KS-Soft. Network Management Solutions
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister    ProfileProfile    Log inLog in 

EventID 1000, 1001 & 10 WMI Crashing

 
Post new topic   Reply to topic    KS-Soft Forum Index -> Configuration, Maintenance, Troubleshooting
View previous topic :: View next topic  
Author Message
xcentric



Joined: 23 Oct 2010
Posts: 176
PostPosted: Thu Jul 21, 2011 10:06 am    Post subject: EventID 1000, 1001 & 10 WMI Crashing Reply with quote
First, I do not believe this has anything to do with HM. I do believe this is a good place to look for answers.

Environment:
Server 2008 R2 SP1

The problem:
WMI crashes every 2 minutes when I enable a specific WMI test. The test is being executed by the local HostMonitor agent. If the test is disabled the events disappear. This happens on the hm server. This does not happen on any server running the agent.

The test:
WMI Query: select AvailableMBytes from Win32_PerfFormattedData_PerfOS_Memory
Frequency: Every 1 minute

EventID 1000:
Code:
Faulting application name: wmiprvse.exe, version: 6.1.7601.17514, time stamp: 0x4ce79267
Faulting module name: ntdll.dll, version: 6.1.7601.17514, time stamp: 0x4ce7ba58
Exception code: 0xc0000374
Fault offset: 0x000ce653
Faulting process id: 0xd3c
Faulting application start time: 0x01cc47b395f386ad
Faulting application path: C:\Windows\sysWOW64\wbem\wmiprvse.exe
Faulting module path: C:\Windows\SysWOW64\ntdll.dll
Report Id: 1e8441e8-b3a7-11e0-bd23-20cf305e5fa9

EventID 10:
Code:
Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

EventID 1001:
Code:
Fault bucket , type 0
Event Name: APPCRASH
Response: Not available
Cab Id: 0

Problem signature:
P1: wmiprvse.exe
P2: 6.1.7601.17514
P3: 4ce79267
P4: StackHash_c155
P5: 6.1.7601.17514
P6: 4ce7ba58
P7: c0000374
P8: 000ce653
P9:
P10:

Attached files:

These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_wmiprvse.exe_867cdf95aec8a687c47181686da7107adbd1d096_0e4b093e

Analysis symbol:
Rechecking for solution: 0
Report Id: 1e8441e8-b3a7-11e0-bd23-20cf305e5fa9
Report Status: 0


I have googled around. Here are some of the things I have looked into.

Checked consistency of the WMI repository. Tested OK.
Checked permissions by running a WBEMtest. Tested OK.

Can anyone offer any additional information?

Regards
Back to top
View user's profile Send private message
KS-Soft



Joined: 03 Apr 2002
Posts: 12795
Location: USA
PostPosted: Thu Jul 21, 2011 11:39 am    Post subject: Reply with quote
I think Microsoft support forums much better discussion place in this case
E.g. this problem discussed here
http://social.technet.microsoft.com/Forums/en-US/windowsserver2008r2management/thread/15f38662-1a83-41fc-ad87-a0380f4c953b/

There are some fixes from Microsoft
http://support.microsoft.com/kb/2280777
http://support.microsoft.com/kb/981314
but as I understand some people still experience this problem after applying patches.

Some more info regarding memory leak
http://blogs.technet.com/b/kevinholman/archive/2010/06/09/wmi-leaks-memory-on-server-2008-r2-monitored-agents.aspx

Regards
Alex
Back to top
View user's profile Send private message Visit poster's website
xcentric



Joined: 23 Oct 2010
Posts: 176
PostPosted: Thu Jul 21, 2011 12:28 pm    Post subject: Reply with quote
Thats funny.

I have visited all those links. Even requested, received and tried to apply the patch with regard to the memory leak. However the patch claimed that the operating system was not supported. My guess is because this was pre service pack 1. Not ruling it out though.

My research thus far has returned nothing conclusive as most with this issue.

Because I think highly of your inteligence is why I posted here.
A call to MS support will result in an expense of $250. I'm sure I can either live with this (as the query succeeds regardless) or persist further for a solution.

Thanks anyway for at least confirming that I'm on the right path.

Regards.
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    KS-Soft Forum Index -> Configuration, Maintenance, Troubleshooting All times are GMT - 6 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum


Powered by phpBB © 2001, 2005 phpBB Group
KS-Soft Forum Index