none
Event viewer mmc error when filter current log is selected RRS feed

  • Question

  • When using our windows server 2012 R2 Event viewer, if I select a filter current log, I see an MMC.exe error, stating MMC has detected an error in a snap-in and will unload it. If I select ignore error and carry on I then get an "Unhandled exception in Managed Code Snap-in" dialog with Exception Type: System.IO.IOExeception and some stack trace info.

       at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
       at System.IO.FileStream.Init(String path, FileMode mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32 bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath, Boolean bFromProxy, Boolean useLongPath, Boolean checkHost)
       at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share)
       at Microsoft.Windows.ManagementUI.CombinedControls.EventsNode.get_IsReadOnlyView()
       at Microsoft.Windows.ManagementUI.CombinedControls.EventsNode.UpdateReadOnly()
       at Microsoft.Windows.ManagementUI.CombinedControls.EventsNode.InitializeQueryNode(FileInfo fileInfo)
       at Microsoft.Windows.ManagementUI.CombinedControls.EventsNode.AddSubNodes(DirectoryInfo dir, EventNodeType nodeType, Boolean userQuery, String standardViewConfig)
       at Microsoft.Windows.ManagementUI.CombinedControls.EventsNode.AddSavedQueryNodes()
       at Microsoft.Windows.ManagementUI.CombinedControls.EventsNode.CreateChildNodes()
       at Microsoft.Windows.ManagementUI.CombinedControls.TreeComboBox.ProcessEventItems(EventsNode& parent)
       at Microsoft.Windows.ManagementUI.CombinedControls.TreeComboBox.ProcessEventItems(EventsNode& parent)
       at Microsoft.Windows.ManagementUI.CombinedControls.TreeComboBox.InitializeTree()
       at Microsoft.Windows.ManagementUI.CombinedControls.TreeComboBox.Initialize(IntPtr session, Boolean allowManualEdit)
       at Microsoft.Windows.ManagementUI.CombinedControls.QueryFilter.ResetOrInitializeView()
       at Microsoft.Windows.ManagementUI.CombinedControls.QueryFilterDlg.InitializeView(EventsNode rootNode)
       at Microsoft.Windows.ManagementUI.CombinedControls.EventsNode.ExecuteFilterAction()
       at Microsoft.Windows.ManagementUI.CombinedControls.EventsNode.OnAction(ManagementAction action)
       at Microsoft.EventViewer.SnapIn.ViewerRootNode.OnAction(ManagementAction mmcAction)
       at Microsoft.EventViewer.SnapIn.ViewerRootNode.OnAction(Object sender, SyncActionEventArgs e)
       at Microsoft.ManagementConsole.SyncAction.RaiseTriggeredEvent(Object sender, SyncStatus status)
       at Microsoft.ManagementConsole.ScopeNode.DoAction(Int32 actionId, IRequestStatus requestStatus)
       at Microsoft.ManagementConsole.NodeSyncManager.ProcessRequest(NodeRequestInfo info, IRequestStatus requestStatus)
       at Microsoft.ManagementConsole.SnapIn.ProcessRequest(Request request)
       at Microsoft.ManagementConsole.Internal.SnapInClient.Microsoft.ManagementConsole.Internal.IMessageClient.ProcessRequest(Request request)
       at Microsoft.ManagementConsole.Internal.IMessageClient.ProcessRequest(Request request)
       at Microsoft.ManagementConsole.Executive.RequestStatus.BeginRequest(IMessageClient messageClient, RequestInfo requestInfo)
       at Microsoft.ManagementConsole.Executive.SnapInRequestOperation.ProcessRequest()
       at Microsoft.ManagementConsole.Executive.Operation.OnThreadTransfer(SimpleOperationCallback callback)

    It has worked in the past, but at some point it has stopped working, I imagine after an update.

    How can I resolve this ?

    Regards

    Tony

    Tuesday, July 9, 2019 1:42 PM

All replies

  • One or more of the evtx files may be somehow corrupt. You can disable the Windows Event Log service, reboot, then move or delete the EVTX from \Windows\System32\winevt\Logs, then set the Windows Event Log service back to Automatic, reboot.

     

    (please don't forget to mark helpful replies as answer)

     

     



    Regards, Dave Patrick ....
    Microsoft Certified Professional
    Microsoft MVP [Windows Server] Datacenter Management

    Disclaimer: This posting is provided "AS IS" with no warranties or guarantees, and confers no rights.


    Tuesday, July 9, 2019 1:51 PM
  • Hi Dave,

    I've tried that solution out, deleting the 3 main logs (system, security and setup) and it seems to have made no difference. There are a lot of other evtx logfiles. Is it safe to remove all of them ?

    Regards

    Tony

    Wednesday, July 10, 2019 2:24 PM
  • Yes, it isn't a problem other than losing the history.

     

     



    Regards, Dave Patrick ....
    Microsoft Certified Professional
    Microsoft MVP [Windows Server] Datacenter Management

    Disclaimer: This posting is provided "AS IS" with no warranties or guarantees, and confers no rights.

    Wednesday, July 10, 2019 2:27 PM
  • Hi Tony,

    Microsoft has published a document about this, please refer to the following link:

    Event Viewer may close or you may receive an error when using Custom Views

    https://support.microsoft.com/en-us/help/4508640/event-viewer-may-close-or-you-may-receive-an-error-when-using-custom-v

    Best Regards,


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Friday, July 12, 2019 2:42 AM
    Moderator
  • Hi,
    Was your issue solved?
    If yes, would you like to share your solution in order that other community members could find the helpful reply quickly.
    If no, please reply and tell us the current situation in order to provide further help.
    Best Regards,

    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Sunday, July 21, 2019 7:31 PM
    Moderator