Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 3

Source
NVWMI
Level
Information
Description
slimLock : tid=0x1F58 - locked @ 0X000000013F966768
Source
3wareDrv
Level
Error
Description
BuildSgl> Ptr=82E83DD4, Len=528.
Source
3wDrv100
Level
Error
Description
FwReset> 1 outstanding I/O's.
Source
ACPIEC
Level
Warning
Description
\Device\ACPIEC: The embedded controller (EC) hardware returned data when none was requested.  This may indicate that the BIOS is incorectly trying to access the EC without syncronizing with the OS.  The data is being ignored.
Source
Active Server Pages
Level
Information
Description
Service started.
Source
AdsmScsi
Level
Error
Description
A check condition error has occurred on device \Device\mt1.0.0.3 during Rewind with completion code DD_DRIVE_FAILURE. Refer to the device's SCSI reference for appropriate action.
Source
AeLookupSvc
Level
Information
Description
The Application Experience Lookup service started successfully.
Source
Altiris eXpress Server
Level
Information
Description
Brokering Engine initialized.
Source
Altiris eXpress Server
Level
Information
Description
Licensed for: <value> nodes
Serial no: <serial>
Desc.: <desc>
Lic exp.date: Never expires
Product: Altiris eXpress Deployment
   Server 6.0
Nodes: <nodes>
Options: PC Transplant 4.0
   RapidInstall 3.1 Desktop/Notebook
   licenses RapiDeploy 4.5
SW maint.ends: <date> (<value> days).
Source
Altiris eXpress Server
Level
Information
Description
Working directory set to: <directory>.
Source
AppleTalk
Level
Information
Description
Name registered for this node on adapter "<adapter>".
Source
BITS Extensions
Level
Error
Description
An unexpected error occurred while Cleanup was running on the virtual directory <directory>. Try running Cleanup again later.
Source
BlueICE
Level
Error
Description
The description for Event ID ( 3 ) in Source ( BlueICE ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. The following information is part of the event: ; BLUEICE: Could not find cards.
Source
CimNotify
Level
Error
Description
The description for Event ID ( 3 ) in Source ( CimNotify ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: .
Source
Cisco CallManager
Level
Error
Description
Error: DeviceUnregistered - Device unregistered.
Device name.: <name>
Device IP address.: <IP address>
Device type. [Optional]: 72
Device description [Optional].: devbesa1
Reason Code [Optional].: 8
App ID: Cisco CallManager
Cluster ID: StandAloneCluster
Node ID: BE-CM2
Explanation: A device that has previously registered with Cisco CallManager has unregistered. This event may be issued as part of normal unregistration event or due to some other reason such as loss of keepalives.
Recommended Action: No action is required if unregistration of this device was expected.
Source
Cisco CDR Insert
Level
Error
Description
Error: kErrorNotCDRPrimary - InsertCDR service is being run on a server that is not the CDR primary
App ID: Cisco CDR Insert
Cluster ID: servername-Cluster
Node ID:
Explanation: InsertCDR service is being run on a server that is not the CDR primary.
Source
Cisco CTIManager
Level
Error
Description
Error: kCtiProviderOpenFailure - CTI application failed to open provider
CTIconnectionId: <ID>
Login User Id: <ID>
ReasonCode: <code>
IPAddress: <IP address>
App ID: Cisco CTIManager
Cluster ID: JMTAO-CM2-Cluster
Node ID: JMTAO-CM2
CTI Application ID: Cisco Telephony Call Dispatcher
Process ID: <PID>
Process Name: CtiHandler
Provider Name: CTI Framework
Explanation: Application is unable to open provider.
Recommended Action: Check the reason code and correct the problem. Restart CTIManager if problem persists.
Source
Cisco Database Layer Monitor
Level
Error
Description
Error: kDbConnectionFailed - Database connection failed.
Additional Information: Could not open connection. ReturnCode= [0x00000000]
App ID: Cisco Database Layer Monitor
Cluster ID: StandAloneCluster
Node ID: 10.10.1.10
Explanation: An attempt to connect to database failed.
Recommended Action: Enable trace for the database layer monitor to get specific error information.
Source
Cisco Tftp
Level
Error
Description
kConfigThreadCNDelDeviceFileDeleteFailed - Deletion of file for the deleted device from system failure.
  FileName: c:\Program Files\Cisco\TFTPpath\Kashmere_Gardens.cnf.xml
  App ID: Cisco Tftp
  Cluster ID: CM-1A-Cluster
  Node ID: 10.99.38.10
Explanation: File for the deleted device could not be deleted from system.
Recommended Action: This is a Windows system call that failed, so ensure that you are using recommended Windows configuration. Start and stop the TFTP service because the file that it is trying to delete might be in use. If you still get this error, collect TFTP service traces and contact TAC.
Source
Citrix WMI Service
Level
Warning
Description
The license check for <DLL file> failed it will therefore not be available until a Valid License is provided.
Source
Communicator
Level
Error
Description
Communicator was unable to resolve the DNS hostname of the login server <server>.

Resolution:
If you are using manual configuration for Communicator please check that the server name is typed correctly and in full. If you are using automatic configuration the network administrator will need to double-check the DNS A record configuration for <server> because it could not be resolved.
Source
CPQTeamMP
Level
Error
Description
TEAM <value>: PROBLEM: The Primary NIC is not receiving and no Standy could be verifed as receiving for failover. ACTION: Please check your cabling or switch port status.
Source
CRMLog
Level
Error
Description
C:\PROGRA~1\CSCOpx\log\syslog.log failed: The parameter is incorrect. (87)
Source
crypt32
Level
Error
Description
Failed auto update retrieval of third-party root list cab from: <URL> with error: <error code>.
Source
DB2_NT_Performance
Level
Error
Description
Win32 API : <function> returned <error message>.
Source
dmboot
Level
Error
Description
dmboot: Failed to start volume <volume name> (<volume letter>:)
Source
DMIAuthModule
Level
Error
Description
While processing a request for user <user name>, the authentication module encountered the following error: There is no such object on the server.
Source
DNS
Level
Information
Description
The DNS server has shutdown.
Source
DPMSRT RPG
Level
Error
Description
Recovery Point generation for Recovery Set(s) Disk Layout and System Volumes failed. Unknown error(-1).
Source
ECM agent
Level
Information
Description
The description for Event ID ( 3 ) in Source ( ECM agent ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. The following information is part of the event: ECM Started Successfully on the system..
Source
eXclaimer
Level
Error
Description
eXclaimer was unable to open the file C:\WINDOWS\system32\LogFiles\\Tuesday 19 May 2009.txt in thread 10476. The file was locked for an unacceptable period of time.
Source
FCCServer
Level
Error
Description
FCCS3008 Network communication error <COMM_FAILURE> sending message to application <Agent1>.  
The application will be logged out.
Source
Forefront Identity Manager
Level
Error
Description
Microsoft.ResourceManagement.Workflow.Hosting.WorkflowManagerException: Forefront Identity Management Service does not support workflows of type 'Microsoft.ResourceManagement.Workflow.Activities.SequentialWorkflow, Microsoft.ResourceManagement, Version=4.0.2450.5, Culture=neutral, PublicKeyToken=31bf3856ad364e35'.
Source
FW1
Level
Information
Description
FW1: Disabling HW loopback for interface NDISWANIP.
Source
GravitixISAPI
Level
Information
Description
The description for Event ID ( 3 ) in Source ( GravitixISAPI ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: Patchlink ISAPI Started.
Source
HP Active Health
Level
Warning
Description
COM Exception running a Casl GET EmbeddedController.AuditLog.JSON command = [NON CASL ESPECIFIC = 0x80041002]: Exception from HRESULT: 0x80041002
Source
HP Systems Insight Manager
Level
Error
Description
com.hp.mx.database.DbVerificationException: Error loading database verification handler 'com.hp.mx.database.MsSqlVerificationHandler'
com.hp.mx.database.DbVerificationException: Error accessing database.
Source
IAANTmon
Level
Error
Description
RAID1 Volume "SYS" changed from a Normal state to Degraded Failed Disks state"
Source
IAS
Level
Error
Description
The IAS service is not registered in active directory.
Source
IAS
Level
Error
Description
Access request for user <user id> was discarded.
Fully-Qualified-User-Name = <domain>\<user>
NAS-IP-Address = <ip addres>
NAS-Identifier = <not present>
Called-Station-Identifier = <not present>
Calling-Station-Identifier = <not present>
Client-Friendly-Name = <name>
Client-IP-Address = <ip addres>
NAS-Port-Type = Virtual
NAS-Port = 2221
Reason-Code = <error code>
Reason = <description>
Source
IISLOG
Level
Error
Description
IIS Logging was unable to create the file C:\WINNT\System32\LogFiles\W3SVC1\ex010320.log. The data is the error.
Source
InoculateIT
Level
Error
Description
[event time <time> <date>: event number <number>: machine <machine>: response time <time> <date>] <error message>.
Source
IntelQRTD
Level
Warning
Description
Error calling OSB Method.
Source
intlfxsr
Level
Warning
Description
Streaming SIMD extensions are not supported by some of the processors in this system.
Source
IsProto
Level
Error
Description
The description for Event ID ( 3 ) in Source ( IsProto ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: .
Source
Kerberos
Level
Error
Description
A Kerberos Error Message was received:
on logon session InitializeSecurityContext
Client Time:
Server Time: 17:15:47.0000 11/18/2003 Z
Error Code: <error code> <error symbolic name>
Extended Error: 0xc00000bb KLIN(0)
Client Realm:
Client Name:
Server Realm: <domain>
Server Name: host/<domain>
Target Name: host/<name>@<domain>
Error Text:
File: 9
Line: ab8
Error Data is in record data.
Source
Kernel-EventTracing
Level
Error
Description
Session "ReadyBoot" stopped due to the following error: 0xC0000188
Source
LDM
Level
Error
Description
A Dynamic Volume (<volume>) has failed.
Source
Media Center Receiver
Level
Error
Description
TV tuner encountered an error. (<error code>) <model name>.
Source
Microsoft-Windows-FilterManager
Level
Error
Description
Filter Manager failed to attach to volume '\Device\Harddisk5\DR10'. This volume will be unavailable for filtering until a reboot. The final status was 0xc03a001c.
Source
Microsoft-Windows-HAL
Level
Warning
Description
Initialization of the High Precision Event Timer failed due to an interrupt configuration problem.
The operating system will use another available platform timer in lieu of the High Precision Event Timer.

It may be possible to address this problem with an updated system BIOS.
Contact your system vendor for technical assistance.
Source
Microsoft-Windows-PrintSpooler
Level
Warning
Description
Printer %1 was deleted, and users will no longer be able to print to this printer. No user action is required.
To stop logging information events for the print spooler, in Control Panel, open Printers, right-click a blank area of the window, click Server Properties, click the Advanced tab, and then clear the Log spooler information events check box.
Source
Microsoft-Windows-RemoteAssistance
Level
Error
Description
Application will terminate, a critical error was detected in <file path>\novinterdialog.cpp Line <line number> Function OnErrorProc
Source
Microsoft-Windows-Security-Kerberos
Level
Error
Description
A Kerberos Error Message was received:
on logon session InitializeSecurityContext
Client Time:
Server Time: 17:15:47.0000 11/18/2003 Z
Error Code: <error code> <error symbolic name>
Extended Error: 0xc00000bb KLIN(0)
Client Realm:
Client Name:
Server Realm: <domain>
Server Name: host/<domain>
Target Name: host/<name>@<domain>
Error Text:
File: 9
Line: ab8
Error Data is in record data.
Source
Microsoft-Windows-WUSA
Level
Error
Description
Windows update could not be installed because of error 2359302 "" (Command line: ""C:\Windows\system32\wusa.exe" "C:\Program Files (x86)\LANDesk\LDClient\sdmcache\windows6.1-kb2475792-x64.msu" /quiet /norestart")
Source
MIK
Level
Error
Description
An unexpected exception occurred in MIK.
Source
mm
Level
Error
Description
The description for Event ID ( 3 ) in Source ( mm ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: <error message>
Source
MSMPSVC
Level
Error
Description
AV Engine failed to scan <file> file accessed thru C:\Program Files\Windows Defender\MsMpEng.exe (Session 0x0).
Source
MSSQLServerOLAPService
Level
Error
Description
OLE DB error: OLE DB or ODBC error: <error>.
Source
named
Level
Information
Description
denied update from [<ip address of the DNS server>].<version number> for "<domain name>" IN
Source
Norton Antivirus for Gateways
Level
Error
Description
Error: "bind" to (0.0.0.0).25 failed, error 10048.
Source
NProtectService
Level
Information
Description
The service was started.
Source
NRPE_NT
Level
Error
Description
NRPE_NT:  Error: Could not complete SSL handshake.
Source
NTP
Level
Error
Description
refclock_newpeer: clock type 4 invalid.
Source
NUEWizard
Level
Error
Description
The description for Event ID ( 3 ) in Source ( NUEWizard ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. The following information is part of the event: The event log file is corrupt..
Source
nv
Level
Error
Description
Unknown Method Error on C 00000000 SC 00000004 M 00000300 Data 8800cccc
Source
NVWMI
Level
Information
Description
slimLock : tid=0x1F58 - locked @ 0X000000013F966768
Source
NXND5HP
Level
Error
Description
DEVICE: HP NC375i Integrated Quad Port Multifunction Gigabit Server Adapter #4

PROBLEM: Unable to register the interrupt service routine. The network driver is unloaded.
Source
OTMan5
Level
Error
Description
OTM opened
Source
OtMan5
Level
Error
Description
Driver or device is incorrectly configured for .
Source
P3
Level
Error
Description
Performance Transition to state 1 failed during the initialization phase.
Source
Parallel
Level
Error
Description
Not enough memory was available to allocate internal storage needed for the device.
Source
Print
Level
Information
Description
Printer <printer name> was deleted.
Source
RdBusManager
Level
Error
Description
The Radius 1394 BusManager is unable to start the 1394 Device Drivers. Please review the software installation instructions and the troubleshooting section in your user guide. NT System Error: <error code>.
Source
Recording
Level
Warning
Description
Recording of <program name> began as scheduled on <date> <time> and was interrupted when the computer was powered off or the recording service was stopped.
Source
RmaServer
Level
Error
Description
RMA Error Occured : R: Error retrieving URL `rtsp://<url name>' (Invalid Path); For More Information see: (N/A)
Source
RtProgLog
Level
Error
Description
The description for event ID ( 3 ) in Source ( RtProgLog ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: .
Source
SccAAAServer
Level
Error
Description
The description for Event ID ( 3 ) in Source ( SccAAAServer ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event:
User ID: <id>
Client Type: <type>
Client Address: <address>.
Source
SecurityCenter
Level
Error
Description
The Windows Security Center Service was unable to establish event queries with WMI to monitor third party AntiVirus AntiSpyware and Firewall.
Source
Sentinel
Level
Error
Description
The description for Event ID ( 3 ) in Source ( Sentinel ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event:
Source
Serial
Level
Information
Description
User configuration data for parameter <COM port> overriding firmware configuration data.
Source
Server Health Agent
Level
Error
Description
The description for Event ID ( 3 ) in Source ( Server Health Agent ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. The following information is part of the event: The event log file is corrupt..
Source
SharePoint Portal Server
Level
Information
Description
New search server found or added.
Source
SimpTcp
Level
Warning
Description
The Simple TCP/IP Services could not find the TCP Discard port. The TCP Discard service was not started.  
Source
SQLBrowser
Level
Warning
Description
The configuration of the AdminConnection\TCP protocol in the SQL instance SQLEXPRESS is not valid.
Source
STCAgent
Level
Error
Description
Termination reason code 10 [FAST_USER_SWITCH]
Source
SurfControl Config Server
Level
Error
Description
StartServiceCtrlDispatcher failed.
Source
Symantec AntiVirus
Level
Information
Description
Scan started on selected drives and folders and all extensions.
Source
System.ServiceModel 3.0.0.0
Level
Error
Description
WebHost failed to process a request.
Sender Information:
The exception message is: Security settings for this service require "Anonymous" Authentication but it is not enabled for the IIS application that hosts this service ---> System.NotSupportedException: Security settings for this service require "Anonymous" Authentication but it is not enabled for the IIS application that hosts this service.
Source
System.ServiceModel 4.0.0.0
Level
Error
Description
WebHost failed to process a request.
Sender Information: System.ServiceModel.ServiceHostingEnvironment+HostingManager/63835064
Exception: System.ServiceModel.ServiceActivationException: The service '/SecurityTokenServiceApplication/securitytoken.svc' cannot be activated due to an exception during compilation. The exception message is: Exception has been thrown by the target of an invocation.. ---> System.Reflection.TargetInvocationException: Exception has been thrown by the target of an invocation. ---> System.InvalidOperationException: The farm is unavailable.
at Microsoft.SharePoint.Administration.Claims.SPSecurityTokenServiceManager.get_Local()
at Microsoft.SharePoint.IdentityModel.SPSecurityTokenServiceConfiguration..ctor()
--- End of inner exception stack trace ---
at System.RuntimeTypeHandle.CreateInstance(RuntimeType type, Boolean publicOnly, Boolean noCheck, Boolean& canBeCached, RuntimeMethodHandleInternal& ctor, Boolean& bNeedSecurityCheck)
at System.RuntimeType.CreateInstanceSlow(Boolean publicOnly, Boolean skipCheckThis, Boolean fillCache, StackCrawlMark& stackMark)
at System.RuntimeType.CreateInstanceDefaultCtor(Boolean publicOnly, Boolean skipCheckThis, Boolean fillCache, StackCrawlMark& stackMark)
at System.Activator.CreateInstance(Type type, Boolean nonPublic)
at System.RuntimeType.CreateInstanceImpl(BindingFlags bindingAttr, Binder binder, Object[] args, CultureInfo culture, Object[] activationAttributes, StackCrawlMark& stackMark)
at System.Activator.CreateInstance(Type type, BindingFlags bindingAttr, Binder binder, Object[] args, CultureInfo culture, Object[] activationAttributes)
at System.Activator.CreateInstance(Type type, BindingFlags bindingAttr, Binder binder, Object[] args, CultureInfo culture)
at Microsoft.IdentityModel.Protocols.WSTrust.WSTrustServiceHostFactory.CreateSecurityTokenServiceConfiguration(String constructorString)
at Microsoft.IdentityModel.Protocols.WSTrust.WSTrustServiceHostFactory.CreateServiceHost(String constructorString, Uri[] baseAddresses)
at Microsoft.SharePoint.IdentityModel.SPSecurityTokenServiceHostFactory.CreateServiceHost(String constructorString, Uri[] baseAddresses)
at System.ServiceModel.ServiceHostingEnvironment.HostingManager.CreateService(String normalizedVirtualPath, EventTraceActivity eventTraceActivity)
at System.ServiceModel.ServiceHostingEnvironment.HostingManager.ActivateService(ServiceActivationInfo serviceActivationInfo, EventTraceActivity eventTraceActivity)
at System.ServiceModel.ServiceHostingEnvironment.HostingManager.EnsureServiceAvailable(String normalizedVirtualPath, EventTraceActivity eventTraceActivity)
--- End of inner exception stack trace ---
at System.ServiceModel.ServiceHostingEnvironment.HostingManager.EnsureServiceAvailable(String normalizedVirtualPath, EventTraceActivity eventTraceActivity)
at System.ServiceModel.ServiceHostingEnvironment.EnsureServiceAvailableFast(String relativeVirtualPath, EventTraceActivity eventTraceActivity)
Process Name: w3wp
Process ID: 4844
Source
trha6
Level
Error
Description
The description for Event ID ( 3 ) in Source ( trha6 ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. The following information is part of the event: TRHA6 Did not find any Host Adapter Boards.
Source
tsmlvsa
Level
Error
Description
Encountered insufficient resources error.
Source
TV_RM3
Level
Error
Description
message string data:
(0x80040BB8, 202010) Cannot login TrustServer.
Account: F2232
TrustServer: https://10.1.1.24:8332/tvud/rd
Authentication Module: TVLdapSam
Description: Authentication Error!
Source
Virtual Disk Service
Level
Information
Description
Service started.
Source
Virtual Server
Level
Information
Description
Virtual Server was shut down.
Source
vmdebug
Level
Error
Description
VMDebug driver (version 7.3.3.3) was not enabled. This driver is required by the replay debugging feature of VMware Workstation. If you are using other VMware products or not using replay debugging  please ignore this message.
Source
Vmnet
Level
Error
Description
The description for Event ID ( 3 ) in Source ( VMnet ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. The following information is part of the event: \Device\VMnet0. Data: 0000: 00 00 08
Source
VMware Virtual Mount Service Extended
Level
Error
Description
Error: 1.
Source
VxMS NTFS Mapping Plug-in
Level
Error
Description
The description for Event ID ( 3 ) in Source ( VxMS NTFS Mapping Plug-in ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. The following information is part of the event: Error: 0x00000003, in file NtfsMftParser.cpp, line 732.
Source
WinAcPci
Level
Error
Description
The driver could not connect to its interrupt.
Source
WinSock Proxy Client
Level
Warning
Description
Application [<application exe>]. The application was started while the service manager was locked and NtLmSsp wasn't running. If the application will try to remote via WinSock Proxy it can cause a deadlock with the service manager. For this reason the remoting is disabled. If the application is a service, and you want it to be able to remote, make it dependent on NtLmSsp.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...