Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 4098 Source: EventSystem

The COM+ Event System failed to fire the <method> method on subscription {<GUID>}. The subscriber returned HRESULT <error code>.
This problem can be caused by faulty disk controllers or hard disk I/O problems. I have observed this problem on systems with faulty disk controllers but after changing the controller, the errors ceased. In this case, it was a VIA onboard Ultra ATA/66 IDE controller. Boot time seemed slow, so I put in a Promise Ultra ATA/66 offboard controller. The offboard controller was faster than the onboard controller and there was more than a 10 second difference for the CPU time in WINLOGON.EXE. The EventSystem errors were noticed when using the VIA IDE onboard controller, but they went away when using the Promise offboard controller.
Reported codes:
- 800706BA = "The RPC server is unavailable" - See the link to Error code 0x800706BA
- 80020006 = "Unknown name" - See ME317276 and also the link to Error code 0x80020006.
- 8007000E = "Not enough storage is available to complete this operation"
- 800706BF = "The remote procedure call failed and did not execute"

Reported method/GUID/code combinations:
- Logoff, 3DF3460B-858E-4DA9-8127-941F3B14B6BF, 800706BA - no info
- DisplayLock, FB197685-103A-4BC1-B1E8-46B194B50F96, 800706BA - no info
- Logoff, 094E2849-D51B-449B-B5DD-6175F00E0D60, 800706BA - no info
- GetObjectIdentity, E8ABC579-F891-4169-95A5-9F49DC6648A5, 80020006 - See ME317276.
- OnMethodCall, 55706C9A-5BF1-4F5C-A1DE-FFD8B90B328B, 80020006 - no info
- StopScreenSaver, 2F519218-4CFE-8DAA-5215CD0DE0EB, 8007000E - from a newsgroup post, this may be a symptom for the problem described in ME824226
- Logoff, 5D84831A-8A00-4484-B832-56B1DAFC179E, 800706BF - fixed by restarting the system
A list of Application Center errors (HRESULT codes) and their descriptions can be found by following the link “Application Center Error Message Reference”.
The decription of this error and the reason why it occurs can be found through the "COM + System Error" link. To remove the error look in the registry for "svchost". You should find strings which look like: ..."System32\svchost.exe -k netsvcs". In some strings, however, can be found the following mistake: Instead of "svchost.exe -k" there is only "svchost -k". This is the source of the error. Once corrected the error message disappears.
- HRESULT: 85AFEDF0 - no info.

Reported codes:
- 80040154 = "Class not registered"
- 80040155 = "Interface not registered"
This occured when we installed Servicepack 6a on a Windows NT 4.0 system.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.