Event ID 2012

Event ID 2012
PerfOS

http://go.microsoft.com/fwlink/events.asp

http://www.eventid.net/display.asp?eventid=2012&eventno=3810&source=PerfOS&phase=1

Source: PerfOS

Type: Warning

Description: Unable to get system process information from system. Status code returned is data DWORD 0. Data: 0000: 05 00 00 c0

English: Request a translation of the event description in plain English.

Concepts to understand: What is a DWORD?

Comments: Anonymous There is a Microsoft white paper on this issue. Changing the boot.ini resolved our issue on 2003 SP2. See EV100293(Detection, Analysis, and Corrective Actions for Low Page Table Entry Issues). DJW See M316739 on how to use /userva=xxxx switch for more precise tuning of user and kernel virtual memory space. igavio I had the same situation as Brian and it was caused by a printer driver ZSHP2600.exe of the infamous HP Color LaserJet 2600n. This driver was running many times. To stop it you have to net stop the print spooler, kill the processes and re-start the spooler. HP is aware of the problem, and  (apparently) does nothing to solve it.  x 3 EventID.Net From a newsgroup post: "These types of errors usually occur in the following situations: 1. You do not have enough page file (ensure the page file has enough room to grow) 2. You have a leaky application Perfmon should be able to help in the second situation; if you are still having troble resolving this I suggest you log a support call with your support provider or Microsoft GTSC." The 5 in the data portion of the event may point to Error code 5 ("Access denied"). Data code c000009a may indicate that the system is running out of resources. A restart may fix the problem.  x 10 Jean-Michel Depaepe We had exactly the same problem as Brian Dwyer described in his comment. Without any application started, the PTEs number was only 15000. With applications started, the PTEs number dropped to 2000. The number of PTEs also decreased during network perturbations and sometimes was less than 600. I solved the problem by changing the value for "HKLM\CurrentControlSet\Control\Session Manager\Memory Management\SystemPages" from 0 to 50000. It increased the number of PTEs to 42500 (no applications started).  x 4 Why bother deciphering Event logs when GFI EventsManager can do everything for you? Free trial here! Brian Dwyer This is a possible indication that the System Page Table Entries (PTEs) have reached a dangerously low level. Run performance (system) monitor on the server and add the memory counter "Free System Page Table Entries". A healthy number for a server operating normally should be anywhere from 2, 000 to as high as 10, 000 and more. The higher the number, the better. Another strange behavior you may observe if this is the case is that no processes may show in the task manager even though they are actively running. If the number you see is below 2000 you most likely have some sort of driver and/or process that is causing a memory leak or is failing. In one instance, I found that a custom application registered as a service was causing application initialization popup errors on the server console. There were hundreds of these errors that were not acknowledged. Additionally, there were over 50 orphaned instances of the application process itself loaded in memory. By clearing/acknowledging the errors and killing the orphaned processes, the system PTEs returned to in excess of 14, 000. Keep in mind that drivers (especially video and SCSI drivers) can also cause this type of behavior. However, be aware of application popups at the server console.  x 12 Anonymous If you don’t want to receive this warning anymore you can use the Exctrlst.exe Tool and uncheck PerfOS.  x 3

Private comment: Subscribers only. See example of private comment

Links: Error code 5, Exctrlst.exe: Extensible Performance Counter List, Error code 0xc000009a

Search: Google - Bing - Microsoft - Yahoo - EventID.Net Queue - More links...

Custom search for *****: Google - Bing - Microsoft - Yahoo

Feedback: Send comments or solutions - Notify me when updated

.