Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 1005 Source: Application Error

Windows cannot access the file <file> for one of the following reasons: there is a problem with the network connection, the disk that the file is stored on, or the storage drivers installed on this computer, or the disk is missing. Windows closed the program <program name> because of this error.

Program: <program name>
File: <file>

The error value is listed in the Additional Data section.
User Action
1. Open the file again.  This situation might be a temporary problem that corrects itself when the program runs again.
2.  If the file still cannot be accessed and
- It is on the network  your network administrator should verify that there is not a problem with the network and that the server can be contacted.
- It is on a removable disk for example a floppy disk or CD-ROM verify that the disk is fully inserted into the computer.
3. Check and repair the file system by running CHKDSK. To run CHKDSK click Start click Run type CMD and then click OK. At the command prompt type CHKDSK /F and then press ENTER.
4. If the problem persists restore the file from a backup copy.
5. Determine whether other files on the same disk can be opened. If not the disk might be damaged. If it is a hard disk contact your administrator or computer hardware vendor for  further assistance.
Additional Data
Error value: C000009C
Disk type: 3
In our case the problem appeared because the file msi.dll was missing. When we tried to install software directly from an install CD this event was generated. Copying the CD to the local hard drive and attempting to install from the local hard drive generated the same event. Attempting to run Setup.exe directly returned "Windows cannot access the specified device, path, or file. You may not have the appropriate permissions to access the item". Additionally, we were unable to open the Add or Remove Programs applet. Finally, we ran msiexec /unreg and received the following error message: "This application has failed to start because msi.dll was not found. Reinstalling the application may fix this problem". We copied msi.dll from another server and successfully unregistered and reregistered msiexec.
From a newsgroup post: "The problem with reading shared files disappeared when the SATA RAID controller was moved to another PCI-X slot in the machine. I guess that in the previous configuration there was a subtle hardware or driver conflict between the RAID controller and the integrated NIC. It is very strange that Windows Server 2003 did not issue any warnings or errors regarding this".

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.