Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 1002 Source: ApplicationHang

Hanging application <application exe>, version <version>, hang module hungapp, version, hang address <hex address>.
Application: Excel.exe - This happened to us after a Windows update. It happens with Excel on opening network-based xls:

After you install MS11-021 and the Office File Validation (OFV) Add-in for Microsoft Office 2003 (KB 2501584). The solution is ME2570623.
Application: MovieMaker.exe - We got this when we tried to import a .flv (Flash Video file) video file into Microsoft Movie Maker. The application will hang during the import process and we had to restart it. Most probably that format is not supported.
I was experience this event 1002 with an application. If I started the application immediately after startup, it was ok. But if I tried to start the application after some time (after running IE or something using .NET or something) then application would not start. Immediately after I disabled the .NET optimization service, my application started.
Application: Explorer.EXE -  In my case disabling Virtual CD V10 Explorer Extension solved the problem.
Application iexplore.exe - My issue was an outdated version of Google Toolbar being used with Internet Exploder 7. Once removed, the crashing of IE stopped. Others may want to look into this, or other outdated add-ons.

In my case, I have updated all the firmware and applied all the hotfixes and patches and the error was gone.
In some cases, the application that reports as being hung it may simply wait for one of its components. For example, mmc.exe, the Microsoft Management Console, will report this if the appication that is accessed through it is not responding (and most of the Microsoft applications are using mmc as management interface). In such cases, the event is not useful in troubleshooting as mmc is not the source of the problem. Look for other events that may be directly related to the problem.

As per MSW2KDB, the indicated program stopped responding. The message contains details on which program and module stopped responding. A matching event with EventID 1001 might also appear in the event log. This matching event displays information about the specific error that occurred.

Application: FRONTPG.EXE - I got this message while using Frontpage. At some point the connectivity to the Internet was lost and Frontpage crashed while trying to save a webpage. I used Task Manager to kill the process and restarted Frontpage.
- Application: ntbackup.exe - See ME942843 for a hotfix applicable to Microsoft Windows Server 2003.

From a newsgroup post: "Regarding Office applications errors you can try to disable the Office Plug-in option in Norton".
MS article ME918165 describes such problems with applications in Windows Explorer or in the Windows shell after installing a certain security update.
In my case, this issue occured on an XP Pro (SP2) box after running Windows Update. Word and Excel 2000 were hanging when trying to save or open files and the box was being generally slow and unruly. Updating to the latest NIC driver fixed the problem.
If applications are hanging in Terminal Server, and you have Microsoft Office installed, check for the presence of CTFMON.EXE and uninstall it. Microsoft articles ME282599 and ME823586 show you how to do this.
From a newsgroup post: "We were in the middle of a major upgrade from Sybase PB5 to PB7, when we noticed that the server of our customers started to have problems, especially when printing (namely events 1002 were being logged in the event log). Eventually, I find out that if this problem occurs using DW Graph or Win Graph object, it has been solved by Sybase since PB7.0.3 build 10146. Sybase has send "End of Life" notification for PB7. You should consider upgrading directly to PB8".

From a newsgroup post: "If you are having problems with Outlook XP you might also want to look into uninstalling WinFax Pro . It has a great deal to do with Outlook problems".

If you are having problems with the system restore function, try to reinstall system restore to see if the problem is fixed. See the link to "Reinstalling System Restore" for details on this task.
I have found that some 3rd party toolbars added to Office or Internet Explorer can cause the problem. I had the same error come up and started removing software from control panel. I then started looking on the C: drive and found a directory called "c:\searchassistance" and ran the uninstall.htm. This brought up an html page with an uninstall button. I clicked uninstall. I then closed internet explorer and opened it again and everything was working great. So if you ever have problems with any application, first seek out any third party toolbars and remove them first before going through the headache of trying other things.
I received this error when I was running a 16-bit application. To resolve this, I let Windows control the pagefile size instead of manual pagefile size.

Looks like I found my solution in a bad RAM module. I have been up for 8 days with no iexplore faults or application hangs after taking one of my RAM chips out. I replaced the RAM chip and everything is fine now.
There is no clear definition of an application hanging. Typically the application is "busy" with some processing. However from a user's perspective, the application has stopped responding. The idea is to periodically detect if the application is still responding in a timer and depending on application logic, the target application can be killed or other necessary action can be taken.
When I went to the Help and Support centre, this is what came up, i.e not much use for mortal man
Symbolic Name:  ER_HANG_LOG
Message - Hanging application %1, version %2, hang module %3, version %4, hang address 0x%5.
Explanation:  The indicated program stopped responding. The message contains details on which program and module stopped responding. A matching event with EventID 1001 might also appear in the event log. This matching event displays information about the specific error that occurred.
I was having this same problem with IE 6.0.2800 with Windows XP Home. When I clicked on a URL that launched a page in a new browser window, The blank window would come up, but nothing would happen.  When I clicked the stop button and then refresh button, the page would come up normally. How did I repair this? I ran the following command from the START-RUN line and it was fixed:
rundll32.exe setupapi, InstallHinfSection DefaultInstall 132C:\windows\inf\ie.inf. Information taken from "EventID 1001 from source Application Hang".
If the application noticed in this message work on files through a network and category is (101), think of a problem with NIC: update the driver and tune parameters. If problem still there after this, change NIC for better brand.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.