How to find the source of a cryptic event viewer log

Posted by mlsteeves on Server Fault See other posts from Server Fault or by mlsteeves
Published on 2010-12-02T16:20:22Z Indexed on 2011/02/13 23:26 UTC
Read the original article Hit count: 203

I'm looking at the eventviewer logs, and I see a bunch Error entries in the Application log. (Windows Server 2008 R1). There is an error written to the logs about every 4 seconds.

I need to find out which application is causing these events, is there anyway to find this out?

Here is what each look like:

Error  12/2/2010 12:00:09 PM   Application 0   None

The details for each error:

Log Name:      Application
Source:        Application
Date:          12/2/2010 12:00:09 PM
Event ID:      0
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      computer.domain
Description:
The description for Event ID 0 from source Application cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

If the event originated on another computer, the display information had to be saved with the event.

The following information was included with the event: 


the message resource is present but the message is not found in the string/message table

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Application" />
    <EventID Qualifiers="0">0</EventID>
    <Level>2</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2010-12-02T20:00:09.000Z" />
    <EventRecordID>237167</EventRecordID>
    <Channel>Application</Channel>
    <Computer>computer.domain</Computer>
    <Security />
  </System>
  <EventData>
    <Binary>534F434B...</Binary>
  </EventData>
</Event>

© Server Fault or respective owner

Related posts about windows-server-2008

Related posts about eventviewer