Event viewer
in [Windows XP Basics]
|
From: Jose on 15 Feb 2010 12:01 On Feb 15, 11:07 am, "William B. Lurie" <billu...(a)nospam.net> wrote: > Jose wrote: > > On Feb 15, 9:24 am, "William B. Lurie" <billu...(a)nospam.net> wrote: > >> Jose wrote: > >>> On Feb 14, 7:03 am, "Gerry" <ge...(a)nospam.com> wrote: > >>>> Jose > >>>>>> Do you have success audits enabled? > >>>> Obviously the answer is Yes; otherwise there would not be any reports! > >>>> The computer has Windows XP Home Edition installed. I have never altered > >>>> the default with regard to Auditing Entries. I realise as a result of > >>>> Peter's response that I could and that the Security tabs can be > >>>> displayed if a default is changed.http://www.dougknox.com/xp/tips/xp_security_tab.htm > >>>> What is the point in investigating a Success Audit? An Audit Failure > >>>> makes more sense because it is reporting some wrong. Understanding a > >>>> Failure could pinpoint what is causing a problem. I have seen Failures > >>>> in the past but not recently. > >>> If I am not looking into a problem, I will turn all that stuff off. > >>> It is extra I/O I don't need and would rather my CPU time be spent > >>> doing things I want. I find no use for the constant logging of > >>> routine events. I don't look at my Event Log unless I am suspicious > >>> of a problem which is almost never - or trying to help someone else > >>> with their problem which is often. My event logs are no longer > >>> intellectually stimulating. > >>> If other folks want to log all that stuff, more power to 'em. I just > >>> chose not to! It is also possible that with my tinkering over the > >>> years my XP has been installed, I changed some of the Event Log > >>> settings so they may not match yours. Maybe we are not even talking > >>> about the same things anymore. > >>> Okay - I don't to get bogged down with it and would rather move on. > >>> The OP still does't seem to be able to hibernate reliably, his screen > >>> saver doesn't work, he does not have SP3, has not said the hotfix to > >>> fix hibernating for SP2 was installed, and has not described the SP3 > >>> anomalies. > >>> I think I'll just watch that for a while! > >> Jose, I'm willing to stop logging except while we're trouble-shooting. > >> I imagine I can find out how, but that's a side issue. The screen-saver > >> works *most* of the time, except when these events prevent it. > >> SP3 forced things on me that I didn't like and don't recall what > >> they were, and couldn't undo except by going back to SP2. One of them > >> I think had to do with automatic live update for Windows, which > >> I most assuredly resented. The hotfix you mentioned seems to be a KB fix > >> that I'd welcome a link to........ > > > I thought I sent all that aready - maybe to somebody else: > > >http://support.microsoft.com/kb/909095 > > Thanks, I installed that KB item. Had not seen it before. Good. Reboot, set your hibernate to something like 5 minutes and see how it goes. XP needs to think your system is idle before it will hibernate. If you are running some scan (at least for me) the scan has to complete, then the hibernate countdown starts. Try not to troubleshoot too many things at once - just fix one thing at a time.
From: William B. Lurie on 16 Feb 2010 11:28 William B. Lurie wrote: > JD wrote: >> William B. Lurie wrote: >>> JD wrote: >>>> William B. Lurie wrote: >>>>> SNIP < >>>>> ************************************************************** >>>>> I'd like to reopen this informative discussion, and add >>>>> the details of three *events* which seem to be applicable >>>>> to my system's failing to go to hibernate, and sometimes >>>>> not even to Screen Saver (!). Any explanations will be >>>>> appreciated. >>>>> ********************************************************** >>>>> Event Type: Error >>>>> Event Source: Service Control Manager >>>>> Event Category: None >>>>> Event ID: 7026 >>>>> Date: 2/15/2010 >>>>> Time: 6:06:25 AM >>>>> User: N/A >>>>> Computer: COMPAQ-2006 >>>>> Description: >>>>> The following boot-start or system-start driver(s) failed to load: >>>>> ftsata2 >>>>> KLIF >>>>> >>>>> For more information, see Help and Support Center at >>>>> http://go.microsoft.com/fwlink/events.asp. >>>>> ************************************************************ >>>>> Event Type: Failure Audit >>>>> Event Source: Security >>>>> Event Category: Policy Change >>>>> Event ID: 615 >>>>> Date: 2/13/2010 >>>>> Time: 6:38:44 AM >>>>> User: NT AUTHORITY\NETWORK SERVICE >>>>> Computer: COMPAQ-2006 >>>>> Description: >>>>> IPSec Services: IPSec Services failed to get the complete >>>>> list of network interfaces on the machine. This can be a potential >>>>> security hazard to the machine since some of the network interfaces >>>>> may not get the protection as desired by the applied IPSec filters. >>>>> Please run IPSec monitor snap-in to further diagnose the problem. >>>>> ********************************************************************* >>>>> Event Type: Error >>>>> Event Source: Service Control Manager >>>>> Event Category: None >>>>> Event ID: 7026 >>>>> Date: 2/15/2010 >>>>> Time: 6:06:25 AM >>>>> User: N/A >>>>> Computer: COMPAQ-2006 >>>>> Description: >>>>> The following boot-start or system-start driver(s) failed to load: >>>>> ftsata2 >>>>> KLIF >>>>> >>>>> For more information, see Help and Support Center at >>>>> http://go.microsoft.com/fwlink/events.asp. >>>>> ****************************************************** >>>> >>>> Did you make any changes to your computer around the same time you >>>> noticed your problems? >>>> >>>> I went to http://www.ask.com and entered the two programs that are not >>>> loading: >>>> >>>> ftsata2 >>>> >>>> http://www.file.net/process/ftsata2.sys.html >>>> >>>> http://forums11.itrc.hp.com/service/forums/questionanswer.do?admit=109447626+1266240824138+28353475&threadId=1163749 >>>> >>>> >>>> >>>> KLIF >>>> >>>> http://www.file.net/process/klif.sys.html >>>> >>>> Do you use any anti-malware or anti-spyware programs? >>>> >>> Yes, I have one anti-malware program installed but turned >>> it off two weeks ago when this ATI stuff started. msconfig has it not >>> loading on startup. >> >> How about a couple of free programs that you run on demand? Take a >> look at: >> >> Malwarebytes' Anti-Malware http://www.malwarebytes.org/mbam.php >> >> SUPERAntiSpyware Free Edition http://www.superantispyware.com/ >> >> Download the free versions. That's all you need. >> >> Read about them before you run them, make sure they won't conflict >> with your current software (they shouldn't but you never know) and >> let's make sure you machine is clean. >> >> And if you've read along here, the logging of these errors default is >> ON. Sometimes people reply here with great authority when they don't >> really know what they're talking about. >> >> I don't know what is causing your problem(s) but I'm trying to help >> you to figure it out on your own. You know, teach a man to fish, don't >> just give him a fish. >> >> Maybe I missed your reply so I'll ask again. What changed on your >> computer about the time you noticed these problems? >> > I thought I mentioned that I *did* install MBAM, in this time > frame, but, suspecting it as the cause, I have removed it from ram > and from the start-up list, so it should not be the cause. > Ditto the other item previously recommended, installed, tried, > but disabled. *********************************************** One more time: This report: Event Type: Failure Audit Event Source: Security Event Category: Policy Change Event ID: 615 Date: 2/16/2010 Time: 7:14:12 AM User: NT AUTHORITY\NETWORK SERVICE Computer: COMPAQ-2006 Description: IPSec Services: IPSec Services failed to get the complete list of network interfaces on the machine. This can be a potential security hazard to the machine since some of the network interfaces may not get the protection as desired by the applied IPSec filters. Please run IPSec monitor snap-in to further diagnose the problem. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. ******************************************************* This '615' under Security seems to happen every hour or two. It asks me to run IPSec (presumably SECurity) monitor snap-in to further diagnose the problem. R=Those terms are all brand new to me. I'd like to run it if I knew what it was and where it is. Thanks.
From: William B. Lurie on 16 Feb 2010 13:33 Jose wrote: > On Feb 12, 6:10 am, "William B. Lurie" <billu...(a)nospam.net> wrote: >> You nice folks led me to Event Viewer not too long ago, and >> in studying it, I find under Applications that Automatic Live >> Update is being run every 3 hours. It isn't my Norton Anti- >> Virus Live Update, and I do not allow Windows Live Update to >> run. Or at least I think I have it set so that I run Windows >> Update when I choose to do so. >> >> How can I track down what is running so often, and preventing >> my system from hibernating as a result? >> >> Thank you. > > Provide more information: > > Minimize back and forth Q&A and eliminate guesswork and assumptions: > > Click Start, Run and in the box enter: > > msinfo32 > > Click OK, and when the System Summary info appears, click Edit, Select > All, Copy and then paste > back here. > > There will be some personal information (like System Name and User > Name), and whatever appears to > be private information to you, just delete from the pasted > information. > > What are your system settings regarding Hibernation? Mine is set to > hibernate after 30 minutes of inactivity, but I can also hibernate > anytime. Which does not work for you? > > Has hibernation ever worked? > > If you click Start, Turn Off Computer and press the Shift key, does > the Stand By button turn into a Hibernate button and then if you click > Hibernate does your system enter hibernation? > > Let's see this event you see: > > Look in the Event Viewer for clues around the time of the incident > > Here is a method to post the specific information about individual > events. > > To see the Event Viewer logs, click Start, Settings, Control Panel, > Administrative Tools, Event Viewer. > > A shortcut to Event Viewer is to click Start, Run and in the box > enter: > > %SystemRoot%\system32\eventvwr.msc > > Click OK to launch the Event Viewer. > > The most interesting logs are usually the Application and System. > Some logs may be almost or completely empty. > Not every event is a problem, some are informational messages that > things are working okay and some are warnings. > No event should defy reasonable explanation. > > Each event is sorted by Date and Time. Errors will have red Xs, > Warnings will have yellow !s. > Information messages have white is. Not every Error or Warning event > means there is a serious issue. > Some are excusable at startup time when Windows is booting. Try to > find just the events at the date > and time around your problem. > > If you double click an event, it will open a Properties windows with > more information. On the right are > black up and down arrow buttons to scroll through the open events. The > third button that looks like > two pages on top of each other is used to copy the event details to > your Windows clipboard. > > When you find an interesting event that occurred around the time of > your issue, click the third button > under the up and down arrows to copy the details and then you can > paste the details (right click, Paste > or CTRL-V) the detail text back here for analysis. > > To get a fresh start on any Event Viewer log, you can choose to clear > the log (backing up the log is offered), > then reproduce your issue, then look at just the events around the > time of your issue. Okay, Jose, one mo' time: Event Type: Error Event Source: ati2mtag Event Category: CRT Event ID: 45062 Date: 2/16/2010 Time: 1:03:13 PM User: N/A Computer: COMPAQ-2006 Description: CRT invalid display type Data: 0000: 00 00 00 00 01 00 5a 00 ......Z. 0008: 2c 00 00 00 06 b0 00 c0 ,....�.� 0010: 00 00 00 00 00 00 00 00 ........ 0018: 00 00 00 00 00 00 00 00 ........ 0020: 00 00 00 00 00 00 00 00 ........ The above is the Event that occurs every time the Power Options is invoked (I think). How do I find out what it doesn't like about my CRT?
From: William B. Lurie on 17 Feb 2010 06:50 William B. Lurie wrote: > Jose wrote: >> On Feb 12, 6:10 am, "William B. Lurie" <billu...(a)nospam.net> wrote: >>> You nice folks led me to Event Viewer not too long ago, and >>> in studying it, I find under Applications that Automatic Live >>> Update is being run every 3 hours. It isn't my Norton Anti- >>> Virus Live Update, and I do not allow Windows Live Update to >>> run. Or at least I think I have it set so that I run Windows >>> Update when I choose to do so. >>> >>> How can I track down what is running so often, and preventing >>> my system from hibernating as a result? >>> >>> Thank you. >> >> Provide more information: >> >> Minimize back and forth Q&A and eliminate guesswork and assumptions: >> >> Click Start, Run and in the box enter: >> >> msinfo32 >> >> Click OK, and when the System Summary info appears, click Edit, Select >> All, Copy and then paste >> back here. >> >> There will be some personal information (like System Name and User >> Name), and whatever appears to >> be private information to you, just delete from the pasted >> information. >> >> What are your system settings regarding Hibernation? Mine is set to >> hibernate after 30 minutes of inactivity, but I can also hibernate >> anytime. Which does not work for you? >> >> Has hibernation ever worked? >> >> If you click Start, Turn Off Computer and press the Shift key, does >> the Stand By button turn into a Hibernate button and then if you click >> Hibernate does your system enter hibernation? >> >> Let's see this event you see: >> >> Look in the Event Viewer for clues around the time of the incident >> >> Here is a method to post the specific information about individual >> events. >> >> To see the Event Viewer logs, click Start, Settings, Control Panel, >> Administrative Tools, Event Viewer. >> >> A shortcut to Event Viewer is to click Start, Run and in the box >> enter: >> >> %SystemRoot%\system32\eventvwr.msc >> >> Click OK to launch the Event Viewer. >> >> The most interesting logs are usually the Application and System. >> Some logs may be almost or completely empty. >> Not every event is a problem, some are informational messages that >> things are working okay and some are warnings. >> No event should defy reasonable explanation. >> >> Each event is sorted by Date and Time. Errors will have red Xs, >> Warnings will have yellow !s. >> Information messages have white is. Not every Error or Warning event >> means there is a serious issue. >> Some are excusable at startup time when Windows is booting. Try to >> find just the events at the date >> and time around your problem. >> >> If you double click an event, it will open a Properties windows with >> more information. On the right are >> black up and down arrow buttons to scroll through the open events. The >> third button that looks like >> two pages on top of each other is used to copy the event details to >> your Windows clipboard. >> >> When you find an interesting event that occurred around the time of >> your issue, click the third button >> under the up and down arrows to copy the details and then you can >> paste the details (right click, Paste >> or CTRL-V) the detail text back here for analysis. >> >> To get a fresh start on any Event Viewer log, you can choose to clear >> the log (backing up the log is offered), >> then reproduce your issue, then look at just the events around the >> time of your issue. > > Okay, Jose, one mo' time: > > Event Type: Error > Event Source: ati2mtag > Event Category: CRT > Event ID: 45062 > Date: 2/16/2010 > Time: 1:03:13 PM > User: N/A > Computer: COMPAQ-2006 > Description: > CRT invalid display type > Data: > 0000: 00 00 00 00 01 00 5a 00 ......Z. > 0008: 2c 00 00 00 06 b0 00 c0 ,....�.� > 0010: 00 00 00 00 00 00 00 00 ........ > 0018: 00 00 00 00 00 00 00 00 ........ > 0020: 00 00 00 00 00 00 00 00 ........ > > The above is the Event that occurs every time the > Power Options is invoked (I think). How do I > find out what it doesn't like about my CRT? It is now worse than ever, and I suspect why. I decided to do some Windows Update. Hadn't been there in about a month. (I prefer Manual....I don't want all the updates, and for good reason). I let it install 27 updates, including Windows Search and IE8. I did a reboot (of course), and some work, and went away, figuring it would go to hibernate. Instead, 8 hours later, it had not even gone to Screen Saver! Looking at Event Viewer, it has 200 events recorded, in the top two categories. I'd like to back off and uninstall Windows Search and try again, if somebody will tell me how to uninstall it. As for IE8, I can probably download and IE7, uninstall IE8 and reinstall IE7. I use Firefox as my main browser anyway. Meanwhile, here is one of the messages in the Event Viewer. Note that Windows Search was involved. Event Type: Error Event Source: Windows Search Service Event Category: Gatherer Event ID: 3024 Date: 2/16/2010 Time: 3:29:08 PM User: N/A Computer: COMPAQ-2006 Description: The update cannot be started because the content sources cannot be accessed. Fix the errors and try the update again. Context: Windows Application, SystemIndex Catalog For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
From: William B. Lurie on 17 Feb 2010 08:40
William B. Lurie wrote: > William B. Lurie wrote: >> Jose wrote: >>> On Feb 12, 6:10 am, "William B. Lurie" <billu...(a)nospam.net> wrote: >>>> You nice folks led me to Event Viewer not too long ago, and >>>> in studying it, I find under Applications that Automatic Live >>>> Update is being run every 3 hours. It isn't my Norton Anti- >>>> Virus Live Update, and I do not allow Windows Live Update to >>>> run. Or at least I think I have it set so that I run Windows >>>> Update when I choose to do so. >>>> >>>> How can I track down what is running so often, and preventing >>>> my system from hibernating as a result? >>>> >>>> Thank you. >>> >>> Provide more information: >>> >>> Minimize back and forth Q&A and eliminate guesswork and assumptions: >>> >>> Click Start, Run and in the box enter: >>> >>> msinfo32 >>> >>> Click OK, and when the System Summary info appears, click Edit, Select >>> All, Copy and then paste >>> back here. >>> >>> There will be some personal information (like System Name and User >>> Name), and whatever appears to >>> be private information to you, just delete from the pasted >>> information. >>> >>> What are your system settings regarding Hibernation? Mine is set to >>> hibernate after 30 minutes of inactivity, but I can also hibernate >>> anytime. Which does not work for you? >>> >>> Has hibernation ever worked? >>> >>> If you click Start, Turn Off Computer and press the Shift key, does >>> the Stand By button turn into a Hibernate button and then if you click >>> Hibernate does your system enter hibernation? >>> >>> Let's see this event you see: >>> >>> Look in the Event Viewer for clues around the time of the incident >>> >>> Here is a method to post the specific information about individual >>> events. >>> >>> To see the Event Viewer logs, click Start, Settings, Control Panel, >>> Administrative Tools, Event Viewer. >>> >>> A shortcut to Event Viewer is to click Start, Run and in the box >>> enter: >>> >>> %SystemRoot%\system32\eventvwr.msc >>> >>> Click OK to launch the Event Viewer. >>> >>> The most interesting logs are usually the Application and System. >>> Some logs may be almost or completely empty. >>> Not every event is a problem, some are informational messages that >>> things are working okay and some are warnings. >>> No event should defy reasonable explanation. >>> >>> Each event is sorted by Date and Time. Errors will have red Xs, >>> Warnings will have yellow !s. >>> Information messages have white is. Not every Error or Warning event >>> means there is a serious issue. >>> Some are excusable at startup time when Windows is booting. Try to >>> find just the events at the date >>> and time around your problem. >>> >>> If you double click an event, it will open a Properties windows with >>> more information. On the right are >>> black up and down arrow buttons to scroll through the open events. The >>> third button that looks like >>> two pages on top of each other is used to copy the event details to >>> your Windows clipboard. >>> >>> When you find an interesting event that occurred around the time of >>> your issue, click the third button >>> under the up and down arrows to copy the details and then you can >>> paste the details (right click, Paste >>> or CTRL-V) the detail text back here for analysis. >>> >>> To get a fresh start on any Event Viewer log, you can choose to clear >>> the log (backing up the log is offered), >>> then reproduce your issue, then look at just the events around the >>> time of your issue. >> >> Okay, Jose, one mo' time: >> >> Event Type: Error >> Event Source: ati2mtag >> Event Category: CRT >> Event ID: 45062 >> Date: 2/16/2010 >> Time: 1:03:13 PM >> User: N/A >> Computer: COMPAQ-2006 >> Description: >> CRT invalid display type >> Data: >> 0000: 00 00 00 00 01 00 5a 00 ......Z. >> 0008: 2c 00 00 00 06 b0 00 c0 ,....�.� >> 0010: 00 00 00 00 00 00 00 00 ........ >> 0018: 00 00 00 00 00 00 00 00 ........ >> 0020: 00 00 00 00 00 00 00 00 ........ >> >> The above is the Event that occurs every time the >> Power Options is invoked (I think). How do I >> find out what it doesn't like about my CRT? > It is now worse than ever, and I suspect why. > > I decided to do some Windows Update. Hadn't been there in about > a month. (I prefer Manual....I don't want all the updates, and > for good reason). > > I let it install 27 updates, including Windows Search and IE8. > > I did a reboot (of course), and some work, and went away, > figuring it would go to hibernate. Instead, 8 hours later, > it had not even gone to Screen Saver! > > Looking at Event Viewer, it has 200 events recorded, in the top > two categories. > > I'd like to back off and uninstall Windows Search and try again, > if somebody will tell me how to uninstall it. As for IE8, I can > probably download and IE7, uninstall IE8 and reinstall IE7. I > use Firefox as my main browser anyway. > > Meanwhile, here is one of the messages in the Event Viewer. Note > that Windows Search was involved. > > Event Type: Error > Event Source: Windows Search Service > Event Category: Gatherer > Event ID: 3024 > Date: 2/16/2010 > Time: 3:29:08 PM > User: N/A > Computer: COMPAQ-2006 > Description: > The update cannot be started because the content sources cannot be > accessed. Fix the errors and try the update again. > > Context: Windows Application, SystemIndex Catalog > > > For more information, see Help and Support Center at > http://go.microsoft.com/fwlink/events.asp. > > and still one more to explain: Event Type: Error Event Source: Service Control Manager Event Category: None Event ID: 7026 Date: 2/17/2010 Time: 7:54:22 AM User: N/A Computer: COMPAQ-2006 Description: The following boot-start or system-start driver(s) failed to load: ftsata2 KLIF For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. |