Event logs not viewable (or, what is a "Hard Error"?)

[Doug]

I've been encountering a "funny" system error simply called "Hard Error".
The computer needs to be shut down and unplugged from the wall before it
will behave. A search of Microsoft.com for that term yielded not one thing.

Reading general information about error messages, I was told to check the
event logs using the event viewer, but was not able to. Opening the system
event file showed a blank screen, even though the event viewer said there
were 2000 plus events logged. Looking in the directory where the event logs
are stored, I found that SysEvent.Evt file was empty (512kin size), but that
there were several other very large files where events were apparently being
logged. Only trouble is that I am not allowed any access to these files,
even in safe mode, even just to copy them. Neither could I open any of these
files in Event Viewer, because the files were "being used by another
process".

I'm hoping that one of these event logs will tell me what this "hard error"
is, but clearly there's something wrong with this whole logging system on my
machine (or with my understanding, at least).

The presumed log files (large files with recent dates) are called
"system.alt", "system", and "software".

Thanks in advance for any help. I'm stumped...

Doug

 

[Dave Patrick]

You'll need to fix the Event Log system before you can troubleshoot the
other problem(s).

The temporary fix;
You might try changing the file properties to "Overwrite as needed"

Then; Control Panel|Administrative Tools|Services|Event Log Service|General,
set the "Startup Type:" to "Disabled" restart the pc, then delete (or move)
the corrupt *.evt file(s) from %windir%\system32\config then set the Event
Log Service "Startup Type:" back to "Automatic", restart for effect.

The more permanent fix;
http://support.microsoft.com/default.aspx?scid=kb;en-us;829246&Product=win2000

--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect


:
| I've been encountering a "funny" system error simply called "Hard Error".
| The computer needs to be shut down and unplugged from the wall before it
| will behave. A search of Microsoft.com for that term yielded not one
thing.
|
| Reading general information about error messages, I was told to check the
| event logs using the event viewer, but was not able to. Opening the system
| event file showed a blank screen, even though the event viewer said there
| were 2000 plus events logged. Looking in the directory where the event
logs
| are stored, I found that SysEvent.Evt file was empty (512kin size), but
that
| there were several other very large files where events were apparently
being
| logged. Only trouble is that I am not allowed any access to these files,
| even in safe mode, even just to copy them. Neither could I open any of
these
| files in Event Viewer, because the files were "being used by another
| process".
|
| I'm hoping that one of these event logs will tell me what this "hard
error"
| is, but clearly there's something wrong with this whole logging system on
my
| machine (or with my understanding, at least).
|
| The presumed log files (large files with recent dates) are called
| "system.alt", "system", and "software".
|
| Thanks in advance for any help. I'm stumped...
|
| Doug
|
|

 

[Doug]

Thanks, Dave,

Apparently those other files weren't .evt files after all. Even after
disabling the event log service, they were still not accessible. Using your
hints, though, I looked at the properties of the .evt files and saw that
they were limited to a default 512k in size. I changed that to a larger
number, reenabled the event viewer, and now I see the 2000 plus events...

There had been no entries since March 12, though -- that must be when the
log filled up. There are new entries after I made these changes, though, so
I'll simply wait until the next crash, and then hopefully learn what a "hard
error" is...

With appreciation,
Doug

You'll need to fix the Event Log system before you can troubleshoot the
other problem(s).

The temporary fix;
You might try changing the file properties to "Overwrite as needed"

Then; Control Panel|Administrative Tools|Services|Event Log Service|General,
set the "Startup Type:" to "Disabled" restart the pc, then delete (or move)
the corrupt *.evt file(s) from %windir%\system32\config then set the Event
Log Service "Startup Type:" back to "Automatic", restart for effect.

The more permanent fix;
http://support.microsoft.com/default.aspx?scid=kb;en-us;829246&Product=win2000

--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect


:
| I've been encountering a "funny" system error simply called "Hard Error".
| The computer needs to be shut down and unplugged from the wall before it
| will behave. A search of Microsoft.com for that term yielded not one
thing.
|
| Reading general information about error messages, I was told to check the
| event logs using the event viewer, but was not able to. Opening the system
| event file showed a blank screen, even though the event viewer said there
| were 2000 plus events logged. Looking in the directory where the event
logs
| are stored, I found that SysEvent.Evt file was empty (512kin size), but
that
| there were several other very large files where events were apparently
being
| logged. Only trouble is that I am not allowed any access to these files,
| even in safe mode, even just to copy them. Neither could I open any of
these
| files in Event Viewer, because the files were "being used by another
| process".
|
| I'm hoping that one of these event logs will tell me what this "hard
error"
| is, but clearly there's something wrong with this whole logging system on
my
| machine (or with my understanding, at least).
|
| The presumed log files (large files with recent dates) are called
| "system.alt", "system", and "software".
|
| Thanks in advance for any help. I'm stumped...
|
| Doug
|
|

 

[Doug]

Dear Dave and fellow saints,

I've had a few more crashes, and have taken notes. Unfortunately nothing is
being recorded in the event logs, and there was no mini dump recorded. The
error message says "unknown" and I guess it's not kidding.

Details are these: programs start sporadically misbehaving or crashing, and
an error message pops up saying "error loading hotplug.dll" . At the same
moment another error message pops up saying "hard error", or "unknown hard
error" (I forget which ). These two windows, or just the "hard error"
window, immediately reappear if I close them, and eventually the system
freezes or I get a blue screen. The blue screen today said "stop c000021a
unknown hard error".

A search for hotplug.dll yielded three references on the entire Microsoft
web site, none of which applied to Windows 2000. One of the articles
suggested it had to do with hot plugging a raid system. This computer
doesn't have a raid system, but I migrated from a prior system which did use
a HighPoint raid system. I had tried to remove all references to the raid
system in the registry, but a few of them could not be deleted. Perhaps they
are causing a problem?

In the system log, there is one error being reported: Event source-Kbdclass
ID-9 Description: Could not enable interrupts on connected port
device\Device\KeyboardClass0 . Again there is no mention of this particular
error at Microsoft.com .

I haven't identified any particular pattern to the crashes. I have no idea
what "hard error" means, since there is no mention of the term at the
Microsoft web site. (Why do they bother inventing these terms if they have
no definition?). I'm guessing it may refer to a hardware error -- in the
latest crash, I had been working on a Word document for several minutes, but
there was no backup file on the hard drive when I restarted the system. This
suggests that the computer had been unable to write to the hard disk for
some period of time prior to the crash. I also noticed my Dragon
transcription program was working erratically, which again could have been
caused by an inability to write to the hard drive (I have 1 Gig ram, so I
imagine the machine could run for a while in such a state).

Thanks in advance for any thoughts. As you can see, I am pretty well
clueless about the cause of this problem.

I am studying the article "How to troubleshoot a "STOP 0xC000021A" error",
although that blue screen is not a consistent feature in these crashes.
Apparently I will now learn about a program called Dr. Watson... ;-)

Doug

Thanks, Dave,

Apparently those other files weren't .evt files after all. Even after
disabling the event log service, they were still not accessible. Using your
hints, though, I looked at the properties of the .evt files and saw that
they were limited to a default 512k in size. I changed that to a larger
number, reenabled the event viewer, and now I see the 2000 plus events...

There had been no entries since March 12, though -- that must be when the
log filled up. There are new entries after I made these changes, though, so
I'll simply wait until the next crash, and then hopefully learn what a "hard
error" is...

With appreciation,
Doug

You'll need to fix the Event Log system before you can troubleshoot the
other problem(s).

The temporary fix;
You might try changing the file properties to "Overwrite as needed"

Then; Control Panel|Administrative Tools|Services|Event Log Service|General,
set the "Startup Type:" to "Disabled" restart the pc, then delete (or move)
the corrupt *.evt file(s) from %windir%\system32\config then set the Event
Log Service "Startup Type:" back to "Automatic", restart for effect.

The more permanent fix;

http://support.microsoft.com/default.aspx?scid=kb;en-us;829246&Product=win2000

--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect


:
| I've been encountering a "funny" system error simply called "Hard Error".
| The computer needs to be shut down and unplugged from the wall before it
| will behave. A search of Microsoft.com for that term yielded not one
thing.
|
| Reading general information about error messages, I was told to check the
| event logs using the event viewer, but was not able to. Opening the system
| event file showed a blank screen, even though the event viewer said there
| were 2000 plus events logged. Looking in the directory where the event
logs
| are stored, I found that SysEvent.Evt file was empty (512kin size), but
that
| there were several other very large files where events were apparently
being
| logged. Only trouble is that I am not allowed any access to these files,
| even in safe mode, even just to copy them. Neither could I open any of
these
| files in Event Viewer, because the files were "being used by another
| process".
|
| I'm hoping that one of these event logs will tell me what this "hard
error"
| is, but clearly there's something wrong with this whole logging system on
my
| machine (or with my understanding, at least).
|
| The presumed log files (large files with recent dates) are called
| "system.alt", "system", and "software".
|
| Thanks in advance for any help. I'm stumped...
|
| Doug
|
|

 

[Doug]

Progress -

Found a Dr Watson log file with the following error info. Does this shed any
light...?


Application exception occurred:
App: winlogon.exe (pid=196)
When: 5/8/2004 @ 21:35:29.269
Exception number: c0000006 (in page io error)

*----> System Information <----*
Computer Name: LOVE
User Name: SYSTEM
Number of Processors: 1
Processor Type: x86 Family 6 Model 10 Stepping 0
Windows 2000 Version: 5.0
Current Build: 2195
Service Pack: 4
Current Type: Uniprocessor Free
Registered Organization:
Registered Owner: Love

*----> Task List <----*
0 Idle.exe
8 System.exe
152 smss.exe
176 CSRSS.exe
196 WINLOGON.exe
224 SERVICES.exe
236 LSASS.exe
412 svchost.exe
444 spoolsv.exe
472 ccEvtMgr.exe
560 aardvark.exe
576 CDAC11BA.exe
620 gearsec.exe
640 hidserv.exe
688 MPFSER~1.exe
744 NPROTECT.exe
768 nvsvc32.exe
788 regsvc.exe
832 mstask.exe
856 tcpsvcs.exe
880 snmp.exe
940 NOPDB.exe
976 winmgmt.exe
988 MsPMSPSv.exe
1152 MpfTray.exe
360 ccApp.exe
1308 ccApp.exe
1356 point32.exe
1364 FTNohMGR.exe
1380 carpserv.exe
1320 MpfAgent.exe
1404 rundll32.exe
1268 explorer.exe
552 drwtsn32.exe
1292 svchost.exe
0 _Total.exe

<snip>

 

[Dave Patrick]

One of these may help.

http://www.google.com/search?hl=en&q="unknown+hard+error"+site:microsoft.com

--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect


:
| Dear Dave and fellow saints,
|
| I've had a few more crashes, and have taken notes. Unfortunately nothing
is
| being recorded in the event logs, and there was no mini dump recorded. The
| error message says "unknown" and I guess it's not kidding.
|
| Details are these: programs start sporadically misbehaving or crashing,
and
| an error message pops up saying "error loading hotplug.dll" . At the same
| moment another error message pops up saying "hard error", or "unknown hard
| error" (I forget which ). These two windows, or just the "hard error"
| window, immediately reappear if I close them, and eventually the system
| freezes or I get a blue screen. The blue screen today said "stop c000021a
| unknown hard error".
|
| A search for hotplug.dll yielded three references on the entire Microsoft
| web site, none of which applied to Windows 2000. One of the articles
| suggested it had to do with hot plugging a raid system. This computer
| doesn't have a raid system, but I migrated from a prior system which did
use
| a HighPoint raid system. I had tried to remove all references to the raid
| system in the registry, but a few of them could not be deleted. Perhaps
they
| are causing a problem?
|
| In the system log, there is one error being reported: Event
source-Kbdclass
| ID-9 Description: Could not enable interrupts on connected port
| device\Device\KeyboardClass0 . Again there is no mention of this
particular
| error at Microsoft.com .
|
| I haven't identified any particular pattern to the crashes. I have no idea
| what "hard error" means, since there is no mention of the term at the
| Microsoft web site. (Why do they bother inventing these terms if they have
| no definition?). I'm guessing it may refer to a hardware error -- in the
| latest crash, I had been working on a Word document for several minutes,
but
| there was no backup file on the hard drive when I restarted the system.
This
| suggests that the computer had been unable to write to the hard disk for
| some period of time prior to the crash. I also noticed my Dragon
| transcription program was working erratically, which again could have been
| caused by an inability to write to the hard drive (I have 1 Gig ram, so I
| imagine the machine could run for a while in such a state).
|
| Thanks in advance for any thoughts. As you can see, I am pretty well
| clueless about the cause of this problem.
|
| I am studying the article "How to troubleshoot a "STOP 0xC000021A" error",
| although that blue screen is not a consistent feature in these crashes.
| Apparently I will now learn about a program called Dr. Watson... ;-)
|
| Doug

 

[Doug]

Hi Dave,

Thanks for showing me the google search method -- that helps. Unfortunately
no solutions yet.

I read about verifier.exe, and so tried that program. After extensive trial
and error, I found that the file ndis.sys triggered a blue screen on boot up
when I enabled verify for it. However, reading about ndis.sys leads me to
think that it is actually part of the driver verifying system, and so I am
not clear what the significance of this blue screen is -- i.e. whether
ndis.sys is the problem or merely a symptom of the problem . An article at
MS.com said that there was a problem with this file which was fixed with
service pack two. I have service pack four, and my version --
5.0.2195.6655 -- should be OK. I suppose it's possible that this ndis.sys
file is corrupted. It's also possible that I have no idea what I'm doing ;-)
..

I guess I'm getting closer to the point of reformatting and reinstalling,
but this is a very full system, and that would take days to accomplish. Any
suggestions are appreciated....

Doug

One of these may help.

http://www.google.com/search?hl=en&q="unknown+hard+error"+site:microsoft.com

--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect


:
| Dear Dave and fellow saints,
|
| I've had a few more crashes, and have taken notes. Unfortunately nothing
is
| being recorded in the event logs, and there was no mini dump recorded. The
| error message says "unknown" and I guess it's not kidding.
|
| Details are these: programs start sporadically misbehaving or crashing,
and
| an error message pops up saying "error loading hotplug.dll" . At the same
| moment another error message pops up saying "hard error", or "unknown hard
| error" (I forget which ). These two windows, or just the "hard error"
| window, immediately reappear if I close them, and eventually the system
| freezes or I get a blue screen. The blue screen today said "stop c000021a
| unknown hard error".
|
| A search for hotplug.dll yielded three references on the entire Microsoft
| web site, none of which applied to Windows 2000. One of the articles
| suggested it had to do with hot plugging a raid system. This computer
| doesn't have a raid system, but I migrated from a prior system which did
use
| a HighPoint raid system. I had tried to remove all references to the raid
| system in the registry, but a few of them could not be deleted. Perhaps
they
| are causing a problem?
|
| In the system log, there is one error being reported: Event
source-Kbdclass
| ID-9 Description: Could not enable interrupts on connected port
| device\Device\KeyboardClass0 . Again there is no mention of this
particular
| error at Microsoft.com .
|
| I haven't identified any particular pattern to the crashes. I have no idea
| what "hard error" means, since there is no mention of the term at the
| Microsoft web site. (Why do they bother inventing these terms if they have
| no definition?). I'm guessing it may refer to a hardware error -- in the
| latest crash, I had been working on a Word document for several minutes,
but
| there was no backup file on the hard drive when I restarted the system.
This
| suggests that the computer had been unable to write to the hard disk for
| some period of time prior to the crash. I also noticed my Dragon
| transcription program was working erratically, which again could have been
| caused by an inability to write to the hard drive (I have 1 Gig ram, so I
| imagine the machine could run for a while in such a state).
|
| Thanks in advance for any thoughts. As you can see, I am pretty well
| clueless about the cause of this problem.
|
| I am studying the article "How to troubleshoot a "STOP 0xC000021A" error",
| although that blue screen is not a consistent feature in these crashes.
| Apparently I will now learn about a program called Dr. Watson... ;-)
|
| Doug