Event Viewer

Hello All,

Does any one know what components are required so you get complete error
statements?

Thanks in advance.

Wayne Taylor

The component to add is called:

Event Log

Also, you may want to enable Verbose Event Logging:

You can facilitate troubleshooting Device Update Agent by creating a
component that enables verbose event logging in the Windows Event Log
Viewer.

To create and add verbose event logging component to your configuration

1. Open Component Designer.

2. Create a new component definition file by choosing File, then New. A
new component definition file opens.

3. Right-click the Components folder in the SLD Browser and choose Add
New Component. A New Component is added to the .sld file.

4. In the Component Properties window, enter a name for the component,
such as Verbose Event Log Support.

5. Right-click Registry Data in the SLD Browser and choose Add, then
Registry Data. The Add Component Registry Resources window appears.

6. Add the following registry information to enable verbose error
logging:

\HKLM\SYSTEM\CurrentControlSet\Services\XPEAgent\P arameters\Config

Name: Logging

Value: 1

Type: DWORD

7. Choose OK.

8. Save the Component by choosing File, then Save As.

9. Open the Component Database Manager by selecting Component Database
Manager from the Tools menu. The Component Database Manager window appears.

10. Import the Verbose Event Log component to the Component Database by
choosing Import under the Database tab. The Import SLD window appears.

11. Browse to the location of the Verbose Event Logging component and
choose Open.

12. In the Import SLD window, choose Import. The component is added to the
database.

The Verbose Event Logging component can now be added to your configuration
in Target Designer.



Dan




--
This posting is provided "AS IS" with no warranties, and confers no rights.



"Wayne Taylor" <wtt@parity-ict.com> wrote in message
news:uagLuuIpDHA.2404@TK2MSFTNGP12.phx.gbl...

> Hello All,
>
> Does any one know what components are required so you get complete error
> statements?
>
> Thanks in advance.
>
> Wayne Taylor
>
>

Wayne:

At a minimum, you need the "Event Log" component but you probably already
have this component.
Lotsa components do not contain the proper registry keys so that you
actually see log messages in the event logs. For example, for the "NTFS"
file system component I had to add the following into a custom component:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\Eventlog\System\ntfs]
"EventMessageFile"=hex(2):25,53,79,73,74,65,6d,52, 6f,6f,74,25,5c,53,79,73,74
,\
65,6d,33,32,5c,49,6f,4c,6f,67,4d,73,67,2e,64,6c,6c ,00
"TypesSupported"=dword:00000007

In my opinion, these registry keys should be part of the NTFS component.

HTH... Doug
"Wayne Taylor" <wtt@parity-ict.com> wrote in message
news:uagLuuIpDHA.2404@TK2MSFTNGP12.phx.gbl...

> Hello All,
>
> Does any one know what components are required so you get complete error
> statements?
>
> Thanks in advance.
>
> Wayne Taylor
>
>

Wayne,

Just to add to previous posts, you may also want to copy over drvmain.sdb
file from XPE Repository to target \WINDOWS\AppPatch\ directory. That will
fix some event descriptions in your future event log. (You can include the
drvmain.sdb into any of your components or use Extra Files in TD).

KM

WT> Hello All,

WT> Does any one know what components are required so you get complete
WT> error statements?

WT> Thanks in advance.

WT> Wayne Taylor


With best regards, KM. E-mail: konstmor@nospam.yahoo.com

Thanks for that guys!

Dan:

Should the key include XPEAgent or DUAgent? The DUA component already has
registry data at the DUAgent location, so I'm wondering if this should
really be XPEAgent.

Thanks...
.... Doug
"Dan Simpson [MS]" <dansimp@online.microsoft.com> wrote in message
news:3faac8dd$1@news.microsoft.com...

> The component to add is called:
>
> Event Log
>
> Also, you may want to enable Verbose Event Logging:
>
> You can facilitate troubleshooting Device Update Agent by creating a
> component that enables verbose event logging in the Windows Event Log
> Viewer.
>
> To create and add verbose event logging component to your configuration
>
> 1. Open Component Designer.
>
> 2. Create a new component definition file by choosing File, then New.

A

> new component definition file opens.
>
> 3. Right-click the Components folder in the SLD Browser and choose

Add

> New Component. A New Component is added to the .sld file.
>
> 4. In the Component Properties window, enter a name for the

component,

> such as Verbose Event Log Support.
>
> 5. Right-click Registry Data in the SLD Browser and choose Add, then
> Registry Data. The Add Component Registry Resources window appears.
>
> 6. Add the following registry information to enable verbose error
> logging:
>
> \HKLM\SYSTEM\CurrentControlSet\Services\XPEAgent\P arameters\Config
>
> Name: Logging
>
> Value: 1
>
> Type: DWORD
>
> 7. Choose OK.
>
> 8. Save the Component by choosing File, then Save As.
>
> 9. Open the Component Database Manager by selecting Component

Database

> Manager from the Tools menu. The Component Database Manager window

appears.

>
> 10. Import the Verbose Event Log component to the Component Database by
> choosing Import under the Database tab. The Import SLD window appears.
>
> 11. Browse to the location of the Verbose Event Logging component and
> choose Open.
>
> 12. In the Import SLD window, choose Import. The component is added to

the

> database.
>
> The Verbose Event Logging component can now be added to your configuration
> in Target Designer.
>
>
>
> Dan
>
>
>
>
> --
> This posting is provided "AS IS" with no warranties, and confers no

rights.

>
>
>
> "Wayne Taylor" <wtt@parity-ict.com> wrote in message
> news:uagLuuIpDHA.2404@TK2MSFTNGP12.phx.gbl...

>
>

Hi Doug

The key is XPEAgent. Otherwise, DUA does not show up in the Event Log.

tks,
Dan

--
This posting is provided "AS IS" with no warranties, and confers no rights.


"Doug Hoeffel (eMVP)" <doug.hoeffelNo@SpAmMcamtronics.com> wrote in message
news:OSwGVvWpDHA.2456@TK2MSFTNGP09.phx.gbl...

> Dan:
>
> Should the key include XPEAgent or DUAgent? The DUA component already has
> registry data at the DUAgent location, so I'm wondering if this should
> really be XPEAgent.
>
> Thanks...
> ... Doug
> "Dan Simpson [MS]" <dansimp@online.microsoft.com> wrote in message
> news:3faac8dd$1@news.microsoft.com...

New.

> A

> Add

> component,

then

> Database

> appears.

> the

configuration

> rights.

error

>
>

Thanks Dan!

"Dan Simpson [MS]" <dansimp@online.microsoft.com> wrote in message
news:3faff607$1@news.microsoft.com...

> Hi Doug
>
> The key is XPEAgent. Otherwise, DUA does not show up in the Event Log.
>
> tks,
> Dan
>
> --
> This posting is provided "AS IS" with no warranties, and confers no

rights.

>
>
> "Doug Hoeffel (eMVP)" <doug.hoeffelNo@SpAmMcamtronics.com> wrote in

message

> news:OSwGVvWpDHA.2456@TK2MSFTNGP09.phx.gbl...

has

configuration

> New.

choose

> then

by

to

> configuration

> error

>
>

Event Viewer

1)System
Event Type: Error
Event Source: Serial
Event Category: None
Event ID: 18
Date: 4/11/2006
Time: 12:40:20 AM
User: N/A
Computer: MACHINENAME
Description:
No Parameters subkey was found for user defined data. This is odd, and it
also means no user configuration can be found.
Data:
0000: 00 00 00 00 01 00 56 00 ......V.
0008: 00 00 00 00 12 00 06 c0 .......?
0010: 53 00 00 00 00 00 00 00 S.......
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5728
Date: 4/11/2006
Time: 12:43:41 AM
User: N/A
Computer: MACHINENAME
Description:
Could not load any transport.

Event Type: Information
Event Source: MrxSmb
Event Category: None
Event ID: 8029
Date: 4/11/2006
Time: 12:43:41 AM
User: N/A
Computer: MACHINENAME
Description:
The browser driver was unable to initialize variables from the Registry.
Data:
0000: 00 00 00 00 01 00 5a 00 ......Z.
0008: 00 00 00 00 5d 1f 00 40 ....]..@
0010: 00 00 00 00 34 00 00 c0 ....4..?
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........


2)Application
Event Type: Information
Event Source: EventLog
Event Category: None
Event ID: 6009
Date: 4/11/2006
Time: 12:40:30 AM
User: N/A
Computer: MACHINENAME
Description:
The description for Event ID ( 6009 ) in Source ( EventLog ) cannot be
found. The local computer may not have the necessary registry information or
message DLL files to display messages from a remote computer. You may be
able to use the /AUXSOURCE= flag to retrieve this description; see Help and
Support for details. The following information is part of the event: 5.01.,
2600, Service Pack 2, Uniprocessor Free.

Event Type: Warning
Event Source: WinMgmt
Event Category: None
Event ID: 63
Date: 4/11/2006
Time: 12:44:41 AM
User: NT AUTHORITY\SYSTEM
Computer: MACHINENAME
Description:
A provider, HiPerfCooker_v1, has been registered in the WMI namespace,
Root\WMI, to use the LocalSystem account. This account is privileged and
the provider may cause a security violation if it does not correctly
impersonate user requests.

Event Type: Warning
Event Source: WinMgmt
Event Category: None
Event ID: 5603
Date: 4/11/2006
Time: 12:45:23 AM
User: NT AUTHORITY\SYSTEM
Computer: MACHINENAME
Description:
A provider, Rsop Planning Mode Provider, has been registered in the WMI
namespace, root\RSOP, but did not specify the HostingModel property. This
provider will be run using the LocalSystem account. This account is
privileged and the provider may cause a security violation if it does not
correctly impersonate user requests. Ensure that provider has been reviewed
for security behavior and update the HostingModel property of the provider
registration to an account with the least privileges possible for the
required functionality.

Event Type: Warning
Event Source: WinMgmt
Event Category: None
Event ID: 5603
Date: 4/11/2006
Time: 12:45:23 AM
User: NT AUTHORITY\SYSTEM
Computer: MACHINENAME
Description:
A provider, Rsop Planning Mode Provider, has been registered in the WMI
namespace, root\RSOP, but did not specify the HostingModel property. This
provider will be run using the LocalSystem account. This account is
privileged and the provider may cause a security violation if it does not
correctly impersonate user requests. Ensure that provider has been reviewed
for security behavior and update the HostingModel property of the provider
registration to an account with the least privileges possible for the
required functionality.

Event Type: Error
Event Source: VSS
Event Category: None
Event ID: 8193
Date: 4/11/2006
Time: 12:45:25 AM
User: N/A
Computer: MACHINENAME
Description:
Volume Shadow Copy Service error: Unexpected error calling routine
CoCreateInstance. hr = 0x80040154.
Data:
0000: 45 56 54 45 56 54 43 43 EVTEVTCC
0008: 31 31 37 00 00 00 00 00 117.....
0010: 45 56 54 45 56 54 43 43 EVTEVTCC
0018: 31 30 31 00 00 00 00 00 101.....

Event Type: Error
Event Source: VSS
Event Category: None
Event ID: 4097
Date: 4/11/2006
Time: 12:45:25 AM
User: N/A
Computer: MACHINENAME
Description:
Volume Shadow Copy Service error: The COM+ Admin catalog instance cannot be
created [0x80040154].
Data:
0000: 43 41 44 43 41 44 4d 43 CADCADMC
0008: 31 33 34 00 00 00 00 00 134.....
0010: 43 41 44 43 41 44 4d 43 CADCADMC
0018: 31 31 37 00 00 00 00 00 117.....

Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1041
Date: 4/11/2006
Time: 12:47:52 AM
User: NT AUTHORITY\SYSTEM
Computer: OEM-EZM3P4DIA0A
Description:
The description for Event ID ( 1041 ) in Source ( Userenv ) cannot be found.
The local computer may not have the necessary registry information or
message DLL files to display messages from a remote computer. You may be
able to use the /AUXSOURCE= flag to retrieve this description; see Help and
Support for details. The following information is part of the event:
{c6dc5466-785a-11d2-84d0-00c04fb169f7}.

Event Type: Error
Event Source: Windows Product Activation
Event Category: None
Event ID: 1010
Date: 4/11/2006
Time: 12:47:53 AM
User: N/A
Computer: OEM-EZM3P4DIA0A
Description:
The description for Event ID ( 1010 ) in Source ( Windows Product
Activation ) cannot be found. The local computer may not have the necessary
registry information or message DLL files to display messages from a remote
computer. You may be able to use the /AUXSOURCE= flag to retrieve this
description; see Help and Support for details. The following information is
part of the event: The event log file is corrupt..

Event Type: Warning
Event Source: MSMQ
Event Category: Kernel
Event ID: 2024
Date: 4/11/2006
Time: 12:48:02 AM
User: N/A
Computer: OEM-EZM3P4DIA0A
Description:
Message Queuing performance counter data are not available because the
performance counter module failed to initialize. Please run 'lodctr.exe
mqperf.ini' from the command console and restart the service, or contact
Microsoft support.

Has anyone looked into just what files are really needed to get the Event
Viewer to work on a target? If I try to bring in the component I get a lot
of dependencies that really blow up the size of my image. I'd be happier
just copying a bunch of files that are all that's needed.