14 entries

Windows Application

Programs crashing, and what the faulting module actually tells you.

10 Event 10 (WMI): An event subscription could not be restarted Worth a look Windows Management Instrumentation tried to reactivate a standing subscription at boot and failed. The famous version of this is a leftover Microsoft left in a Windows 7 install image, harmless and endlessly repeated. The version worth reading is the one where the query is not Microsoft's.
33 Event 33: A program cannot find a runtime library it needs Worth a look Windows tried to work out which version of a shared library a program wanted, and could not find a matching one installed. The program usually fails to start at all. The fix is almost always installing the right Visual C++ redistributable.
455 Event 455: An internal Windows database could not open its log file Informational ESENT is the small database engine Windows uses internally for things like the Start menu tile store and Windows Update history. Event 455 means one of those databases could not open its transaction log. On Windows 10 it is a famously harmless leftover from an old feature.
1000 Event 1000: An application crashed Worth a look A program stopped working. The event names the crashing program, the component it died inside, and the exception code — and the faulting module is usually the field that identifies the real culprit rather than the application you were using.
1001 Event 1001: Windows Error Reporting filed a crash report Informational This is the paperwork that follows a crash, not the crash itself. Windows Error Reporting bundled up what happened, gave it a bucket number, and recorded where any dump file went. It reports that something already went wrong somewhere else.
1002 Event 1002: A program stopped responding and was closed Worth a look Windows decided a program had stopped answering its window messages and closed it for you. This is a freeze, not a crash — the program never faulted, it just stopped listening, which is why there is no faulting module to blame.
1005 Event 1005: Windows could not read a running program's file Investigate A program was closed because Windows could not read part of its own executable or a library from disk. It is not a coding bug like Event 1000 — the program was running fine until the storage underneath it stopped answering. That makes it a disk, network, or antivirus problem, not an application one.
1008 Event 1008: A performance counter set failed to load Informational Windows tried to collect performance counters from a component and the component's counter library would not open. Nothing that the component actually does is affected — only the numbers about it. The real error code is not in the message; it is in the event's binary data, which is why this one is so often given up on.
1026 Event 1026: A .NET program threw an exception nobody caught Worth a look A program written on the .NET framework hit an error its own code did not handle, so the runtime shut it down. Unlike most crash events, this one carries a stack trace — the list of methods that were running — which usually names the responsible component outright.
1033 Event 1033: Windows Installer installed a product Informational An MSI-based installer finished, and Windows recorded the product name, version, publisher, and result. It is the closest thing Windows has to a built-in software installation history — and the number at the end is an MSI error code, so a 1033 can perfectly well be a record of a failure.
1511 Event 1511: You have been signed in with a temporary profile Investigate Windows could not load your normal profile, so it made a throwaway one instead. Everything looks reset — your desktop, your documents, your settings — but nothing has been deleted. The real profile is still on disk and the temporary one is discarded when you sign out.
1530 Event 1530: Registry unloaded while a program was still using it Informational When you sign out, Windows unloads your part of the registry. If a program still had it open, Windows forces the unload anyway and logs this, naming the process that was holding on. On a personal PC it is harmless; on a shared or remote-desktop server it is how profile corruption starts.
4107 Event 4107: Windows could not update its trusted root list Worth a look Windows downloads a signed list of trusted certificate authorities from Microsoft in the background. This event says that refresh failed. Nothing breaks immediately, which is why it gets ignored — but the machine's trust list, including which roots Microsoft has distrusted, is now frozen.
8193 Event 8193: The shadow copy service hit an error during a backup Worth a look Volume Shadow Copy is the Windows feature that lets a backup read files that are open. Event 8193 means one of its internal calls failed. The message names a routine you have never heard of; the part that matters is the error code in brackets at the end.