Event Viewer queries on my Windows 10 laptop

DragonFireDon22 · 08 Mar 2017

https://support.microsoft.com/en-us/...al-x64-edition

https://answers.microsoft.com/en-us/...4-780519363f59

esbo · 22 Mar 2017

alexncfc said:

I have been looking through my Windows 10 (14393) Event Log lately and see a lot of errors that I would like to get cleaned up if possible, and was hoping I could have some advice on why they might be occurring and how to fix them?

The main ones occurring consistently are ESENT (ID varies), Kernel-PNP (219) and DistributedCOM (10010 and 10016).

The most common are ESENT and DistributedCOM errors and I would like to fix them if possible:

DistributedCOM error:

ID 10010 - "The server {784E29F4-5EBE-4279-9948-1E8FE941646D} did not register with DCOM within the required timeout."

ID 10016 - "The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {D63B10C5-BB46-4990-A94F-E40B9D520160}
and APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool."

These above happen multiple times a day.

Kernel-PNP

ID 219 - "The driver \Driver\WudfRd failed to load for the device ROOT\WPD\0000."

ESENT Errors

ID 508 - "SettingSyncHost (568) {464A087D-ED25-4EFB-8D27-26C8A01E5F89}: A request to write to the file "C:\Users\Alex\AppData\Local\Microsoft\Windows\SettingSync\metastore\meta.edb" at offset 16384 (0x0000000000004000) for 16384 (0x00004000) bytes succeeded, but took an abnormally long time (15 seconds) to be serviced by the OS. This problem is likely due to faulty hardware. Please contact your hardware vendor for further assistance diagnosing the problem."

ID 489 - "SettingSyncHost (568) An attempt to open the file "C:\Users\Alex\AppData\Local\Microsoft\Windows\SettingSync\remotemetastore\v1\meta.edb" for read only access failed with system error 32 (0x00000020): "The process cannot access the file because it is being used by another process. ". The open file operation will fail with error -1032 (0xfffffbf8)."

ID 507 - "RemindersServer (5336) CortanaCoreInstance: A request to read from the file "C:\Users\Alex\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\ESEDatabase _CortanaCoreInstance\CortanaCoreDb.dat" at offset 278528 (0x0000000000044000) for 4096 (0x00001000) bytes succeeded, but took an abnormally long time (17 seconds) to be serviced by the OS. This problem is likely due to faulty hardware. Please contact your hardware vendor for further assistance diagnosing the problem."

ID 507 - "svchost (4444) Unistore: A request to read from the file "C:\Users\Alex\AppData\Local\Comms\UnistoreDB\store.vol" at offset 7667712 (0x0000000000750000) for 4096 (0x00001000) bytes succeeded, but took an abnormally long time (18 seconds) to be serviced by the OS. This problem is likely due to faulty hardware. Please contact your hardware vendor for further assistance diagnosing the problem."

ID 636 - "wuaueng.dll (1144) SUS20ClientDataStore: Flush map file "C:\WINDOWS\SoftwareDistribution\DataStore\DataStore.jfm" will be deleted. Reason: ReadHdrFailed."

ID 640 - "wuaueng.dll (1144) SUS20ClientDataStore: Error -1919 validating header page on flush map file "C:\WINDOWS\SoftwareDistribution\DataStore\DataStore.jfm". The flush map file will be invalidated. Additional information: [SignDbHdrFromDb:Create time:08/10/2016 23:27:45.874 Rand:339180914 Computer:] [SignFmHdrFromDb:Create time:08/10/2016 23:27:45.868 Rand:82576924 Computer:] [SignDbHdrFromFm:Create time:08/10/2016 23:28:02.533 Rand:2986111576 Computer:] [SignFmHdrFromFm:Create time:08/10/2016 23:28:05.669 Rand:1313424785 Computer:]"

These are just a few examples of the errors that are constantly appearing in the event log viewer multiple times daily. I don't know if they are impacting performance but I would certainly like to rule them out. Anyone have any ideas how?

Any help much appreciated.

Alex

Attachment 95678

I have had similar probs ie error like this

A request to write to the file "C:\Users\bren\AppData\Local\Microsoft\Windows\SettingSync\remotemetastore\v1\meta.edb" at offset 1032192 (0x00000000000fc000) for 16384 (0x00004000) bytes succeeded, but took an abnormally long time (40 seconds) to be serviced by the OS. In addition, 2 other I/O requests to this file have also taken an abnormally long time to be serviced since the last message regarding this problem was posted 23 seconds ago. This problem is likely due to faulty hardware. Please contact your hardware vendor for further assistance diagnosing the problem.

ie ESSENT error 508 510 & 533

They are in folders metastore and remotemeta store, I've seen others with similar probs, although there is no problem in the computer working other than the event log entries.

ONE THING worth noteing is that I do not have a "SettingSync" fold in that windows folder.

I don't think there is any problem with the drive. I mean why would it be manifest on just that one file(s) when billion of other files have no problems?

I have seen various talk about this but they seem to be from people who have no idea what they are talking about, clearly the drive is perfectly fine in my opinion.

So basically the file mentioned does not exist.

Anyhow there is something on it here

https://social.technet.microsoft.com...10itprogeneral

I have to reboot now I think - fingers crossed!!

esbo · 23 Mar 2017

Something I have been wondering about I wonder if this is linked to one drive???

I took a look at the file being written too and saw some lines like this

h t t p s : / / s 8 h 8 d q - d m 2 3 0 6 . f i l e s . 1 d r v . c o m / y 3 p K Z Q U n n N h n 9 J 5 X M 7 3 J l N B 7 n F 7 l i 1 Y t F V _ 5 H U 4 I B n f A b j E k _ b S B S i 4 P Y 0 M i a p i q 4 I I C Z v b X y U z d Z 4 0 d B v W P 9 c V V c v 6 H c 3 I T K I U D - 4 l Y v B z p h r j Y - d i m I M y v e D z 9 0 w _ G 6 F k c P f M x r 3 L d s V Y A T u W b w 4 3 Q g D 8 A E 3 4 F 5 5 0 5 2 C A E F ! 7 7 3

Note the 1 d r v . c o m bit.

I don't really know what I am talking about it but I wonder if it relates to write to a remote drive, ie onedrive or whatever, which could take a while due to the network?

I just though I would mention that as someone might know more about it than me.

Eagle51 · 24 Mar 2017

DCOM 10016 - That particular one is RunTimeBroker ... There's a couple of threads on this forum about it.
Event Error ID 10016 in Event Viewer...

Note: The DCOM 10016 error fixes involve the 2 step shuffle :) ... Editing the Registry & Editing the Dcom launch permissions) for the specific ClSID and APPID.

Kernal-PnP 219 -Probably a USB drive. Check/Update your drivers.

Esent-Errors - I believe some of those have to do with Edge Browser. Check the settings for Clear Browser Data (History,Cookies,etc) on close ... I don't remember exactly which ones cause those errors.

EliteData · 26 Mar 2017

this is an error when an application under a specific SID tries to execute using "local remote procedure call" through the local host network (127.0.0.1) on the local machine itself when the application does not have the permission to launch locally.
its really not an error to be overly concerned about especially if the application in question is not affected by this security measure.

DragonFireDon22 · 05 Apr 2017

You figured out yet how to fix ESENT?

rmcazz1970 · 10 Jul 2017

alexncfc said:

ID 636 - "wuaueng.dll (1144) SUS20ClientDataStore: Flush map file "C:\WINDOWS\SoftwareDistribution\DataStore\DataStore.jfm" will be deleted. Reason: ReadHdrFailed."

ID 640 - "wuaueng.dll (1144) SUS20ClientDataStore: Error -1919 validating header page on flush map file "C:\WINDOWS\SoftwareDistribution\DataStore\DataStore.jfm". The flush map file will be invalidated. Additional information: [SignDbHdrFromDb:Create time:08/10/2016 23:27:45.874 Rand:339180914 Computer:] [SignFmHdrFromDb:Create time:08/10/2016 23:27:45.868 Rand:82576924 Computer:] [SignDbHdrFromFm:Create time:08/10/2016 23:28:02.533 Rand:2986111576 Computer:] [SignFmHdrFromFm:Create time:08/10/2016 23:28:05.669 Rand:1313424785 Computer:]"

These are just a few examples of the errors that are constantly appearing in the event log viewer multiple times daily. I don't know if they are impacting performance but I would certainly like to rule them out. Anyone have any ideas how?

Any help much appreciated.

Alex

I was able to get rid of these two ESENT ID errors, 636 & 640.

The file always seems to be a .jfm file in question. I read on another forum that these are typically "auto form" files. Although I don't have the string anymore the ESENT errors I were getting were related to caching on Microsoft Edge and IE 11. It was always "readhdrfailed" "flush map invalidated" blah blah blah. Didn't matter how many times I cleared files and reset the browsers it they always came back. Funny thing I noticed, is they typically came back when I logged on to a web page. Facebook, or my gmail account for example. They would "auto fill" then when that error came back I always had to re-log into a page again. Something had to be deleting these files but I tried everything I could think of.

Long story short I was able to disable Windows Defender through the registry and these errors magically went away.

https://answers.microsoft.com/en-us/...6-da9a520f05f2

Windows Defender was screwing up my "auto fill" for whatever reason. I think in my case it was a conflict between browsers. It was deleting the .jfm files on both browsers. Not sure if this will help you, but it helped me.

Found one string. Just replace "Edge" with "Internet Explorer" and your set:

ID 636 - DllHost (???) Microsoft.MicrosoftEdge_8wekyb3d8bbwe_NOEDP_EDGE_IDB: Flush map file "C:\Users\Owner\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AppData\User\Default\In dexed DB\IndexedDB.jfm" will be deleted. Reason: ReadHdrFailed.

Thanks!