Application Eventlog Error message

Jay · Jan 27, 2005

Hi,

I am getting following error in Application event log

"The description for Event ID ( 6006 ) in Source ( EventLog ) cannot be
found. The local computer may not have the necessary registry information or
message DLL files to display messages from a remote computer. You may be
able to use the /AUXSOURCE= flag to retrieve this description; see Help and
Support for details. The following information is part of the event: . "

Any clue what registry Entry/DLL could be missing??

The image had clean dependency check and build had no errors.

Thanks

Jay

KM · Jan 27, 2005

Jay,

Either install Q824704 (it will bring the necessary hotfix to "Application Compatibility Core" component):
http://www.microsoft.com/downloads/...e7-a2d9-4e75-b6ba-9570653f0891&DisplayLang=en

Or add drvmain.sdb file from XPe Repository to your image under \Windows\AppPatch on target:
http://groups-beta.google.com/group...rvmain.sdb&qt_g=1&searchnow=Search+this+group

Jay · Jan 27, 2005

Hi KM,

I already have drvmain.sdb under AppPatch directory. I will try Q824704.

Thanks for your help.

Regards,

Jay

KM said:
Jay,

Either install Q824704 (it will bring the necessary hotfix to "Application

Compatibility Core" component):

KM · Jan 27, 2005

Jay,

Just in case, make sure that "Software Installation Group Policy Extension" component is also included.

Jay · Jan 28, 2005

Hi KM,

Your suggestion to include "Software Installation Group Policy Extension"
in the image fixed Eventlog ID 6006 problem but still I have event ID 6005
and 6009 which are also exhibiting same problem the detail follows
"
The description for Event ID ( 6009 ) in Source ( EventLog ) cannot be
found. The local computer may not have the necessary registry information or
message DLL files to display messages from a remote computer. You may be
able to use the /AUXSOURCE= flag to retrieve this description; see Help and
Support for details. The following information is part of the event: 5.01.,
2600, , Multiprocessor Free.

The description for Event ID ( 6005 ) in Source ( EventLog ) cannot be
found. The local computer may not have the necessary registry information or
message DLL files to display messages from a remote computer. You may be
able to use the /AUXSOURCE= flag to retrieve this description; see Help and
Support for details. The following information is part of the event: . "

Any thoughts ?

Thanks

Jay

KM said:
Jay,

Just in case, make sure that "Software Installation Group Policy

Extension" component is also included.

KM · Jan 28, 2005

Jay,

Did you include "Group Policy Client Core" component?

Jay · Jan 28, 2005

Hi KM,

Yes I did.

Regards,

Jay

KM said:
Jay,

Did you include "Group Policy Client Core" component?

--
Regards,
KM, BSquare Corp.

http://groups-beta.google.com/group...rvmain.sdb&qt_g=1&searchnow=Search+this+group

KM · Jan 28, 2005

Jay,

Then you would probably want to debug it more deeply.
Go to [HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application] key on your target and compare its content to the same key
content on XP Pro. You will see all the different applications that are registered in app log.

The following components listed from XPe database that have some Dll's registration for the Eventlog\Application branch:

Base Performance Counters [Version 5.1.2600, R620], [Visibility=200]
Device Update Agent [Version 5.1.2600.1106, R1507], [Visibility=1000]
Disk Performance Counters [Version 5.1.2600, R620], [Visibility=1000]
Event Log [Version 5.1.2600, R620], [Visibility=1000]
Event Log [Version 5.1.2600.1106, R1507], [Visibility=1000]
Folder Redirection Group Policy Extension [Version 5.1.2600.1106, R1507], [Visibility=1000]
Folder Redirection Group Policy Extension [Version 5.1.2600, R620], [Visibility=1000]
Group Policy Client Core [Version 5.1.2600, R620], [Visibility=200]
IIS Core Libraries [Version 5.1.2600.1106, R1507], [Visibility=200]
IIS Core Libraries [Version 5.1.2600, R620], [Visibility=200]
IIS Core Libraries - Hotfix Q319733 [Version 5.1.2600.41.1, R624], [Visibility=200]
IIS FTP Server [Version 5.1.2600, R620], [Visibility=1000]
IIS FTP Server [Version 5.1.2600.1106, R1507], [Visibility=1000]
IIS FTP Server - Hotfix Q319733 [Version 5.1.2600.41.1, R625], [Visibility=1000]
IIS Web Server [Version 5.1.2600.1106, R1507], [Visibility=1000]
IIS Web Server [Version 5.1.2600, R620], [Visibility=1000]
IIS Web Server - Hotfix Q275657 [Version 5.1.2600, R641], [Visibility=1000]
IIS Web Server - Hotfix Q319733 [Version 5.1.2600.41.1, R649], [Visibility=1000]
Message Queuing (MSMQ) Core [Version 5.1.2600, R620], [Visibility=1000]
Message Queuing (MSMQ) Core [Version 5.1.2600.1106, R1507], [Visibility=1000]
Message Queuing (MSMQ) Trigger Service [Version 5.1.2600.1106, R1507], [Visibility=1000]
Message Queuing (MSMQ) Trigger Service [Version 5.1.2600, R620], [Visibility=1000]
Netmeeting [Version 5.1.2600.1106, R1507], [Visibility=200]
Netmeeting [Version 5.1.2600, R620], [Visibility=200]
Network Performance Counters [Version 5.1.2600, R620], [Visibility=200]
Performance Counter Configuration [Version 5.1.2600, R620], [Visibility=1000]
Performance Logs and Alerts Service [Version 5.1.2600, R620], [Visibility=200]
Performance Logs and Alerts Service [Version 5.1.2600.1106, R1507], [Visibility=200]
Performance Monitor [Version 5.1.2600, R620], [Visibility=1000]
Performance Monitor [Version 5.1.2600.1106, R1507], [Visibility=1000]
SNMP Event Translator [Version 5.1.2600, R620], [Visibility=1000]
Software Installation Group Policy Extension [Version 5.1.2600, R620], [Visibility=1000]
Software Installation Group Policy Extension [Version 5.1.2600.1106, R1507], [Visibility=1000]
Software Installation Group Policy MMC Snap-In [Version 5.1.2600.1106, R1507], [Visibility=1000]
Software Installation Group Policy MMC Snap-In [Version 5.1.2600, R620], [Visibility=1000]
Windows Backup Utility [Version 5.1.2600, R620], [Visibility=50]
WMI Core [Version 5.1.2600, R620], [Visibility=1000]
WMI Core [Version 5.1.2600.1106, R1507], [Visibility=1000]

Try to include one-by-one (probalby leaving out or for the last some obviously heavy components like IIS, WMI).
Don't bother to search for components with old revisions (listed twice in the list above). Just include the components and it will
promise to use the latest ones.

Jay · Jan 29, 2005

Hi KM,

Thanks for the information you provided. I checked the components that are
listed and I have them in my image except 3, Net Meeting , message Queuing
and windows backup utility.

I also compared the Event log\Application branch of the registry with XP Pro
and found except few application entries they match.( The application
entries like NERO, SQLServer etc. are not needed in image and are not in)
I had also tried to load Event log\Application registry key from XP Pro to
the image registry but it still reported errors in event log (shotgun
approach).

One question I have is the Event ID 6009, 6006, 6005 which are recorded in
Application Log on XPe Image, but the same entries are recorded in System
Log on XP Pro (of course without any errors). Why is this different ?

I am also suspecting that one or more DLL which event log uses is not
getting registered.

Is there any tool or command to find out what DLL are registered then I can
compare it among image and XP Pro installation.

I really appreciate all the help you are providing for this problem.

Regards,

Jay.

KM said:
Jay,

Then you would probably want to debug it more deeply.
Go to [HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application] key on

your target and compare its content to the same key

content on XP Pro. You will see all the different applications that are registered in app log.

The following components listed from XPe database that have some Dll's

registration for the Eventlog\Application branch:

Base Performance Counters [Version 5.1.2600, R620], [Visibility=200]
Device Update Agent [Version 5.1.2600.1106, R1507], [Visibility=1000]
Disk Performance Counters [Version 5.1.2600, R620], [Visibility=1000]
Event Log [Version 5.1.2600, R620], [Visibility=1000]
Event Log [Version 5.1.2600.1106, R1507], [Visibility=1000]
Folder Redirection Group Policy Extension [Version 5.1.2600.1106, R1507], [Visibility=1000]
Folder Redirection Group Policy Extension [Version 5.1.2600, R620], [Visibility=1000]
Group Policy Client Core [Version 5.1.2600, R620], [Visibility=200]
IIS Core Libraries [Version 5.1.2600.1106, R1507], [Visibility=200]
IIS Core Libraries [Version 5.1.2600, R620], [Visibility=200]
IIS Core Libraries - Hotfix Q319733 [Version 5.1.2600.41.1, R624], [Visibility=200]
IIS FTP Server [Version 5.1.2600, R620], [Visibility=1000]
IIS FTP Server [Version 5.1.2600.1106, R1507], [Visibility=1000]
IIS FTP Server - Hotfix Q319733 [Version 5.1.2600.41.1, R625], [Visibility=1000]
IIS Web Server [Version 5.1.2600.1106, R1507], [Visibility=1000]
IIS Web Server [Version 5.1.2600, R620], [Visibility=1000]
IIS Web Server - Hotfix Q275657 [Version 5.1.2600, R641], [Visibility=1000]
IIS Web Server - Hotfix Q319733 [Version 5.1.2600.41.1, R649], [Visibility=1000]
Message Queuing (MSMQ) Core [Version 5.1.2600, R620], [Visibility=1000]
Message Queuing (MSMQ) Core [Version 5.1.2600.1106, R1507], [Visibility=1000]
Message Queuing (MSMQ) Trigger Service [Version 5.1.2600.1106, R1507], [Visibility=1000]
Message Queuing (MSMQ) Trigger Service [Version 5.1.2600, R620], [Visibility=1000]
Netmeeting [Version 5.1.2600.1106, R1507], [Visibility=200]
Netmeeting [Version 5.1.2600, R620], [Visibility=200]
Network Performance Counters [Version 5.1.2600, R620], [Visibility=200]
Performance Counter Configuration [Version 5.1.2600, R620], [Visibility=1000]
Performance Logs and Alerts Service [Version 5.1.2600, R620], [Visibility=200]
Performance Logs and Alerts Service [Version 5.1.2600.1106, R1507], [Visibility=200]
Performance Monitor [Version 5.1.2600, R620], [Visibility=1000]
Performance Monitor [Version 5.1.2600.1106, R1507], [Visibility=1000]
SNMP Event Translator [Version 5.1.2600, R620], [Visibility=1000]
Software Installation Group Policy Extension [Version 5.1.2600, R620], [Visibility=1000]
Software Installation Group Policy Extension [Version 5.1.2600.1106, R1507], [Visibility=1000]
Software Installation Group Policy MMC Snap-In [Version

5.1.2600.1106, R1507], [Visibility=1000]

Software Installation Group Policy MMC Snap-In [Version 5.1.2600, R620], [Visibility=1000]
Windows Backup Utility [Version 5.1.2600, R620], [Visibility=50]
WMI Core [Version 5.1.2600, R620], [Visibility=1000]
WMI Core [Version 5.1.2600.1106, R1507], [Visibility=1000]

Try to include one-by-one (probalby leaving out or for the last some

obviously heavy components like IIS, WMI).

Don't bother to search for components with old revisions (listed twice in

the list above). Just include the components and it will

KM · Jan 29, 2005

Jay,

Previously I just showed you the list of components that are registered in Application log.
Since you saw the messages in System log too it would make sense to check all the components that are registered as Eventlog
sources:

Auditing Resource DLLs [Version 5.1.2600, R620], [Visibility=200]
Base Performance Counters [Version 5.1.2600, R620], [Visibility=200]

CompactPCI Hot Swap Support [Version 5.1.2600.1106, R1507], [Visibility=1000]
Device Update Agent [Version 5.1.2600.1106, R1507], [Visibility=1000]
Disk Management Basic Volume Runtime [Version 5.1.2600, R620], [Visibility=1000]
Disk Management Dynamic Volume Runtime [Version 5.1.2600, R620], [Visibility=1000]
Disk Management Services [Version 5.1.2600, R620], [Visibility=200]
Disk Performance Counters [Version 5.1.2600, R620], [Visibility=1000]
El Torito CD [Version 5.1.2600.1106, R1507], [Visibility=1000]

Event Log [Version 5.1.2600.1106, R1507], [Visibility=1000]

First Boot Agent (FBA) [Version 5.1.2600.1106, R1507], [Visibility=200]
Folder Redirection Group Policy Extension [Version 5.1.2600.1106, R1507], [Visibility=1000]

Group Policy Client Core [Version 5.1.2600, R620], [Visibility=200]
IIS Common Libraries [Version 5.1.2600.1106, R1507], [Visibility=200]

IIS Core Libraries [Version 5.1.2600.1106, R1507], [Visibility=200]

IIS Core Libraries - Hotfix Q319733 [Version 5.1.2600.41.1, R624], [Visibility=200]
IIS FTP Server [Version 5.1.2600.1106, R1507], [Visibility=1000]

IIS FTP Server - Hotfix Q319733 [Version 5.1.2600.41.1, R625], [Visibility=1000]
IIS Web Server [Version 5.1.2600.1106, R1507], [Visibility=1000]

IIS Web Server - Hotfix Q319733 [Version 5.1.2600.41.1, R649], [Visibility=1000]
Intel Microcode Update Driver [Version 5.1.2600, R620], [Visibility=200]
Internet Authentication Service (IAS) and Remote Access Common Files [Version 5.1.2600, R620], [Visibility=200]

Local Security Authority Subsystem (LSASS) [Version 5.1.2600.1106, R1507], [Visibility=200]

Message Queuing (MSMQ) Core [Version 5.1.2600.1106, R1507], [Visibility=1000]
Message Queuing (MSMQ) Trigger Service [Version 5.1.2600.1106, R1507], [Visibility=1000]

MPS Multiprocessor PC [Version 5.1.2600.1106, R1507], [Visibility=1000]

MPS Uniprocessor PC [Version 5.1.2600.1106, R1507], [Visibility=1000]
Netmeeting [Version 5.1.2600.1106, R1507], [Visibility=200]

Network Performance Counters [Version 5.1.2600, R620], [Visibility=200]
Performance Counter Configuration [Version 5.1.2600, R620], [Visibility=1000]

Performance Logs and Alerts Service [Version 5.1.2600.1106, R1507], [Visibility=200]

Performance Monitor [Version 5.1.2600.1106, R1507], [Visibility=1000]
Simple Network Management Protocol (SNMP) [Version 5.1.2600.1106, R1507], [Visibility=1000]

Simple Network Management Protocol (SNMP) - Hotfix Q314147 [Version 5.1.2600.28.1, R622], [Visibility=1000]
SNMP Event Translator [Version 5.1.2600, R620], [Visibility=1000]

Software Installation Group Policy Extension [Version 5.1.2600.1106, R1507], [Visibility=1000]
Software Installation Group Policy MMC Snap-In [Version 5.1.2600.1106, R1507], [Visibility=1000]

System Restore Core [Version 5.1.2600.1106, R1507], [Visibility=1000]

Terminal Services Core [Version 5.1.2600.1106, R1507], [Visibility=200]
Volume Shadow Copy Service [Version 5.1.2600.1106, R1507], [Visibility=1000]

Windows Backup Utility [Version 5.1.2600, R620], [Visibility=50]
Windows CE USB Serial Host Driver [Version 5.1.2600, R620], [Visibility=200]
Windows Image Acquisition Core [Version 5.1.2600.1106, R1507], [Visibility=200]

WMI Core [Version 5.1.2600.1106, R1507], [Visibility=1000]

Some information for you about the EventLog: http://www.codeguru.com/Cpp/Cpp/cpp_managed/threads/article.php/c8895/
And MDSN, of course.

KM

KM said:
Hi KM,

Thanks for the information you provided. I checked the components that are
listed and I have them in my image except 3, Net Meeting , message Queuing
and windows backup utility.

I also compared the Event log\Application branch of the registry with XP Pro
and found except few application entries they match.( The application
entries like NERO, SQLServer etc. are not needed in image and are not in)
I had also tried to load Event log\Application registry key from XP Pro to
the image registry but it still reported errors in event log (shotgun
approach).

One question I have is the Event ID 6009, 6006, 6005 which are recorded in
Application Log on XPe Image, but the same entries are recorded in System
Log on XP Pro (of course without any errors). Why is this different ?

I am also suspecting that one or more DLL which event log uses is not
getting registered.

Is there any tool or command to find out what DLL are registered then I can
compare it among image and XP Pro installation.

I really appreciate all the help you are providing for this problem.

Regards,

Jay.

KM said:

Jay,

Then you would probably want to debug it more deeply.
Go to [HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application] key on

Click to expand...

your target and compare its content to the same key

content on XP Pro. You will see all the different applications that are registered in app log.

The following components listed from XPe database that have some Dll's

Click to expand...

registration for the Eventlog\Application branch:

Base Performance Counters [Version 5.1.2600, R620], [Visibility=200]
Device Update Agent [Version 5.1.2600.1106, R1507], [Visibility=1000]
Disk Performance Counters [Version 5.1.2600, R620], [Visibility=1000]
Event Log [Version 5.1.2600, R620], [Visibility=1000]
Event Log [Version 5.1.2600.1106, R1507], [Visibility=1000]
Folder Redirection Group Policy Extension [Version 5.1.2600.1106, R1507], [Visibility=1000]
Folder Redirection Group Policy Extension [Version 5.1.2600, R620], [Visibility=1000]
Group Policy Client Core [Version 5.1.2600, R620], [Visibility=200]
IIS Core Libraries [Version 5.1.2600.1106, R1507], [Visibility=200]
IIS Core Libraries [Version 5.1.2600, R620], [Visibility=200]
IIS Core Libraries - Hotfix Q319733 [Version 5.1.2600.41.1, R624], [Visibility=200]
IIS FTP Server [Version 5.1.2600, R620], [Visibility=1000]
IIS FTP Server [Version 5.1.2600.1106, R1507], [Visibility=1000]
IIS FTP Server - Hotfix Q319733 [Version 5.1.2600.41.1, R625], [Visibility=1000]
IIS Web Server [Version 5.1.2600.1106, R1507], [Visibility=1000]
IIS Web Server [Version 5.1.2600, R620], [Visibility=1000]
IIS Web Server - Hotfix Q275657 [Version 5.1.2600, R641], [Visibility=1000]
IIS Web Server - Hotfix Q319733 [Version 5.1.2600.41.1, R649], [Visibility=1000]
Message Queuing (MSMQ) Core [Version 5.1.2600, R620], [Visibility=1000]
Message Queuing (MSMQ) Core [Version 5.1.2600.1106, R1507], [Visibility=1000]
Message Queuing (MSMQ) Trigger Service [Version 5.1.2600.1106, R1507], [Visibility=1000]
Message Queuing (MSMQ) Trigger Service [Version 5.1.2600, R620], [Visibility=1000]
Netmeeting [Version 5.1.2600.1106, R1507], [Visibility=200]
Netmeeting [Version 5.1.2600, R620], [Visibility=200]
Network Performance Counters [Version 5.1.2600, R620], [Visibility=200]
Performance Counter Configuration [Version 5.1.2600, R620], [Visibility=1000]
Performance Logs and Alerts Service [Version 5.1.2600, R620], [Visibility=200]
Performance Logs and Alerts Service [Version 5.1.2600.1106, R1507], [Visibility=200]
Performance Monitor [Version 5.1.2600, R620], [Visibility=1000]
Performance Monitor [Version 5.1.2600.1106, R1507], [Visibility=1000]
SNMP Event Translator [Version 5.1.2600, R620], [Visibility=1000]
Software Installation Group Policy Extension [Version 5.1.2600, R620], [Visibility=1000]
Software Installation Group Policy Extension [Version 5.1.2600.1106, R1507], [Visibility=1000]
Software Installation Group Policy MMC Snap-In [Version

Click to expand...

5.1.2600.1106, R1507], [Visibility=1000]

Software Installation Group Policy MMC Snap-In [Version 5.1.2600, R620], [Visibility=1000]
Windows Backup Utility [Version 5.1.2600, R620], [Visibility=50]
WMI Core [Version 5.1.2600, R620], [Visibility=1000]
WMI Core [Version 5.1.2600.1106, R1507], [Visibility=1000]

Try to include one-by-one (probalby leaving out or for the last some

Click to expand...

obviously heavy components like IIS, WMI).

Don't bother to search for components with old revisions (listed twice in

Click to expand...

the list above). Just include the components and it will

promise to use the latest ones.

--
Regards,
KM, BSquare Corp.

http://groups-beta.google.com/group...rvmain.sdb&qt_g=1&searchnow=Search+this+group

Click to expand...

Jay · Jan 31, 2005

Hi KM,

Thanks for the Information. I checked all the components that apply to my
image and seems to be at right level.

One thing I am wondering is that these events should be recorded by Eventlog
in systems log yet I see them with the error message in Application log. On
XP Pro these messages are in System log. Does it mean that Eventlog service
had problem reporting this events and reported as application error messages
?

I had also copied all registry entry from relating to Eventlog (under
HKLM\CurrentControlset\Services) from working XP Pro to my image and still
got same errors which leads me to believe that one or more DLL may not be
registered or missing. Dependency check and build is clean so missing dll
is less likely than registering dll.

I also checked my FBA log and found following entries which gives errors

"" [FBARegQueue: DllInstall] C:\CNAE_XP\WINDOWS\System32\eventcls.dll
(Error: 0x8000ffff)
11:00:12 AM - [FBARegQueue: DllInstall]
C:\CNAE_XP\WINDOWS\System32\swprv.dll (Error: 0x8000ffff) ""

Any Idea what these errors mean ( what is Dll Install) ? and what is
missing in configuration?

Thanks again,

Regards
Jay

KM said:
Jay,

Previously I just showed you the list of components that are registered in Application log.
Since you saw the messages in System log too it would make sense to check

all the components that are registered as Eventlog

sources:

Auditing Resource DLLs [Version 5.1.2600, R620], [Visibility=200]
Base Performance Counters [Version 5.1.2600, R620], [Visibility=200]

CompactPCI Hot Swap Support [Version 5.1.2600.1106, R1507], [Visibility=1000]
Device Update Agent [Version 5.1.2600.1106, R1507], [Visibility=1000]
Disk Management Basic Volume Runtime [Version 5.1.2600, R620], [Visibility=1000]
Disk Management Dynamic Volume Runtime [Version 5.1.2600, R620], [Visibility=1000]
Disk Management Services [Version 5.1.2600, R620], [Visibility=200]
Disk Performance Counters [Version 5.1.2600, R620], [Visibility=1000]
El Torito CD [Version 5.1.2600.1106, R1507], [Visibility=1000]

Event Log [Version 5.1.2600.1106, R1507], [Visibility=1000]

First Boot Agent (FBA) [Version 5.1.2600.1106, R1507], [Visibility=200]
Folder Redirection Group Policy Extension [Version 5.1.2600.1106, R1507], [Visibility=1000]

Group Policy Client Core [Version 5.1.2600, R620], [Visibility=200]
IIS Common Libraries [Version 5.1.2600.1106, R1507], [Visibility=200]

IIS Core Libraries [Version 5.1.2600.1106, R1507], [Visibility=200]

IIS Core Libraries - Hotfix Q319733 [Version 5.1.2600.41.1, R624], [Visibility=200]
IIS FTP Server [Version 5.1.2600.1106, R1507], [Visibility=1000]

IIS FTP Server - Hotfix Q319733 [Version 5.1.2600.41.1, R625], [Visibility=1000]
IIS Web Server [Version 5.1.2600.1106, R1507], [Visibility=1000]

IIS Web Server - Hotfix Q319733 [Version 5.1.2600.41.1, R649], [Visibility=1000]
Intel Microcode Update Driver [Version 5.1.2600, R620], [Visibility=200]
Internet Authentication Service (IAS) and Remote Access Common Files

[Version 5.1.2600, R620], [Visibility=200]

Local Security Authority Subsystem (LSASS) [Version 5.1.2600.1106, R1507], [Visibility=200]

Message Queuing (MSMQ) Core [Version 5.1.2600.1106, R1507], [Visibility=1000]
Message Queuing (MSMQ) Trigger Service [Version 5.1.2600.1106, R1507], [Visibility=1000]

MPS Multiprocessor PC [Version 5.1.2600.1106, R1507], [Visibility=1000]

MPS Uniprocessor PC [Version 5.1.2600.1106, R1507], [Visibility=1000]
Netmeeting [Version 5.1.2600.1106, R1507], [Visibility=200]

Network Performance Counters [Version 5.1.2600, R620], [Visibility=200]
Performance Counter Configuration [Version 5.1.2600, R620], [Visibility=1000]

Performance Logs and Alerts Service [Version 5.1.2600.1106, R1507], [Visibility=200]

Performance Monitor [Version 5.1.2600.1106, R1507], [Visibility=1000]
Simple Network Management Protocol (SNMP) [Version 5.1.2600.1106, R1507], [Visibility=1000]

Simple Network Management Protocol (SNMP) - Hotfix Q314147 [Version

5.1.2600.28.1, R622], [Visibility=1000]

SNMP Event Translator [Version 5.1.2600, R620], [Visibility=1000]

Software Installation Group Policy Extension [Version 5.1.2600.1106, R1507], [Visibility=1000]
Software Installation Group Policy MMC Snap-In [Version

5.1.2600.1106, R1507], [Visibility=1000]

KM said:
System Restore Core [Version 5.1.2600.1106, R1507], [Visibility=1000]

Terminal Services Core [Version 5.1.2600.1106, R1507], [Visibility=200]
Volume Shadow Copy Service [Version 5.1.2600.1106, R1507], [Visibility=1000]

Windows Backup Utility [Version 5.1.2600, R620], [Visibility=50]
Windows CE USB Serial Host Driver [Version 5.1.2600, R620], [Visibility=200]
Windows Image Acquisition Core [Version 5.1.2600.1106, R1507], [Visibility=200]

WMI Core [Version 5.1.2600.1106, R1507], [Visibility=1000]

Some information for you about the EventLog: http://www.codeguru.com/Cpp/Cpp/cpp_managed/threads/article.php/c8895/
And MDSN, of course.

KM

Hi KM,

Thanks for the information you provided. I checked the components that are
listed and I have them in my image except 3, Net Meeting , message Queuing
and windows backup utility.

I also compared the Event log\Application branch of the registry with XP Pro
and found except few application entries they match.( The application
entries like NERO, SQLServer etc. are not needed in image and are not in)
I had also tried to load Event log\Application registry key from XP Pro to
the image registry but it still reported errors in event log (shotgun
approach).

One question I have is the Event ID 6009, 6006, 6005 which are recorded in
Application Log on XPe Image, but the same entries are recorded in System
Log on XP Pro (of course without any errors). Why is this different ?

I am also suspecting that one or more DLL which event log uses is not
getting registered.

Is there any tool or command to find out what DLL are registered then I can
compare it among image and XP Pro installation.

I really appreciate all the help you are providing for this problem.

Regards,

Jay.

KM said:

Jay,

Then you would probably want to debug it more deeply.
Go to [HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application] key

Click to expand...

on
your target and compare its content to the same key

content on XP Pro. You will see all the different applications that are registered in app log.

The following components listed from XPe database that have some Dll's

Click to expand...

registration for the Eventlog\Application branch:

Base Performance Counters [Version 5.1.2600, R620], [Visibility=200]
Device Update Agent [Version 5.1.2600.1106, R1507], [Visibility=1000]
Disk Performance Counters [Version 5.1.2600, R620], [Visibility=1000]
Event Log [Version 5.1.2600, R620], [Visibility=1000]
Event Log [Version 5.1.2600.1106, R1507], [Visibility=1000]
Folder Redirection Group Policy Extension [Version 5.1.2600.1106, R1507], [Visibility=1000]
Folder Redirection Group Policy Extension [Version 5.1.2600,

Click to expand...

R620],
[Visibility=1000]

Group Policy Client Core [Version 5.1.2600, R620], [Visibility=200]
IIS Core Libraries [Version 5.1.2600.1106, R1507], [Visibility=200]
IIS Core Libraries [Version 5.1.2600, R620], [Visibility=200]
IIS Core Libraries - Hotfix Q319733 [Version 5.1.2600.41.1,

Click to expand...

R624],
[Visibility=200]

IIS FTP Server [Version 5.1.2600, R620], [Visibility=1000]
IIS FTP Server [Version 5.1.2600.1106, R1507], [Visibility=1000]
IIS FTP Server - Hotfix Q319733 [Version 5.1.2600.41.1, R625], [Visibility=1000]
IIS Web Server [Version 5.1.2600.1106, R1507], [Visibility=1000]
IIS Web Server [Version 5.1.2600, R620], [Visibility=1000]
IIS Web Server - Hotfix Q275657 [Version 5.1.2600, R641], [Visibility=1000]
IIS Web Server - Hotfix Q319733 [Version 5.1.2600.41.1, R649], [Visibility=1000]
Message Queuing (MSMQ) Core [Version 5.1.2600, R620], [Visibility=1000]
Message Queuing (MSMQ) Core [Version 5.1.2600.1106, R1507], [Visibility=1000]
Message Queuing (MSMQ) Trigger Service [Version 5.1.2600.1106, R1507], [Visibility=1000]
Message Queuing (MSMQ) Trigger Service [Version 5.1.2600, R620], [Visibility=1000]
Netmeeting [Version 5.1.2600.1106, R1507], [Visibility=200]
Netmeeting [Version 5.1.2600, R620], [Visibility=200]
Network Performance Counters [Version 5.1.2600, R620], [Visibility=200]
Performance Counter Configuration [Version 5.1.2600, R620], [Visibility=1000]
Performance Logs and Alerts Service [Version 5.1.2600, R620], [Visibility=200]
Performance Logs and Alerts Service [Version 5.1.2600.1106,

Click to expand...

R1507],
[Visibility=200]

Performance Monitor [Version 5.1.2600, R620], [Visibility=1000]
Performance Monitor [Version 5.1.2600.1106, R1507], [Visibility=1000]
SNMP Event Translator [Version 5.1.2600, R620], [Visibility=1000]
Software Installation Group Policy Extension [Version 5.1.2600, R620], [Visibility=1000]
Software Installation Group Policy Extension [Version

Click to expand...

5.1.2600.1106,
R1507], [Visibility=1000]

Software Installation Group Policy MMC Snap-In [Version

Click to expand...

5.1.2600.1106, R1507], [Visibility=1000]

Software Installation Group Policy MMC Snap-In [Version 5.1.2600, R620], [Visibility=1000]
Windows Backup Utility [Version 5.1.2600, R620], [Visibility=50]
WMI Core [Version 5.1.2600, R620], [Visibility=1000]
WMI Core [Version 5.1.2600.1106, R1507], [Visibility=1000]

Try to include one-by-one (probalby leaving out or for the last some

Click to expand...

obviously heavy components like IIS, WMI).

Don't bother to search for components with old revisions (listed twice

Click to expand...

in
the list above). Just include the components and it will

promise to use the latest ones.

--
Regards,
KM, BSquare Corp.

Hi KM,

Yes I did.

Regards,

Jay
Jay,

Did you include "Group Policy Client Core" component?

--
Regards,
KM, BSquare Corp.

Hi KM,

Your suggestion to include "Software Installation Group Policy
Extension"
in the image fixed Eventlog ID 6006 problem but still I have

Click to expand...

event
ID

6005
and 6009 which are also exhibiting same problem the detail follows
"
The description for Event ID ( 6009 ) in Source ( EventLog )

Click to expand...

cannot
be

found. The local computer may not have the necessary registry
information or
message DLL files to display messages from a remote computer. You may be
able to use the /AUXSOURCE= flag to retrieve this description;

Click to expand...

see
Help

and
Support for details. The following information is part of the event:
5.01.,
2600, , Multiprocessor Free.

The description for Event ID ( 6005 ) in Source ( EventLog )

Click to expand...

cannot
be

found. The local computer may not have the necessary registry
information or
message DLL files to display messages from a remote computer. You may be
able to use the /AUXSOURCE= flag to retrieve this description;

Click to expand...

see
Help

and
Support for details. The following information is part of the

Click to expand...

event:
.

"

Any thoughts ?

Thanks

Jay
Jay,

Just in case, make sure that "Software Installation Group Policy
Extension" component is also included.

--
Regards,
KM, BSquare Corp.

Hi KM,

I already have drvmain.sdb under AppPatch directory. I will try
Q824704.

Thanks for your help.

Regards,

Jay
Jay,

Either install Q824704 (it will bring the necessary hotfix to
"Application
Compatibility Core" component):

Click to expand...

http://www.microsoft.com/downloads/...e7-a2d9-4e75-b6ba-9570653f0891&DisplayLang=en

Or add drvmain.sdb file from XPe Repository to your image under
\Windows\AppPatch on target:

Click to expand...

http://groups-beta.google.com/group...rvmain.sdb&qt_g=1&searchnow=Search+this+group

--
Regards,
KM, BSquare Corp.

Hi,

I am getting following error in Application event log

"The description for Event ID ( 6006 ) in Source ( EventLog )
cannot
be
found. The local computer may not have the necessary registry
information or
message DLL files to display messages from a remote computer.
You
may be
able to use the /AUXSOURCE= flag to retrieve this description;
see
Help
and
Support for details. The following information is part of the
event:
. "

Any clue what registry Entry/DLL could be missing??

The image had clean dependency check and build had no errors.

Thanks

Jay

Click to expand...

Click to expand...

KM · Jan 31, 2005

Jay,

One thing I am wondering is that these events should be recorded by Eventlog
in systems log yet I see them with the error message in Application log. On
XP Pro these messages are in System log. Does it mean that Eventlog service
had problem reporting this events and reported as application error messages ?

Most likely. (Although to be 100% sure I must see the Dll's source code

which is unlilely possible )

I had also copied all registry entry from relating to Eventlog (under
HKLM\CurrentControlset\Services) from working XP Pro to my image and still
got same errors which leads me to believe that one or more DLL may not be
registered or missing. Dependency check and build is clean so missing dll
is less likely than registering dll.

I also checked my FBA log and found following entries which gives errors

"" [FBARegQueue: DllInstall] C:\CNAE_XP\WINDOWS\System32\eventcls.dll
(Error: 0x8000ffff)
11:00:12 AM - [FBARegQueue: DllInstall]
C:\CNAE_XP\WINDOWS\System32\swprv.dll (Error: 0x8000ffff) ""

These Dlls belong to "Volume Shadow Copy Service" - you've already go this component in your image.
Could you also check if "COM+ Services" is in your configuration? ANd if the COM+ service is running fine at run time?

Btw, regarding these errors Microsoft input was : "These two errors are benign and can be ignored- they are att-empting to
register the dlls before another component has been installe-d. They get registered later successfully. "

http://groups-beta.google.com/group/microsoft.public.windowsxp.embedded/msg/f6a1c82cba279855

Any Idea what these errors mean ( what is Dll Install) ? and what is
missing in configuration?

They don't mean much beside the fact that there is a "Catastrophic failure" with those components (Dlls). The error description
(E_UNEXPECTED) is useless to us now :-(

KM

Jay,

Previously I just showed you the list of components that are registered in Application log.
Since you saw the messages in System log too it would make sense to check

Click to expand...

all the components that are registered as Eventlog

sources:

Auditing Resource DLLs [Version 5.1.2600, R620], [Visibility=200]
Base Performance Counters [Version 5.1.2600, R620], [Visibility=200]

CompactPCI Hot Swap Support [Version 5.1.2600.1106, R1507], [Visibility=1000]
Device Update Agent [Version 5.1.2600.1106, R1507], [Visibility=1000]
Disk Management Basic Volume Runtime [Version 5.1.2600, R620], [Visibility=1000]
Disk Management Dynamic Volume Runtime [Version 5.1.2600, R620], [Visibility=1000]
Disk Management Services [Version 5.1.2600, R620], [Visibility=200]
Disk Performance Counters [Version 5.1.2600, R620], [Visibility=1000]
El Torito CD [Version 5.1.2600.1106, R1507], [Visibility=1000]

Event Log [Version 5.1.2600.1106, R1507], [Visibility=1000]

First Boot Agent (FBA) [Version 5.1.2600.1106, R1507], [Visibility=200]
Folder Redirection Group Policy Extension [Version 5.1.2600.1106, R1507], [Visibility=1000]

Group Policy Client Core [Version 5.1.2600, R620], [Visibility=200]
IIS Common Libraries [Version 5.1.2600.1106, R1507], [Visibility=200]

IIS Core Libraries [Version 5.1.2600.1106, R1507], [Visibility=200]

IIS Core Libraries - Hotfix Q319733 [Version 5.1.2600.41.1, R624], [Visibility=200]
IIS FTP Server [Version 5.1.2600.1106, R1507], [Visibility=1000]

IIS FTP Server - Hotfix Q319733 [Version 5.1.2600.41.1, R625], [Visibility=1000]
IIS Web Server [Version 5.1.2600.1106, R1507], [Visibility=1000]

IIS Web Server - Hotfix Q319733 [Version 5.1.2600.41.1, R649], [Visibility=1000]
Intel Microcode Update Driver [Version 5.1.2600, R620], [Visibility=200]
Internet Authentication Service (IAS) and Remote Access Common Files

Click to expand...

[Version 5.1.2600, R620], [Visibility=200]

Local Security Authority Subsystem (LSASS) [Version 5.1.2600.1106, R1507], [Visibility=200]

Message Queuing (MSMQ) Core [Version 5.1.2600.1106, R1507], [Visibility=1000]
Message Queuing (MSMQ) Trigger Service [Version 5.1.2600.1106, R1507], [Visibility=1000]

MPS Multiprocessor PC [Version 5.1.2600.1106, R1507], [Visibility=1000]

MPS Uniprocessor PC [Version 5.1.2600.1106, R1507], [Visibility=1000]
Netmeeting [Version 5.1.2600.1106, R1507], [Visibility=200]

Network Performance Counters [Version 5.1.2600, R620], [Visibility=200]
Performance Counter Configuration [Version 5.1.2600, R620], [Visibility=1000]

Performance Logs and Alerts Service [Version 5.1.2600.1106, R1507], [Visibility=200]

Performance Monitor [Version 5.1.2600.1106, R1507], [Visibility=1000]
Simple Network Management Protocol (SNMP) [Version 5.1.2600.1106, R1507], [Visibility=1000]

Simple Network Management Protocol (SNMP) - Hotfix Q314147 [Version

Click to expand...

5.1.2600.28.1, R622], [Visibility=1000]

SNMP Event Translator [Version 5.1.2600, R620], [Visibility=1000]

Software Installation Group Policy Extension [Version 5.1.2600.1106, R1507], [Visibility=1000]
Software Installation Group Policy MMC Snap-In [Version

Click to expand...

5.1.2600.1106, R1507], [Visibility=1000]

System Restore Core [Version 5.1.2600.1106, R1507], [Visibility=1000]

Terminal Services Core [Version 5.1.2600.1106, R1507], [Visibility=200]
Volume Shadow Copy Service [Version 5.1.2600.1106, R1507], [Visibility=1000]

Windows Backup Utility [Version 5.1.2600, R620], [Visibility=50]
Windows CE USB Serial Host Driver [Version 5.1.2600, R620], [Visibility=200]
Windows Image Acquisition Core [Version 5.1.2600.1106, R1507], [Visibility=200]

WMI Core [Version 5.1.2600.1106, R1507], [Visibility=1000]

Some information for you about the EventLog: http://www.codeguru.com/Cpp/Cpp/cpp_managed/threads/article.php/c8895/
And MDSN, of course.

KM

Hi KM,

Thanks for the information you provided. I checked the components that are
listed and I have them in my image except 3, Net Meeting , message Queuing
and windows backup utility.

I also compared the Event log\Application branch of the registry with XP Pro
and found except few application entries they match.( The application
entries like NERO, SQLServer etc. are not needed in image and are not in)
I had also tried to load Event log\Application registry key from XP Pro to
the image registry but it still reported errors in event log (shotgun
approach).

One question I have is the Event ID 6009, 6006, 6005 which are recorded in
Application Log on XPe Image, but the same entries are recorded in System
Log on XP Pro (of course without any errors). Why is this different ?

I am also suspecting that one or more DLL which event log uses is not
getting registered.

Is there any tool or command to find out what DLL are registered then I can
compare it among image and XP Pro installation.

I really appreciate all the help you are providing for this problem.

Regards,

Jay.
Jay,

Then you would probably want to debug it more deeply.
Go to [HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application] key on
your target and compare its content to the same key
content on XP Pro. You will see all the different applications that are
registered in app log.

The following components listed from XPe database that have some Dll's
registration for the Eventlog\Application branch:

Base Performance Counters [Version 5.1.2600, R620], [Visibility=200]
Device Update Agent [Version 5.1.2600.1106, R1507],
[Visibility=1000]
Disk Performance Counters [Version 5.1.2600, R620],
[Visibility=1000]
Event Log [Version 5.1.2600, R620], [Visibility=1000]
Event Log [Version 5.1.2600.1106, R1507], [Visibility=1000]
Folder Redirection Group Policy Extension [Version 5.1.2600.1106,
R1507], [Visibility=1000]
Folder Redirection Group Policy Extension [Version 5.1.2600, R620],
[Visibility=1000]
Group Policy Client Core [Version 5.1.2600, R620], [Visibility=200]
IIS Core Libraries [Version 5.1.2600.1106, R1507], [Visibility=200]
IIS Core Libraries [Version 5.1.2600, R620], [Visibility=200]
IIS Core Libraries - Hotfix Q319733 [Version 5.1.2600.41.1, R624],
[Visibility=200]
IIS FTP Server [Version 5.1.2600, R620], [Visibility=1000]
IIS FTP Server [Version 5.1.2600.1106, R1507], [Visibility=1000]
IIS FTP Server - Hotfix Q319733 [Version 5.1.2600.41.1, R625],
[Visibility=1000]
IIS Web Server [Version 5.1.2600.1106, R1507], [Visibility=1000]
IIS Web Server [Version 5.1.2600, R620], [Visibility=1000]
IIS Web Server - Hotfix Q275657 [Version 5.1.2600, R641],
[Visibility=1000]
IIS Web Server - Hotfix Q319733 [Version 5.1.2600.41.1, R649],
[Visibility=1000]
Message Queuing (MSMQ) Core [Version 5.1.2600, R620],
[Visibility=1000]
Message Queuing (MSMQ) Core [Version 5.1.2600.1106, R1507],
[Visibility=1000]
Message Queuing (MSMQ) Trigger Service [Version 5.1.2600.1106,
R1507], [Visibility=1000]
Message Queuing (MSMQ) Trigger Service [Version 5.1.2600, R620],
[Visibility=1000]
Netmeeting [Version 5.1.2600.1106, R1507], [Visibility=200]
Netmeeting [Version 5.1.2600, R620], [Visibility=200]
Network Performance Counters [Version 5.1.2600, R620],
[Visibility=200]
Performance Counter Configuration [Version 5.1.2600, R620],
[Visibility=1000]
Performance Logs and Alerts Service [Version 5.1.2600, R620],
[Visibility=200]
Performance Logs and Alerts Service [Version 5.1.2600.1106, R1507],
[Visibility=200]
Performance Monitor [Version 5.1.2600, R620], [Visibility=1000]
Performance Monitor [Version 5.1.2600.1106, R1507],
[Visibility=1000]
SNMP Event Translator [Version 5.1.2600, R620], [Visibility=1000]
Software Installation Group Policy Extension [Version 5.1.2600,
R620], [Visibility=1000]
Software Installation Group Policy Extension [Version 5.1.2600.1106,
R1507], [Visibility=1000]
Software Installation Group Policy MMC Snap-In [Version
5.1.2600.1106, R1507], [Visibility=1000]
Software Installation Group Policy MMC Snap-In [Version 5.1.2600,
R620], [Visibility=1000]
Windows Backup Utility [Version 5.1.2600, R620], [Visibility=50]
WMI Core [Version 5.1.2600, R620], [Visibility=1000]
WMI Core [Version 5.1.2600.1106, R1507], [Visibility=1000]

Try to include one-by-one (probalby leaving out or for the last some
obviously heavy components like IIS, WMI).
Don't bother to search for components with old revisions (listed twice in
the list above). Just include the components and it will
promise to use the latest ones.

--
Regards,
KM, BSquare Corp.

Hi KM,

Yes I did.

Regards,

Jay
Jay,

Did you include "Group Policy Client Core" component?

--
Regards,
KM, BSquare Corp.

Hi KM,

Your suggestion to include "Software Installation Group Policy
Extension"
in the image fixed Eventlog ID 6006 problem but still I have event
ID
6005
and 6009 which are also exhibiting same problem the detail follows
"
The description for Event ID ( 6009 ) in Source ( EventLog ) cannot
be
found. The local computer may not have the necessary registry
information or
message DLL files to display messages from a remote computer. You
may be
able to use the /AUXSOURCE= flag to retrieve this description; see
Help
and
Support for details. The following information is part of the event:
5.01.,
2600, , Multiprocessor Free.

The description for Event ID ( 6005 ) in Source ( EventLog ) cannot
be
found. The local computer may not have the necessary registry
information or
message DLL files to display messages from a remote computer. You
may be
able to use the /AUXSOURCE= flag to retrieve this description; see
Help
and
Support for details. The following information is part of the event:
.
"

Any thoughts ?

Thanks

Jay
Jay,

Just in case, make sure that "Software Installation Group Policy
Extension" component is also included.

--
Regards,
KM, BSquare Corp.

Hi KM,

I already have drvmain.sdb under AppPatch directory. I will try
Q824704.

Thanks for your help.

Regards,

Jay
Jay,

Either install Q824704 (it will bring the necessary hotfix to
"Application
Compatibility Core" component):

http://www.microsoft.com/downloads/...e7-a2d9-4e75-b6ba-9570653f0891&DisplayLang=en

Or add drvmain.sdb file from XPe Repository to your image
under
\Windows\AppPatch on target:

http://groups-beta.google.com/group...rvmain.sdb&qt_g=1&searchnow=Search+this+group

--
Regards,
KM, BSquare Corp.

Hi,

I am getting following error in Application event log

"The description for Event ID ( 6006 ) in Source (
EventLog )
cannot
be
found. The local computer may not have the necessary
registry
information or
message DLL files to display messages from a remote
computer.
You
may be
able to use the /AUXSOURCE= flag to retrieve this
description;
see
Help
and
Support for details. The following information is part of
the
event:
. "

Any clue what registry Entry/DLL could be missing??

The image had clean dependency check and build had no
errors.

Thanks

Jay

Click to expand...

Click to expand...

Jay · Jan 31, 2005

Hi KM,

Thanks for the info.

Can you check to see on working image that you have( preferably SP1
based if you have one)
event log ID entries 6006, 6005, 6009 are reported on System log or
application log ?

Thanks,

Jay

KM said:
Jay,

One thing I am wondering is that these events should be recorded by Eventlog
in systems log yet I see them with the error message in Application log. On
XP Pro these messages are in System log. Does it mean that Eventlog service
had problem reporting this events and reported as application error

Click to expand...

messages ?

Most likely. (Although to be 100% sure I must see the Dll's source code which is unlilely possible )

I had also copied all registry entry from relating to Eventlog (under
HKLM\CurrentControlset\Services) from working XP Pro to my image and still
got same errors which leads me to believe that one or more DLL may not be
registered or missing. Dependency check and build is clean so missing dll
is less likely than registering dll.

I also checked my FBA log and found following entries which gives errors

"" [FBARegQueue: DllInstall] C:\CNAE_XP\WINDOWS\System32\eventcls.dll
(Error: 0x8000ffff)
11:00:12 AM - [FBARegQueue: DllInstall]
C:\CNAE_XP\WINDOWS\System32\swprv.dll (Error: 0x8000ffff) ""

Click to expand...

These Dlls belong to "Volume Shadow Copy Service" - you've already go this component in your image.
Could you also check if "COM+ Services" is in your configuration? ANd if

the COM+ service is running fine at run time?

Btw, regarding these errors Microsoft input was : "These two errors are

benign and can be ignored- they are att-empting to

register the dlls before another component has been installe-d. They get

registered later successfully. "

http://groups-beta.google.com/group/microsoft.public.windowsxp.embedded/msg/f6a1c82cba279855

They don't mean much beside the fact that there is a "Catastrophic

failure" with those components (Dlls). The error description

(E_UNEXPECTED) is useless to us now :-(

KM

Jay,

Previously I just showed you the list of components that are registered

Click to expand...

in
Application log.

Since you saw the messages in System log too it would make sense to

Click to expand...

check
all the components that are registered as Eventlog

sources:

Auditing Resource DLLs [Version 5.1.2600, R620], [Visibility=200]
Base Performance Counters [Version 5.1.2600, R620], [Visibility=200]

CompactPCI Hot Swap Support [Version 5.1.2600.1106, R1507], [Visibility=1000]
Device Update Agent [Version 5.1.2600.1106, R1507], [Visibility=1000]
Disk Management Basic Volume Runtime [Version 5.1.2600, R620], [Visibility=1000]
Disk Management Dynamic Volume Runtime [Version 5.1.2600, R620], [Visibility=1000]
Disk Management Services [Version 5.1.2600, R620], [Visibility=200]
Disk Performance Counters [Version 5.1.2600, R620], [Visibility=1000]
El Torito CD [Version 5.1.2600.1106, R1507], [Visibility=1000]

Event Log [Version 5.1.2600.1106, R1507], [Visibility=1000]

First Boot Agent (FBA) [Version 5.1.2600.1106, R1507], [Visibility=200]
Folder Redirection Group Policy Extension [Version 5.1.2600.1106, R1507], [Visibility=1000]

Group Policy Client Core [Version 5.1.2600, R620], [Visibility=200]
IIS Common Libraries [Version 5.1.2600.1106, R1507], [Visibility=200]

IIS Core Libraries [Version 5.1.2600.1106, R1507], [Visibility=200]

IIS Core Libraries - Hotfix Q319733 [Version 5.1.2600.41.1,

Click to expand...

R624],
[Visibility=200]

IIS FTP Server [Version 5.1.2600.1106, R1507], [Visibility=1000]

IIS FTP Server - Hotfix Q319733 [Version 5.1.2600.41.1, R625], [Visibility=1000]
IIS Web Server [Version 5.1.2600.1106, R1507], [Visibility=1000]

IIS Web Server - Hotfix Q319733 [Version 5.1.2600.41.1, R649], [Visibility=1000]
Intel Microcode Update Driver [Version 5.1.2600, R620], [Visibility=200]
Internet Authentication Service (IAS) and Remote Access Common

Click to expand...

Files
[Version 5.1.2600, R620], [Visibility=200]

Local Security Authority Subsystem (LSASS) [Version

Click to expand...

5.1.2600.1106,
R1507], [Visibility=200]

Message Queuing (MSMQ) Core [Version 5.1.2600.1106, R1507], [Visibility=1000]
Message Queuing (MSMQ) Trigger Service [Version 5.1.2600.1106, R1507], [Visibility=1000]

MPS Multiprocessor PC [Version 5.1.2600.1106, R1507], [Visibility=1000]

MPS Uniprocessor PC [Version 5.1.2600.1106, R1507], [Visibility=1000]
Netmeeting [Version 5.1.2600.1106, R1507], [Visibility=200]

Network Performance Counters [Version 5.1.2600, R620], [Visibility=200]
Performance Counter Configuration [Version 5.1.2600, R620], [Visibility=1000]

Performance Logs and Alerts Service [Version 5.1.2600.1106,

Click to expand...

R1507],
[Visibility=200]

Performance Monitor [Version 5.1.2600.1106, R1507], [Visibility=1000]
Simple Network Management Protocol (SNMP) [Version 5.1.2600.1106, R1507], [Visibility=1000]

Simple Network Management Protocol (SNMP) - Hotfix Q314147

Click to expand...

[Version
5.1.2600.28.1, R622], [Visibility=1000]

SNMP Event Translator [Version 5.1.2600, R620], [Visibility=1000]

Software Installation Group Policy Extension [Version

Click to expand...

5.1.2600.1106,
R1507], [Visibility=1000]

Software Installation Group Policy MMC Snap-In [Version

Click to expand...

5.1.2600.1106, R1507], [Visibility=1000]

System Restore Core [Version 5.1.2600.1106, R1507], [Visibility=1000]

Terminal Services Core [Version 5.1.2600.1106, R1507], [Visibility=200]
Volume Shadow Copy Service [Version 5.1.2600.1106, R1507], [Visibility=1000]

Windows Backup Utility [Version 5.1.2600, R620], [Visibility=50]
Windows CE USB Serial Host Driver [Version 5.1.2600, R620], [Visibility=200]
Windows Image Acquisition Core [Version 5.1.2600.1106, R1507], [Visibility=200]

WMI Core [Version 5.1.2600.1106, R1507], [Visibility=1000]

Some information for you about the EventLog: http://www.codeguru.com/Cpp/Cpp/cpp_managed/threads/article.php/c8895/
And MDSN, of course.

KM

Hi KM,

Thanks for the information you provided. I checked the components

Click to expand...

that
are

listed and I have them in my image except 3, Net Meeting , message Queuing
and windows backup utility.

I also compared the Event log\Application branch of the registry with

Click to expand...

XP
Pro

and found except few application entries they match.( The application
entries like NERO, SQLServer etc. are not needed in image and are

Click to expand...

not
in)

I had also tried to load Event log\Application registry key from XP Pro to
the image registry but it still reported errors in event log (shotgun
approach).

One question I have is the Event ID 6009, 6006, 6005 which are

Click to expand...

recorded
in

Application Log on XPe Image, but the same entries are recorded in System
Log on XP Pro (of course without any errors). Why is this different ?

I am also suspecting that one or more DLL which event log uses is not
getting registered.

Is there any tool or command to find out what DLL are registered then

Click to expand...

I
can

compare it among image and XP Pro installation.

I really appreciate all the help you are providing for this problem.

Regards,

Jay.
Jay,

Then you would probably want to debug it more deeply.
Go to [HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application]

Click to expand...

key
on

your target and compare its content to the same key
content on XP Pro. You will see all the different applications that are
registered in app log.

The following components listed from XPe database that have some Dll's
registration for the Eventlog\Application branch:

Base Performance Counters [Version 5.1.2600, R620], [Visibility=200]
Device Update Agent [Version 5.1.2600.1106, R1507],
[Visibility=1000]
Disk Performance Counters [Version 5.1.2600, R620],
[Visibility=1000]
Event Log [Version 5.1.2600, R620], [Visibility=1000]
Event Log [Version 5.1.2600.1106, R1507], [Visibility=1000]
Folder Redirection Group Policy Extension [Version 5.1.2600.1106,
R1507], [Visibility=1000]
Folder Redirection Group Policy Extension [Version 5.1.2600, R620],
[Visibility=1000]
Group Policy Client Core [Version 5.1.2600, R620], [Visibility=200]
IIS Core Libraries [Version 5.1.2600.1106, R1507], [Visibility=200]
IIS Core Libraries [Version 5.1.2600, R620], [Visibility=200]
IIS Core Libraries - Hotfix Q319733 [Version 5.1.2600.41.1, R624],
[Visibility=200]
IIS FTP Server [Version 5.1.2600, R620], [Visibility=1000]
IIS FTP Server [Version 5.1.2600.1106, R1507], [Visibility=1000]
IIS FTP Server - Hotfix Q319733 [Version 5.1.2600.41.1, R625],
[Visibility=1000]
IIS Web Server [Version 5.1.2600.1106, R1507], [Visibility=1000]
IIS Web Server [Version 5.1.2600, R620], [Visibility=1000]
IIS Web Server - Hotfix Q275657 [Version 5.1.2600, R641],
[Visibility=1000]
IIS Web Server - Hotfix Q319733 [Version 5.1.2600.41.1, R649],
[Visibility=1000]
Message Queuing (MSMQ) Core [Version 5.1.2600, R620],
[Visibility=1000]
Message Queuing (MSMQ) Core [Version 5.1.2600.1106, R1507],
[Visibility=1000]
Message Queuing (MSMQ) Trigger Service [Version 5.1.2600.1106,
R1507], [Visibility=1000]
Message Queuing (MSMQ) Trigger Service [Version 5.1.2600, R620],
[Visibility=1000]
Netmeeting [Version 5.1.2600.1106, R1507], [Visibility=200]
Netmeeting [Version 5.1.2600, R620], [Visibility=200]
Network Performance Counters [Version 5.1.2600, R620],
[Visibility=200]
Performance Counter Configuration [Version 5.1.2600, R620],
[Visibility=1000]
Performance Logs and Alerts Service [Version 5.1.2600, R620],
[Visibility=200]
Performance Logs and Alerts Service [Version 5.1.2600.1106, R1507],
[Visibility=200]
Performance Monitor [Version 5.1.2600, R620], [Visibility=1000]
Performance Monitor [Version 5.1.2600.1106, R1507],
[Visibility=1000]
SNMP Event Translator [Version 5.1.2600, R620], [Visibility=1000]
Software Installation Group Policy Extension [Version 5.1.2600,
R620], [Visibility=1000]
Software Installation Group Policy Extension [Version 5.1.2600.1106,
R1507], [Visibility=1000]
Software Installation Group Policy MMC Snap-In [Version
5.1.2600.1106, R1507], [Visibility=1000]
Software Installation Group Policy MMC Snap-In [Version 5.1.2600,
R620], [Visibility=1000]
Windows Backup Utility [Version 5.1.2600, R620], [Visibility=50]
WMI Core [Version 5.1.2600, R620], [Visibility=1000]
WMI Core [Version 5.1.2600.1106, R1507], [Visibility=1000]

Try to include one-by-one (probalby leaving out or for the last some
obviously heavy components like IIS, WMI).
Don't bother to search for components with old revisions (listed

Click to expand...

twice
in

the list above). Just include the components and it will
promise to use the latest ones.

--
Regards,
KM, BSquare Corp.

Hi KM,

Yes I did.

Regards,

Jay
Jay,

Did you include "Group Policy Client Core" component?

--
Regards,
KM, BSquare Corp.

Hi KM,

Your suggestion to include "Software Installation Group Policy
Extension"
in the image fixed Eventlog ID 6006 problem but still I have event
ID
6005
and 6009 which are also exhibiting same problem the detail follows
"
The description for Event ID ( 6009 ) in Source ( EventLog ) cannot
be
found. The local computer may not have the necessary registry
information or
message DLL files to display messages from a remote computer. You
may be
able to use the /AUXSOURCE= flag to retrieve this description; see
Help
and
Support for details. The following information is part of the event:
5.01.,
2600, , Multiprocessor Free.

The description for Event ID ( 6005 ) in Source ( EventLog ) cannot
be
found. The local computer may not have the necessary registry
information or
message DLL files to display messages from a remote computer. You
may be
able to use the /AUXSOURCE= flag to retrieve this description; see
Help
and
Support for details. The following information is part of the event:
.
"

Any thoughts ?

Thanks

Jay
Jay,

Just in case, make sure that "Software Installation Group Policy
Extension" component is also included.

--
Regards,
KM, BSquare Corp.

Hi KM,

I already have drvmain.sdb under AppPatch directory. I

Click to expand...

will
try

Q824704.

Thanks for your help.

Regards,

Jay
Jay,

Either install Q824704 (it will bring the necessary

Click to expand...

hotfix
to

"Application
Compatibility Core" component):

Click to expand...

http://www.microsoft.com/downloads/...e7-a2d9-4e75-b6ba-9570653f0891&DisplayLang=en

Or add drvmain.sdb file from XPe Repository to your image
under
\Windows\AppPatch on target:

Click to expand...

http://groups-beta.google.com/group...rvmain.sdb&qt_g=1&searchnow=Search+this+group

--
Regards,
KM, BSquare Corp.

Hi,

I am getting following error in Application event log

"The description for Event ID ( 6006 ) in Source (
EventLog )
cannot
be
found. The local computer may not have the necessary
registry
information or
message DLL files to display messages from a remote
computer.
You
may be
able to use the /AUXSOURCE= flag to retrieve this
description;
see
Help
and
Support for details. The following information is part of
the
event:
. "

Any clue what registry Entry/DLL could be missing??

The image had clean dependency check and build had no
errors.

Thanks

Jay

Click to expand...

Click to expand...

KM · Jan 31, 2005

Jay,

I checked one of the XPProEmulation images I have created locally and the events you are interested in were reported there only in
Application log.
Keep in mind that XPProEmulation image virtually included all the software components from XPe SP1 database.

--
Regards,
KM, BSquare Corp.

KM said:
Hi KM,

Thanks for the info.

Can you check to see on working image that you have( preferably SP1
based if you have one)
event log ID entries 6006, 6005, 6009 are reported on System log or
application log ?

Thanks,

Jay

KM said:

Jay,

One thing I am wondering is that these events should be recorded by Eventlog
in systems log yet I see them with the error message in Application log. On
XP Pro these messages are in System log. Does it mean that Eventlog service
had problem reporting this events and reported as application error

Click to expand...

messages ?

Most likely. (Although to be 100% sure I must see the Dll's source code which is unlilely possible )

I had also copied all registry entry from relating to Eventlog (under
HKLM\CurrentControlset\Services) from working XP Pro to my image and still
got same errors which leads me to believe that one or more DLL may not be
registered or missing. Dependency check and build is clean so missing dll
is less likely than registering dll.

I also checked my FBA log and found following entries which gives errors

"" [FBARegQueue: DllInstall] C:\CNAE_XP\WINDOWS\System32\eventcls.dll
(Error: 0x8000ffff)
11:00:12 AM - [FBARegQueue: DllInstall]
C:\CNAE_XP\WINDOWS\System32\swprv.dll (Error: 0x8000ffff) ""

Click to expand...

These Dlls belong to "Volume Shadow Copy Service" - you've already go this component in your image.
Could you also check if "COM+ Services" is in your configuration? ANd if

Click to expand...

the COM+ service is running fine at run time?

Btw, regarding these errors Microsoft input was : "These two errors are

Click to expand...

benign and can be ignored- they are att-empting to

register the dlls before another component has been installe-d. They get

Click to expand...

registered later successfully. "

http://groups-beta.google.com/group/microsoft.public.windowsxp.embedded/msg/f6a1c82cba279855

They don't mean much beside the fact that there is a "Catastrophic

Click to expand...

failure" with those components (Dlls). The error description

(E_UNEXPECTED) is useless to us now :-(

KM

Jay,

Previously I just showed you the list of components that are registered in
Application log.
Since you saw the messages in System log too it would make sense to check
all the components that are registered as Eventlog
sources:

Auditing Resource DLLs [Version 5.1.2600, R620], [Visibility=200]
Base Performance Counters [Version 5.1.2600, R620], [Visibility=200]

CompactPCI Hot Swap Support [Version 5.1.2600.1106, R1507],
[Visibility=1000]
Device Update Agent [Version 5.1.2600.1106, R1507],
[Visibility=1000]
Disk Management Basic Volume Runtime [Version 5.1.2600, R620],
[Visibility=1000]
Disk Management Dynamic Volume Runtime [Version 5.1.2600, R620],
[Visibility=1000]
Disk Management Services [Version 5.1.2600, R620], [Visibility=200]
Disk Performance Counters [Version 5.1.2600, R620],
[Visibility=1000]
El Torito CD [Version 5.1.2600.1106, R1507], [Visibility=1000]

Event Log [Version 5.1.2600.1106, R1507], [Visibility=1000]

First Boot Agent (FBA) [Version 5.1.2600.1106, R1507],
[Visibility=200]
Folder Redirection Group Policy Extension [Version 5.1.2600.1106,
R1507], [Visibility=1000]

Group Policy Client Core [Version 5.1.2600, R620], [Visibility=200]
IIS Common Libraries [Version 5.1.2600.1106, R1507],
[Visibility=200]

IIS Core Libraries [Version 5.1.2600.1106, R1507], [Visibility=200]

IIS Core Libraries - Hotfix Q319733 [Version 5.1.2600.41.1, R624],
[Visibility=200]
IIS FTP Server [Version 5.1.2600.1106, R1507], [Visibility=1000]

IIS FTP Server - Hotfix Q319733 [Version 5.1.2600.41.1, R625],
[Visibility=1000]
IIS Web Server [Version 5.1.2600.1106, R1507], [Visibility=1000]

IIS Web Server - Hotfix Q319733 [Version 5.1.2600.41.1, R649],
[Visibility=1000]
Intel Microcode Update Driver [Version 5.1.2600, R620],
[Visibility=200]
Internet Authentication Service (IAS) and Remote Access Common Files
[Version 5.1.2600, R620], [Visibility=200]

Local Security Authority Subsystem (LSASS) [Version 5.1.2600.1106,
R1507], [Visibility=200]

Message Queuing (MSMQ) Core [Version 5.1.2600.1106, R1507],
[Visibility=1000]
Message Queuing (MSMQ) Trigger Service [Version 5.1.2600.1106,
R1507], [Visibility=1000]

MPS Multiprocessor PC [Version 5.1.2600.1106, R1507],
[Visibility=1000]

MPS Uniprocessor PC [Version 5.1.2600.1106, R1507],
[Visibility=1000]
Netmeeting [Version 5.1.2600.1106, R1507], [Visibility=200]

Network Performance Counters [Version 5.1.2600, R620],
[Visibility=200]
Performance Counter Configuration [Version 5.1.2600, R620],
[Visibility=1000]

Performance Logs and Alerts Service [Version 5.1.2600.1106, R1507],
[Visibility=200]

Performance Monitor [Version 5.1.2600.1106, R1507],
[Visibility=1000]
Simple Network Management Protocol (SNMP) [Version 5.1.2600.1106,
R1507], [Visibility=1000]

Simple Network Management Protocol (SNMP) - Hotfix Q314147 [Version
5.1.2600.28.1, R622], [Visibility=1000]
SNMP Event Translator [Version 5.1.2600, R620], [Visibility=1000]

Software Installation Group Policy Extension [Version 5.1.2600.1106,
R1507], [Visibility=1000]
Software Installation Group Policy MMC Snap-In [Version
5.1.2600.1106, R1507], [Visibility=1000]

System Restore Core [Version 5.1.2600.1106, R1507],
[Visibility=1000]

Terminal Services Core [Version 5.1.2600.1106, R1507],
[Visibility=200]
Volume Shadow Copy Service [Version 5.1.2600.1106, R1507],
[Visibility=1000]

Windows Backup Utility [Version 5.1.2600, R620], [Visibility=50]
Windows CE USB Serial Host Driver [Version 5.1.2600, R620],
[Visibility=200]
Windows Image Acquisition Core [Version 5.1.2600.1106, R1507],
[Visibility=200]

WMI Core [Version 5.1.2600.1106, R1507], [Visibility=1000]

Some information for you about the EventLog:
http://www.codeguru.com/Cpp/Cpp/cpp_managed/threads/article.php/c8895/
And MDSN, of course.

KM

Hi KM,

Thanks for the information you provided. I checked the components that
are
listed and I have them in my image except 3, Net Meeting , message
Queuing
and windows backup utility.

I also compared the Event log\Application branch of the registry with XP
Pro
and found except few application entries they match.( The application
entries like NERO, SQLServer etc. are not needed in image and are not
in)
I had also tried to load Event log\Application registry key from XP
Pro to
the image registry but it still reported errors in event log (shotgun
approach).

One question I have is the Event ID 6009, 6006, 6005 which are recorded
in
Application Log on XPe Image, but the same entries are recorded in
System
Log on XP Pro (of course without any errors). Why is this different ?

I am also suspecting that one or more DLL which event log uses is not
getting registered.

Is there any tool or command to find out what DLL are registered then I
can
compare it among image and XP Pro installation.

I really appreciate all the help you are providing for this problem.

Regards,

Jay.
Jay,

Then you would probably want to debug it more deeply.
Go to [HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application] key
on
your target and compare its content to the same key
content on XP Pro. You will see all the different applications that are
registered in app log.

The following components listed from XPe database that have some Dll's
registration for the Eventlog\Application branch:

Base Performance Counters [Version 5.1.2600, R620],
[Visibility=200]
Device Update Agent [Version 5.1.2600.1106, R1507],
[Visibility=1000]
Disk Performance Counters [Version 5.1.2600, R620],
[Visibility=1000]
Event Log [Version 5.1.2600, R620], [Visibility=1000]
Event Log [Version 5.1.2600.1106, R1507], [Visibility=1000]
Folder Redirection Group Policy Extension [Version 5.1.2600.1106,
R1507], [Visibility=1000]
Folder Redirection Group Policy Extension [Version 5.1.2600,
R620],
[Visibility=1000]
Group Policy Client Core [Version 5.1.2600, R620],
[Visibility=200]
IIS Core Libraries [Version 5.1.2600.1106, R1507],
[Visibility=200]
IIS Core Libraries [Version 5.1.2600, R620], [Visibility=200]
IIS Core Libraries - Hotfix Q319733 [Version 5.1.2600.41.1,
R624],
[Visibility=200]
IIS FTP Server [Version 5.1.2600, R620], [Visibility=1000]
IIS FTP Server [Version 5.1.2600.1106, R1507], [Visibility=1000]
IIS FTP Server - Hotfix Q319733 [Version 5.1.2600.41.1, R625],
[Visibility=1000]
IIS Web Server [Version 5.1.2600.1106, R1507], [Visibility=1000]
IIS Web Server [Version 5.1.2600, R620], [Visibility=1000]
IIS Web Server - Hotfix Q275657 [Version 5.1.2600, R641],
[Visibility=1000]
IIS Web Server - Hotfix Q319733 [Version 5.1.2600.41.1, R649],
[Visibility=1000]
Message Queuing (MSMQ) Core [Version 5.1.2600, R620],
[Visibility=1000]
Message Queuing (MSMQ) Core [Version 5.1.2600.1106, R1507],
[Visibility=1000]
Message Queuing (MSMQ) Trigger Service [Version 5.1.2600.1106,
R1507], [Visibility=1000]
Message Queuing (MSMQ) Trigger Service [Version 5.1.2600, R620],
[Visibility=1000]
Netmeeting [Version 5.1.2600.1106, R1507], [Visibility=200]
Netmeeting [Version 5.1.2600, R620], [Visibility=200]
Network Performance Counters [Version 5.1.2600, R620],
[Visibility=200]
Performance Counter Configuration [Version 5.1.2600, R620],
[Visibility=1000]
Performance Logs and Alerts Service [Version 5.1.2600, R620],
[Visibility=200]
Performance Logs and Alerts Service [Version 5.1.2600.1106,
R1507],
[Visibility=200]
Performance Monitor [Version 5.1.2600, R620], [Visibility=1000]
Performance Monitor [Version 5.1.2600.1106, R1507],
[Visibility=1000]
SNMP Event Translator [Version 5.1.2600, R620], [Visibility=1000]
Software Installation Group Policy Extension [Version 5.1.2600,
R620], [Visibility=1000]
Software Installation Group Policy Extension [Version
5.1.2600.1106,
R1507], [Visibility=1000]
Software Installation Group Policy MMC Snap-In [Version
5.1.2600.1106, R1507], [Visibility=1000]
Software Installation Group Policy MMC Snap-In [Version 5.1.2600,
R620], [Visibility=1000]
Windows Backup Utility [Version 5.1.2600, R620], [Visibility=50]
WMI Core [Version 5.1.2600, R620], [Visibility=1000]
WMI Core [Version 5.1.2600.1106, R1507], [Visibility=1000]

Try to include one-by-one (probalby leaving out or for the last some
obviously heavy components like IIS, WMI).
Don't bother to search for components with old revisions (listed twice
in
the list above). Just include the components and it will
promise to use the latest ones.

--
Regards,
KM, BSquare Corp.

Hi KM,

Yes I did.

Regards,

Jay
Jay,

Did you include "Group Policy Client Core" component?

--
Regards,
KM, BSquare Corp.

Hi KM,

Your suggestion to include "Software Installation Group Policy
Extension"
in the image fixed Eventlog ID 6006 problem but still I have
event
ID
6005
and 6009 which are also exhibiting same problem the detail
follows
"
The description for Event ID ( 6009 ) in Source ( EventLog )
cannot
be
found. The local computer may not have the necessary registry
information or
message DLL files to display messages from a remote computer. You
may be
able to use the /AUXSOURCE= flag to retrieve this description;
see
Help
and
Support for details. The following information is part of the
event:
5.01.,
2600, , Multiprocessor Free.

The description for Event ID ( 6005 ) in Source ( EventLog )
cannot
be
found. The local computer may not have the necessary registry
information or
message DLL files to display messages from a remote computer. You
may be
able to use the /AUXSOURCE= flag to retrieve this description;
see
Help
and
Support for details. The following information is part of the
event:
.
"

Any thoughts ?

Thanks

Jay
Jay,

Just in case, make sure that "Software Installation Group
Policy
Extension" component is also included.

--
Regards,
KM, BSquare Corp.

Hi KM,

I already have drvmain.sdb under AppPatch directory. I will
try
Q824704.

Thanks for your help.

Regards,

Jay
Jay,

Either install Q824704 (it will bring the necessary hotfix
to
"Application
Compatibility Core" component):

http://www.microsoft.com/downloads/...e7-a2d9-4e75-b6ba-9570653f0891&DisplayLang=en

Or add drvmain.sdb file from XPe Repository to your image
under
\Windows\AppPatch on target:

Click to expand...

Click to expand...

http://groups-beta.google.com/group...rvmain.sdb&qt_g=1&searchnow=Search+this+group

Jay · Jan 31, 2005

Hi KM,

Thanks for the information I will let you know if I make any progress on
this problem.

Thanks for all your help and information you provided.

Regards,

Jay

KM said:
Jay,

I checked one of the XPProEmulation images I have created locally and the

events you are interested in were reported there only in

Application log.
Keep in mind that XPProEmulation image virtually included all the software

components from XPe SP1 database.

KM said:
--
Regards,
KM, BSquare Corp.

Hi KM,

Thanks for the info.

Can you check to see on working image that you have( preferably SP1
based if you have one)
event log ID entries 6006, 6005, 6009 are reported on System log or
application log ?

Thanks,

Jay

KM said:

Jay,

One thing I am wondering is that these events should be recorded by Eventlog
in systems log yet I see them with the error message in Application

Click to expand...

log.
On

XP Pro these messages are in System log. Does it mean that Eventlog service
had problem reporting this events and reported as application error messages ?

Most likely. (Although to be 100% sure I must see the Dll's source

Click to expand...

code
which is unlilely possible )

I had also copied all registry entry from relating to Eventlog (under
HKLM\CurrentControlset\Services) from working XP Pro to my image and still
got same errors which leads me to believe that one or more DLL may

Click to expand...

not
be

registered or missing. Dependency check and build is clean so

Click to expand...

missing
dll

is less likely than registering dll.

I also checked my FBA log and found following entries which gives errors

"" [FBARegQueue: DllInstall] C:\CNAE_XP\WINDOWS\System32\eventcls.dll
(Error: 0x8000ffff)
11:00:12 AM - [FBARegQueue: DllInstall]
C:\CNAE_XP\WINDOWS\System32\swprv.dll (Error: 0x8000ffff) ""

These Dlls belong to "Volume Shadow Copy Service" - you've already go

Click to expand...

this
component in your image.

Could you also check if "COM+ Services" is in your configuration? ANd

Click to expand...

if
the COM+ service is running fine at run time?

Btw, regarding these errors Microsoft input was : "These two errors

Click to expand...

are
benign and can be ignored- they are att-empting to

register the dlls before another component has been installe-d. They

Click to expand...

get
registered later successfully. " http://groups-beta.google.com/group/microsoft.public.windowsxp.embedded/msg/f6a1c82cba279855

Any Idea what these errors mean ( what is Dll Install) ? and what is
missing in configuration?

They don't mean much beside the fact that there is a "Catastrophic

Click to expand...

failure" with those components (Dlls). The error description

(E_UNEXPECTED) is useless to us now :-(

KM

Jay,

Previously I just showed you the list of components that are

Click to expand...

registered
in

Application log.
Since you saw the messages in System log too it would make sense to check
all the components that are registered as Eventlog
sources:

Auditing Resource DLLs [Version 5.1.2600, R620], [Visibility=200]
Base Performance Counters [Version 5.1.2600, R620], [Visibility=200]

CompactPCI Hot Swap Support [Version 5.1.2600.1106, R1507],
[Visibility=1000]
Device Update Agent [Version 5.1.2600.1106, R1507],
[Visibility=1000]
Disk Management Basic Volume Runtime [Version 5.1.2600, R620],
[Visibility=1000]
Disk Management Dynamic Volume Runtime [Version 5.1.2600, R620],
[Visibility=1000]
Disk Management Services [Version 5.1.2600, R620], [Visibility=200]
Disk Performance Counters [Version 5.1.2600, R620],
[Visibility=1000]
El Torito CD [Version 5.1.2600.1106, R1507], [Visibility=1000]

Event Log [Version 5.1.2600.1106, R1507], [Visibility=1000]

First Boot Agent (FBA) [Version 5.1.2600.1106, R1507],
[Visibility=200]
Folder Redirection Group Policy Extension [Version 5.1.2600.1106,
R1507], [Visibility=1000]

Group Policy Client Core [Version 5.1.2600, R620], [Visibility=200]
IIS Common Libraries [Version 5.1.2600.1106, R1507],
[Visibility=200]

IIS Core Libraries [Version 5.1.2600.1106, R1507], [Visibility=200]

IIS Core Libraries - Hotfix Q319733 [Version 5.1.2600.41.1, R624],
[Visibility=200]
IIS FTP Server [Version 5.1.2600.1106, R1507], [Visibility=1000]

IIS FTP Server - Hotfix Q319733 [Version 5.1.2600.41.1, R625],
[Visibility=1000]
IIS Web Server [Version 5.1.2600.1106, R1507], [Visibility=1000]

IIS Web Server - Hotfix Q319733 [Version 5.1.2600.41.1, R649],
[Visibility=1000]
Intel Microcode Update Driver [Version 5.1.2600, R620],
[Visibility=200]
Internet Authentication Service (IAS) and Remote Access

Click to expand...

Common
Files

[Version 5.1.2600, R620], [Visibility=200]

Local Security Authority Subsystem (LSASS) [Version 5.1.2600.1106,
R1507], [Visibility=200]

Message Queuing (MSMQ) Core [Version 5.1.2600.1106, R1507],
[Visibility=1000]
Message Queuing (MSMQ) Trigger Service [Version 5.1.2600.1106,
R1507], [Visibility=1000]

MPS Multiprocessor PC [Version 5.1.2600.1106, R1507],
[Visibility=1000]

MPS Uniprocessor PC [Version 5.1.2600.1106, R1507],
[Visibility=1000]
Netmeeting [Version 5.1.2600.1106, R1507], [Visibility=200]

Network Performance Counters [Version 5.1.2600, R620],
[Visibility=200]
Performance Counter Configuration [Version 5.1.2600, R620],
[Visibility=1000]

Performance Logs and Alerts Service [Version 5.1.2600.1106, R1507],
[Visibility=200]

Performance Monitor [Version 5.1.2600.1106, R1507],
[Visibility=1000]
Simple Network Management Protocol (SNMP) [Version 5.1.2600.1106,
R1507], [Visibility=1000]

Simple Network Management Protocol (SNMP) - Hotfix Q314147 [Version
5.1.2600.28.1, R622], [Visibility=1000]
SNMP Event Translator [Version 5.1.2600, R620], [Visibility=1000]

Software Installation Group Policy Extension [Version 5.1.2600.1106,
R1507], [Visibility=1000]
Software Installation Group Policy MMC Snap-In [Version
5.1.2600.1106, R1507], [Visibility=1000]

System Restore Core [Version 5.1.2600.1106, R1507],
[Visibility=1000]

Terminal Services Core [Version 5.1.2600.1106, R1507],
[Visibility=200]
Volume Shadow Copy Service [Version 5.1.2600.1106, R1507],
[Visibility=1000]

Windows Backup Utility [Version 5.1.2600, R620], [Visibility=50]
Windows CE USB Serial Host Driver [Version 5.1.2600, R620],
[Visibility=200]
Windows Image Acquisition Core [Version 5.1.2600.1106, R1507],
[Visibility=200]

WMI Core [Version 5.1.2600.1106, R1507], [Visibility=1000]

Some information for you about the EventLog:
http://www.codeguru.com/Cpp/Cpp/cpp_managed/threads/article.php/c8895/
And MDSN, of course.

KM

Hi KM,

Thanks for the information you provided. I checked the components that
are
listed and I have them in my image except 3, Net Meeting , message
Queuing
and windows backup utility.

I also compared the Event log\Application branch of the registry

Click to expand...

with
XP

Pro
and found except few application entries they match.( The application
entries like NERO, SQLServer etc. are not needed in image and

Click to expand...

are
not

in)
I had also tried to load Event log\Application registry key from XP
Pro to
the image registry but it still reported errors in event log (shotgun
approach).

One question I have is the Event ID 6009, 6006, 6005 which are recorded
in
Application Log on XPe Image, but the same entries are recorded in
System
Log on XP Pro (of course without any errors). Why is this

Click to expand...

different
?

I am also suspecting that one or more DLL which event log uses

Click to expand...

is
not

getting registered.

Is there any tool or command to find out what DLL are registered

Click to expand...

then
I

can
compare it among image and XP Pro installation.

I really appreciate all the help you are providing for this problem.

Regards,

Jay.
Jay,

Then you would probably want to debug it more deeply.
Go to

Click to expand...

[HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application]
key

on
your target and compare its content to the same key
content on XP Pro. You will see all the different applications

Click to expand...

that
are

registered in app log.

The following components listed from XPe database that have some Dll's
registration for the Eventlog\Application branch:

Base Performance Counters [Version 5.1.2600, R620],
[Visibility=200]
Device Update Agent [Version 5.1.2600.1106, R1507],
[Visibility=1000]
Disk Performance Counters [Version 5.1.2600, R620],
[Visibility=1000]
Event Log [Version 5.1.2600, R620], [Visibility=1000]
Event Log [Version 5.1.2600.1106, R1507], [Visibility=1000]
Folder Redirection Group Policy Extension [Version 5.1.2600.1106,
R1507], [Visibility=1000]
Folder Redirection Group Policy Extension [Version 5.1.2600,
R620],
[Visibility=1000]
Group Policy Client Core [Version 5.1.2600, R620],
[Visibility=200]
IIS Core Libraries [Version 5.1.2600.1106, R1507],
[Visibility=200]
IIS Core Libraries [Version 5.1.2600, R620], [Visibility=200]
IIS Core Libraries - Hotfix Q319733 [Version 5.1.2600.41.1,
R624],
[Visibility=200]
IIS FTP Server [Version 5.1.2600, R620], [Visibility=1000]
IIS FTP Server [Version 5.1.2600.1106, R1507], [Visibility=1000]
IIS FTP Server - Hotfix Q319733 [Version 5.1.2600.41.1, R625],
[Visibility=1000]
IIS Web Server [Version 5.1.2600.1106, R1507], [Visibility=1000]
IIS Web Server [Version 5.1.2600, R620], [Visibility=1000]
IIS Web Server - Hotfix Q275657 [Version 5.1.2600, R641],
[Visibility=1000]
IIS Web Server - Hotfix Q319733 [Version 5.1.2600.41.1, R649],
[Visibility=1000]
Message Queuing (MSMQ) Core [Version 5.1.2600, R620],
[Visibility=1000]
Message Queuing (MSMQ) Core [Version 5.1.2600.1106, R1507],
[Visibility=1000]
Message Queuing (MSMQ) Trigger Service [Version 5.1.2600.1106,
R1507], [Visibility=1000]
Message Queuing (MSMQ) Trigger Service [Version 5.1.2600, R620],
[Visibility=1000]
Netmeeting [Version 5.1.2600.1106, R1507], [Visibility=200]
Netmeeting [Version 5.1.2600, R620], [Visibility=200]
Network Performance Counters [Version 5.1.2600, R620],
[Visibility=200]
Performance Counter Configuration [Version 5.1.2600, R620],
[Visibility=1000]
Performance Logs and Alerts Service [Version 5.1.2600, R620],
[Visibility=200]
Performance Logs and Alerts Service [Version 5.1.2600.1106,
R1507],
[Visibility=200]
Performance Monitor [Version 5.1.2600, R620], [Visibility=1000]
Performance Monitor [Version 5.1.2600.1106, R1507],
[Visibility=1000]
SNMP Event Translator [Version 5.1.2600, R620], [Visibility=1000]
Software Installation Group Policy Extension [Version 5.1.2600,
R620], [Visibility=1000]
Software Installation Group Policy Extension [Version
5.1.2600.1106,
R1507], [Visibility=1000]
Software Installation Group Policy MMC Snap-In [Version
5.1.2600.1106, R1507], [Visibility=1000]
Software Installation Group Policy MMC Snap-In [Version 5.1.2600,
R620], [Visibility=1000]
Windows Backup Utility [Version 5.1.2600, R620], [Visibility=50]
WMI Core [Version 5.1.2600, R620], [Visibility=1000]
WMI Core [Version 5.1.2600.1106, R1507], [Visibility=1000]

Try to include one-by-one (probalby leaving out or for the last some
obviously heavy components like IIS, WMI).
Don't bother to search for components with old revisions (listed twice
in
the list above). Just include the components and it will
promise to use the latest ones.

--
Regards,
KM, BSquare Corp.

Hi KM,

Yes I did.

Regards,

Jay
Jay,

Did you include "Group Policy Client Core" component?

--
Regards,
KM, BSquare Corp.

Hi KM,

Your suggestion to include "Software Installation Group Policy
Extension"
in the image fixed Eventlog ID 6006 problem but still I have
event
ID
6005
and 6009 which are also exhibiting same problem the detail
follows
"
The description for Event ID ( 6009 ) in Source ( EventLog )
cannot
be
found. The local computer may not have the necessary registry
information or
message DLL files to display messages from a remote

Click to expand...

computer.
You

may be
able to use the /AUXSOURCE= flag to retrieve this description;
see
Help
and
Support for details. The following information is part of the
event:
5.01.,
2600, , Multiprocessor Free.

The description for Event ID ( 6005 ) in Source ( EventLog )
cannot
be
found. The local computer may not have the necessary registry
information or
message DLL files to display messages from a remote

Click to expand...

computer.
You

may be
able to use the /AUXSOURCE= flag to retrieve this description;
see
Help
and
Support for details. The following information is part of the
event:
.
"

Any thoughts ?

Thanks

Jay
Jay,

Just in case, make sure that "Software Installation Group
Policy
Extension" component is also included.

--
Regards,
KM, BSquare Corp.

Hi KM,

I already have drvmain.sdb under AppPatch directory. I will
try
Q824704.

Thanks for your help.

Regards,

Jay
Jay,

Either install Q824704 (it will bring the necessary hotfix
to
"Application
Compatibility Core" component):

Click to expand...

http://www.microsoft.com/downloads/...e7-a2d9-4e75-b6ba-9570653f0891&DisplayLang=en

Or add drvmain.sdb file from XPe Repository to your image
under
\Windows\AppPatch on target:

Click to expand...

Click to expand...

http://groups-beta.google.com/group...rvmain.sdb&qt_g=1&searchnow=Search+this+group

part
of

Click to expand...

Guest · May 25, 2005

I think that if an event is logged and an entry is not found in the system
registry key it defaults to an application error.

see my reply to the post titled " The description for Event ID (...) in
Source (...) cannot be XPE SP2" for a possible reason why the eventlog keys
are not being created correctly for some services

Thanks,
Ed.

Jay said:
Hi KM,

Thanks for the information you provided. I checked the components that are
listed and I have them in my image except 3, Net Meeting , message Queuing
and windows backup utility.

I also compared the Event log\Application branch of the registry with XP Pro
and found except few application entries they match.( The application
entries like NERO, SQLServer etc. are not needed in image and are not in)
I had also tried to load Event log\Application registry key from XP Pro to
the image registry but it still reported errors in event log (shotgun
approach).

One question I have is the Event ID 6009, 6006, 6005 which are recorded in
Application Log on XPe Image, but the same entries are recorded in System
Log on XP Pro (of course without any errors). Why is this different ?

I am also suspecting that one or more DLL which event log uses is not
getting registered.

Is there any tool or command to find out what DLL are registered then I can
compare it among image and XP Pro installation.

I really appreciate all the help you are providing for this problem.

Regards,

Jay.

KM said:

Jay,

Then you would probably want to debug it more deeply.
Go to [HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application] key on

Click to expand...

your target and compare its content to the same key

content on XP Pro. You will see all the different applications that are registered in app log.

The following components listed from XPe database that have some Dll's

Click to expand...

registration for the Eventlog\Application branch:

Base Performance Counters [Version 5.1.2600, R620], [Visibility=200]
Device Update Agent [Version 5.1.2600.1106, R1507], [Visibility=1000]
Disk Performance Counters [Version 5.1.2600, R620], [Visibility=1000]
Event Log [Version 5.1.2600, R620], [Visibility=1000]
Event Log [Version 5.1.2600.1106, R1507], [Visibility=1000]
Folder Redirection Group Policy Extension [Version 5.1.2600.1106, R1507], [Visibility=1000]
Folder Redirection Group Policy Extension [Version 5.1.2600, R620], [Visibility=1000]
Group Policy Client Core [Version 5.1.2600, R620], [Visibility=200]
IIS Core Libraries [Version 5.1.2600.1106, R1507], [Visibility=200]
IIS Core Libraries [Version 5.1.2600, R620], [Visibility=200]
IIS Core Libraries - Hotfix Q319733 [Version 5.1.2600.41.1, R624], [Visibility=200]
IIS FTP Server [Version 5.1.2600, R620], [Visibility=1000]
IIS FTP Server [Version 5.1.2600.1106, R1507], [Visibility=1000]
IIS FTP Server - Hotfix Q319733 [Version 5.1.2600.41.1, R625], [Visibility=1000]
IIS Web Server [Version 5.1.2600.1106, R1507], [Visibility=1000]
IIS Web Server [Version 5.1.2600, R620], [Visibility=1000]
IIS Web Server - Hotfix Q275657 [Version 5.1.2600, R641], [Visibility=1000]
IIS Web Server - Hotfix Q319733 [Version 5.1.2600.41.1, R649], [Visibility=1000]
Message Queuing (MSMQ) Core [Version 5.1.2600, R620], [Visibility=1000]
Message Queuing (MSMQ) Core [Version 5.1.2600.1106, R1507], [Visibility=1000]
Message Queuing (MSMQ) Trigger Service [Version 5.1.2600.1106, R1507], [Visibility=1000]
Message Queuing (MSMQ) Trigger Service [Version 5.1.2600, R620], [Visibility=1000]
Netmeeting [Version 5.1.2600.1106, R1507], [Visibility=200]
Netmeeting [Version 5.1.2600, R620], [Visibility=200]
Network Performance Counters [Version 5.1.2600, R620], [Visibility=200]
Performance Counter Configuration [Version 5.1.2600, R620], [Visibility=1000]
Performance Logs and Alerts Service [Version 5.1.2600, R620], [Visibility=200]
Performance Logs and Alerts Service [Version 5.1.2600.1106, R1507], [Visibility=200]
Performance Monitor [Version 5.1.2600, R620], [Visibility=1000]
Performance Monitor [Version 5.1.2600.1106, R1507], [Visibility=1000]
SNMP Event Translator [Version 5.1.2600, R620], [Visibility=1000]
Software Installation Group Policy Extension [Version 5.1.2600, R620], [Visibility=1000]
Software Installation Group Policy Extension [Version 5.1.2600.1106, R1507], [Visibility=1000]
Software Installation Group Policy MMC Snap-In [Version

Click to expand...

5.1.2600.1106, R1507], [Visibility=1000]

Software Installation Group Policy MMC Snap-In [Version 5.1.2600, R620], [Visibility=1000]
Windows Backup Utility [Version 5.1.2600, R620], [Visibility=50]
WMI Core [Version 5.1.2600, R620], [Visibility=1000]
WMI Core [Version 5.1.2600.1106, R1507], [Visibility=1000]

Try to include one-by-one (probalby leaving out or for the last some

Click to expand...

obviously heavy components like IIS, WMI).

Don't bother to search for components with old revisions (listed twice in

Click to expand...

the list above). Just include the components and it will

promise to use the latest ones.

--
Regards,
KM, BSquare Corp.

http://groups-beta.google.com/group...rvmain.sdb&qt_g=1&searchnow=Search+this+group

Click to expand...

Missing Description Strings in Event Log	5	Aug 12, 2004
Windows XP Embedded Application Event Log Messages	2	Aug 17, 2005
Event ID error message inside application folder	0	Aug 30, 2010
Event IDs	3	Mar 30, 2006
the right way to use event log	1	Apr 26, 2007
Event ID : 1041 - Source : Userenv	2	Mar 14, 2008
XPe problems with "Event Id 1041 (userenv)" error	4	Jul 28, 2008
Event ID 1041 Source Userenv	1	Mar 13, 2009

Application Eventlog Error message

Jay

KM

Jay

KM

Jay

KM

Jay

KM

Jay

KM

Jay

KM

Jay

KM

Jay

Guest

Ask a Question

Similar Threads