locked
Application Error 1000 in event log on Windows Server 2008 R2

    Question

  • Hello !

    I currently have a Windows 2008 R2 server installed and about 2/3 times per week I get the following error message showing up on the server's event log:

    Event 1000 Applicaton Error

    Faulting application name: wmiprvse.exe, version: 6.1.7600.16385, time stamp: 0x4a5bc794
    Faulting module name: ole32.dll, version: 6.1.7600.16385, time stamp: 0x4a5be01a
    Exception code: 0xc0000005
    Fault offset: 0x0000000000039389
    Faulting process id: 0x3a1c
    Faulting application start time: 0x01caac4d608522af
    Faulting application path: C:\Windows\system32\wbem\wmiprvse.exe
    Faulting module path: C:\Windows\system32\ole32.dll
    Report Id: 8e0e6945-2022-11df-9c3b-005056a3641d

    I am not sure what is causing this or how to fix it.  I have looked at applying some of the hotfixes suggested in the KB articles below but our server appears to have later versions than the hotfixes suggested:

    http://social.technet.microsoft.com/Forums/en-US/winserverhyperv/thread/9b009617-9c2f-4a50-96f2-3b831ca152a1

    Currently, on this server, the following are installed:

    Microsoft Office Sharepoint Server 2007
    SQL Server 2008
    IIS 7

    I would appreciate any help/suggestions to determine what is causing this type of error and how to fix it.

    Thank you.
    Tuesday, March 02, 2010 2:17 PM

Answers

  • Hi,

     

    The error is an application crash. If you didn’t get any issue, you may ignore that event.

     

    If you want to perform the further research on the event, I would like to suggest that you contact Microsoft Customer Service and Support (CSS) via telephone so that a dedicated Support Professional can assist with your request. Because we find it seems to be application crash issue and we need to analyze the crash dump file to narrow down the root cause of the issue. Unfortunately, it is not effective for us to debug the crash dump file here in the forum.

     

    To obtain the phone numbers for specific technology request please take a look at the web site listed below:

     

    http://support.microsoft.com/default.aspx?scid=fh;EN-US;OfferProPhone#faq607

     

     

    Best Regards,

    Vincent Hu

    Friday, March 05, 2010 9:53 AM

All replies

  • Any luck wit this?  Same issue here on my servers running Windows 2008 R2 Datacenter w/Hyper-V2 R2 & Failover Clustering.  Also installed (naturally) are the OpsMgr Agent and SCVMM agents.  The error:

    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Application Error" />
        <EventID Qualifiers="0">1000</EventID>
        <Level>2</Level>
        <Task>100</Task>
        <Keywords>0x80000000000000</Keywords>
        <TimeCreated SystemTime="2010-03-04T20:02:13.000000000Z" />
        <EventRecordID>12926</EventRecordID>
        <Channel>Application</Channel>
        <Computer>hvhost-e.my.domain.com</Computer>
        <Security />
      </System>
      <EventData>
        <Data>wmiprvse.exe</Data>
        <Data>6.1.7600.16385</Data>
        <Data>4a5bc794</Data>
        <Data>ntdll.dll</Data>
        <Data>6.1.7600.16385</Data>
        <Data>4a5be02b</Data>
        <Data>c0000005</Data>
        <Data>000000000004fa27</Data>
        <Data>a88</Data>
        <Data>01cabaa8ecbf7d05</Data>
        <Data>C:\Windows\system32\wbem\wmiprvse.exe</Data>
        <Data>C:\Windows\SYSTEM32\ntdll.dll</Data>
        <Data>d2674f65-27c8-11df-9144-00215e6fc2c4</Data>
      </EventData>
    </Event>


    James
    Thursday, March 04, 2010 8:35 PM
  • Hi,

     

    The error is an application crash. If you didn’t get any issue, you may ignore that event.

     

    If you want to perform the further research on the event, I would like to suggest that you contact Microsoft Customer Service and Support (CSS) via telephone so that a dedicated Support Professional can assist with your request. Because we find it seems to be application crash issue and we need to analyze the crash dump file to narrow down the root cause of the issue. Unfortunately, it is not effective for us to debug the crash dump file here in the forum.

     

    To obtain the phone numbers for specific technology request please take a look at the web site listed below:

     

    http://support.microsoft.com/default.aspx?scid=fh;EN-US;OfferProPhone#faq607

     

     

    Best Regards,

    Vincent Hu

    Friday, March 05, 2010 9:53 AM
  • Hi,

     

    The error is an application crash. If you didn’t get any issue, you may ignore that event.

     

    ... 

     

    Best Regards,

    Vincent Hu


    SCVMM loses connection to the host server, resulting in all VMs being seen a "missing" or "host not responding".  Also, the WMI namespace for the cluster service disappears & SCOM alerts to this.   I'll contact PSS.
    Cheers,
    James
    Friday, March 05, 2010 8:02 PM
  • Hi James,

    Were you able to find a resolution for this?  We are experiencing the exact same symptoms and have also tried all the patches with no luck.

    Thanks,

    Beth
    EAS
    Tuesday, March 16, 2010 4:41 PM
  • Hi,

     

    The error is an application crash. If you didn’t get any issue, you may ignore that event.

     

     

    ... 

     

    Best Regards,

    Vincent Hu


    SCVMM loses connection to the host server, resulting in all VMs being seen a "missing" or "host not responding".  Also, the WMI namespace for the cluster service disappears & SCOM alerts to this.   I'll contact PSS.
    Cheers,
    James

    Hi James,

    I'm also having the exact same problem.  Did you ever find a resolution?

    Cheers,

    Paul.
    Wednesday, March 17, 2010 10:30 AM
  • Hot Issue... any further technical expertises ? Any Idea?
    Configuration: SCCM 2007 R2 with MDT 2008
    Thursday, March 18, 2010 11:02 AM
  • I am seeing this on several of the newly installed servers with 2008 R2. The error looks like this:

    Faulting application wmiprvse.exe, version 6.1.7600.16385, time stamp 0x4a5bc794, faulting module ole32.dll, version 6.1.7600.16385, time stamp 0x4a5be01a, exception code 0xc0000005, fault offset 0x00000000000204e4,
    process id 0x13f8, application start time 0x01cacc6fa0cbe9d7.

    We have both SCOM and SCCM agents on them. Is there some way to fix this?

    S-E B

     

    Friday, March 26, 2010 12:29 PM
  • I'm seeing the exact same fault across all of our W2008 R2 Hyper-V cluster.  WMI crashes, VMM 2008 R2 hosts go into a warning state, OpsMgr alerts, my boss is on the phone wondering what has died, and eventually it goes away as mysteriously as it first occurred, with the host status going green again.

    Source: Application Error

  • Event ID: 1000
  • Faulting application name: wmiprvse.exe, version: 6.1.7600.16385, time stamp: 0x4a5bc794
    Faulting module name: ole32.dll, version: 6.1.7600.16385, time stamp: 0x4a5be01a
    Exception code: 0xc0000005
    Fault offset: 0x0000000000039389
    Faulting process id: 0x460
    Faulting application start time: 0x01cad6a519c1cecf
    Faulting application path: C:\Windows\system32\wbem\wmiprvse.exe
    Faulting module path: C:\Windows\system32\ole32.dll
    Report Id: 77a5a2c7-46da-11df-b088-0017a477001a

Tuesday, April 13, 2010 9:39 AM
  • I had a problem with wmiprvse.exe crashing on our Windows 2008 R2 servers every now and then. I called Microsoft back in January and they had me increase the memory quota for the process. It worked for a little bit but the memory would continue to climb but the application wouldn't crash. It was only occurring on our Windows 2008 R2 servers that had SQL installed. By dumb luck I found out that if I had SQL Server Management Studio connected the wmiprvse.exe memory would climb and cause it to crash. After that I recontacted Microsoft and reopened my case. They were able to determine the problem and they sent me a test hotfix which fixed the problem of wmiprvse.exe consuming memory and then crashing. They indicated to me a public hotfix should be released at the end of April but I don't know what the KB article number is or will be at this time. Hope this helps.
    Tuesday, April 13, 2010 5:24 PM
  • I am having the exact same issue on all of our SQL servers. Has a KB article been release yet on this? If so, where is the hotfix?

     

    Thanks. -Jim

    Tuesday, April 27, 2010 4:32 PM
  • I haven't tested this, but noticed the following post at Jonathan's Virtual Blog: http://blogs.technet.com/jonjor/archive/2010/04/21/intermittent-connectivity-issues-and-cluster-refresh-times-with-windows-2008-r2-and-scvmm-2008-r2.aspx.  A couple KB's are mentioned:

    •Install on all Windows 2008 R2 systems managed by SCVMM 2008 R2
    The "Win32_Service" WMI class leaks memory in Windows Server 2008 R2 and in Windows 7
    http://support.microsoft.com/kb/981314

    •Install on all Failover Cluster Nodes
    An application or service that queries information about a failover cluster by using the WMI provider may experience low performance or a time-out exception
    http://support.microsoft.com/?id=974930

    I'll give them a test and report back...


    James
    • Proposed as answer by JamesAB Wednesday, April 28, 2010 7:08 PM
    Wednesday, April 28, 2010 7:08 PM
  • I haven't tested this, but noticed the following post at Jonathan's Virtual Blog: http://blogs.technet.com/jonjor/archive/2010/04/21/intermittent-connectivity-issues-and-cluster-refresh-times-with-windows-2008-r2-and-scvmm-2008-r2.aspx .  A couple KB's are mentioned:

    •Install on all Windows 2008 R2 systems managed by SCVMM 2008 R2
    The "Win32_Service" WMI class leaks memory in Windows Server 2008 R2 and in Windows 7
    http://support.microsoft.com/kb/981314

    •Install on all Failover Cluster Nodes
    An application or service that queries information about a failover cluster by using the WMI provider may experience low performance or a time-out exception
    http://support.microsoft.com/?id=974930

    I'll give them a test and report back...


    James

    Hi James,

     

    any news concerning this topic? Did you find the time to test it?

    Would be nice to get more information, as I experience the same behaviour on my machines.

    Friday, June 25, 2010 7:26 AM
  • Hi James,

    any news concerning this topic? Did you find the time to test it?

    Would be nice to get more information, as I experience the same behaviour on my machines.

    I'm installing the two KBs on every Windows 2008 R2 cluster I have.  It hasn't hurt anything, and I've had less WMI crashes.


    James
    Friday, June 25, 2010 5:09 PM
  • hi guys

    I have upgraded SCCM sp2 on windows 2008 sp2 with database connected to a different SQL server 2008. after some days the application error 1000  has been raising in the application event viewer mentioned below

    Log Name:      Application
    Source:        Application Error
    Date:          6/29/2010 1:11:42 PM
    Event ID:      1000
    Task Category: (100)
    Level:         Error0
    Keywords:      Classic
    User:          N/A
    Computer:      INS0003.itil.co.in

    Description:
    Faulting application wmiprvse.exe, version 6.0.6002.18005, time stamp 0x49e01c05, faulting module ntdll.dll, version 6.0.6002.18005, time stamp 0x49e03824, exception code 0xc0000374, fault offset 0x000ab0bf, process id 0x4ec8, application start time 0x01cb175e8318a86b.
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Application Error" />
        <EventID Qualifiers="0">1000</EventID>
        <Level>2</Level>
        <Task>100</Task>
        <Keywords>0x80000000000000</Keywords>
        <TimeCreated SystemTime="2010-06-29T07:41:42.000Z" />
        <EventRecordID>13161</EventRecordID>
        <Channel>Application</Channel>
        <Computer>INS0003.itil.co.in</Computer>
        <Security />
      </System>
      <EventData>
        <Data>wmiprvse.exe</Data>
        <Data>6.0.6002.18005</Data>
        <Data>49e01c05</Data>
        <Data>ntdll.dll</Data>
        <Data>6.0.6002.18005</Data>
        <Data>49e03824</Data>
        <Data>c0000374</Data>
        <Data>000ab0bf</Data>
        <Data>4ec8</Data>
        <Data>01cb175e8318a86b</Data>
      </EventData>
    </Event>

     

    Can anyone tell the solution to resolve this issue.

     

    Thanks in advance

     


    sreejith.ps CCNA, MCITP Exchange Administrator
    Wednesday, June 30, 2010 7:40 AM