.7
DynamicSig[2].Name=Locale ID
DynamicSig[2].Value=1033
DynamicSig[22].Name=Additional Information 1
DynamicSig[22].Value=a80b
DynamicSig[23].Name=Additional Information 2
DynamicSig[23].Value=a80b5d7481362c8eeb76a77903fa82d6
DynamicSig[24].Name=Additional Information 3
DynamicSig[24].Value=a1f8
DynamicSig[25].Name=Additional Information 4
DynamicSig[25].Value=a1f83374660c205ca4489043b9691b2f
UI[2]=C:\Windows\Cluster\clussvc.exe
UI[5]=Check online for a solution (recommended)
UI[6]=Check for a solution later (recommended)
UI[7]=Close
UI[8]=Microsoft Failover Cluster Service stopped working and was closed
UI[9]=A problem caused the application to stop working correctly. Windows will notify you if a solution is available.
UI[10]=&Close
LoadedModule[0]=C:\Windows\Cluster\clussvc.exe
LoadedModule[1]=C:\Windows\SYSTEM32\ntdll.dll
LoadedModule[2]=C:\Windows\system32\KERNEL32.DLL
LoadedModule[3]=C:\Windows\system32\KERNELBASE.dll
LoadedModule[4]=C:\Windows\system32\msvcrt.dll
LoadedModule[5]=C:\Windows\SYSTEM32\sechost.dll
LoadedModule[6]=C:\Windows\system32\ADVAPI32.dll
LoadedModule[7]=C:\Windows\SYSTEM32\CLUSAPI.dll
LoadedModule[8]=C:\Windows\system32\CRYPT32.dll
LoadedModule[9]=C:\Windows\SYSTEM32\dhcpcsvc.DLL
LoadedModule[10]=C:\Windows\SYSTEM32\IPHLPAPI.DLL
LoadedModule[11]=C:\Windows\SYSTEM32\NTDSAPI.dll
LoadedModule[12]=C:\Windows\system32\ole32.dll
LoadedModule[13]=C:\Windows\system32\OLEAUT32.dll
LoadedModule[14]=C:\Windows\SYSTEM32\RESUTILS.dll
LoadedModule[15]=C:\Windows\system32\RPCRT4.dll
LoadedModule[16]=C:\Windows\SYSTEM32\SspiCli.dll
LoadedModule[17]=C:\Windows\SYSTEM32\sscore.dll
LoadedModule[18]=C:\Windows\system32\USER32.dll
LoadedModule[19]=C:\Windows\SYSTEM32\VSSAPI.DLL
LoadedModule[20]=C:\Windows\SYSTEM32\wevtapi.dll
LoadedModule[21]=C:\Windows\system32\WS2_32.dll
LoadedModule[22]=C:\Windows\system32\NSI.dll
LoadedModule[23]=C:\Windows\SYSTEM32\WINNSI.DLL
LoadedModule[24]=C:\Windows\SYSTEM32\FirewallAPI.dll
LoadedModule[25]=C:\Windows\SYSTEM32\bcrypt.dll
LoadedModule[26]=C:\Windows\SYSTEM32\NETAPI32.dll
LoadedModule[27]=C:\Windows\SYSTEM32\FLTLIB.DLL
LoadedModule[28]=C:\Windows\system32\SETUPAPI.dll
LoadedModule[29]=C:\Windows\SYSTEM32\DEVOBJ.dll
LoadedModule[30]=C:\Windows\SYSTEM32\fwpuclnt.dll
LoadedModule[31]=C:\Windows\SYSTEM32\VirtDisk.dll
LoadedModule[32]=C:\Windows\SYSTEM32\clfsw32.dll
LoadedModule[33]=C:\Windows\SYSTEM32\DSPARSE.dll
LoadedModule[34]=C:\Windows\SYSTEM32\cryptdll.dll
LoadedModule[35]=C:\Windows\system32\MSASN1.dll
LoadedModule[36]=C:\Windows\SYSTEM32\combase.dll
LoadedModule[37]=C:\Windows\system32\GDI32.dll
LoadedModule[38]=C:\Windows\SYSTEM32\VssTrace.DLL
LoadedModule[39]=C:\Windows\SYSTEM32\DSROLE.dll
LoadedModule[40]=C:\Windows\SYSTEM32\bcd.dll
LoadedModule[41]=C:\Windows\SYSTEM32\netutils.dll
LoadedModule[42]=C:\Windows\SYSTEM32\srvcli.dll
LoadedModule[43]=C:\Windows\SYSTEM32\wkscli.dll
LoadedModule[44]=C:\Windows\system32\CFGMGR32.dll
LoadedModule[45]=C:\Windows\SYSTEM32\DPAPI.DLL
LoadedModule[46]=C:\Windows\SYSTEM32\CRYPTBASE.dll
LoadedModule[47]=C:\Windows\SYSTEM32\SAMCLI.DLL
LoadedModule[48]=C:\Windows\SYSTEM32\bcryptPrimitives.dll
LoadedModule[49]=C:\Windows\SYSTEM32\sscoreext.dll
LoadedModule[50]=C:\Windows\SYSTEM32\mi.dll
LoadedModule[51]=C:\Windows\SYSTEM32\miutils.dll
LoadedModule[52]=C:\Windows\system32\wmidcom.dll
LoadedModule[53]=C:\Windows\SYSTEM32\kernel.appcore.dll
LoadedModule[54]=C:\Windows\SYSTEM32\ntmarta.dll
LoadedModule[55]=C:\Windows\SYSTEM32\dhcpcsvc6.DLL
LoadedModule[56]=C:\Windows\SYSTEM32\clbcatq.dll
LoadedModule[57]=C:\Windows\system32\wbem\wbemprox.dll
LoadedModule[58]=C:\Windows\SYSTEM32\wbemcomn.dll
LoadedModule[59]=C:\Windows\SYSTEM32\CRYPTSP.dll
LoadedModule[60]=C:\Windows\system32\rsaenh.dll
LoadedModule[61]=C:\Windows\system32\wbem\wbemsvc.dll
LoadedModule[62]=C:\Windows\system32\wbem\fastprox.dll
LoadedModule[63]=C:\Windows\SYSTEM32\pcwum.dll
LoadedModule[64]=C:\Windows\system32\mswsock.dll
LoadedModule[65]=C:\Windows\system32\WINTRUST.dll
LoadedModule[66]=C:\Windows\SYSTEM32\logoncli.dll
LoadedModule[67]=C:\Windows\SYSTEM32\DNSAPI.dll
LoadedModule[68]=C:\Windows\System32\rasadhlp.dll
LoadedModule[69]=C:\Windows\system32\kerberos.DLL
LoadedModule[70]=C:\Windows\SYSTEM32\SAMLIB.dll
LoadedModule[71]=C:\Windows\system32\es.dll
LoadedModule[72]=C:\Windows\system32\PROPSYS.dll
LoadedModule[73]=C:\Windows\SYSTEM32\profapi.dll
FriendlyEventName=Stopped working
ConsentKey=APPCRASH
AppName=Microsoft Failover Cluster Service
AppPath=C:\Windows\Cluster\clussvc.exe
NsPartner=windows
NsGroup=windows8
ApplicationIdentity=78F1110F74732BD871C9A3C553A667E4Got a window to reboot the EX02 machine and this seems to have solved the issue. Cluster Service is stable again and DAG is healthy. This issue can be marked as answered.
I have this same issue, and it appears to manifest whenever there is a network disruption. After network is restored, the cluster service repeatedly crashes until a reboot. I'm not sure if a reboot is a real fix. I'm curious whether
yours returns if you unplug the network cable and plug it back in on your server, like mine.
Maybe you are looking for
-
How can I print only in black on my HP 6700 from my I Phone 5?
How can I print only in black on my HP 6700 from my I Phone 5?
-
Got email saying my subscription has expired?
Just paid my membership, got an email stating it had been paid for, and then got an email today saying it's expired? Don't know what's going on. Please help.
-
Iphone 4s update to ios 6.0.1 wifi issue
I updated my iphone 4s to the latest firmware 6.0.1 and now my phone can't find any wifi connections at all in any place. Not even at home. It doesn't pick up any wifi signal.
-
My I-phone 4S will not turn on after failed attempt to Restore
Dear Anyone who could possibly help me, Today I opened up my I-tunes and plugged in my I-phone; I selected the "Restore I-phone" option because I wanted to restore my I-phone back to its original state as when I first recieved it. I selected "Restore
-
Web Dispacher, deactivate a particular node how to?
Hi, Is there any property that can be set in the Web dispatcher profile or the message server, which can stop sending any request to a particular J2ee instance in the cluster? The business requirement is that one server (node) in the cluster should