WHEA-Logger

Question

Hi, I'd like to predict and find device fault in phy by analysing WHEA-Logger. Now I got a few WHEA-Logger from Windows Server 2019 and Windows Server 2022 via wevtutil tool, what bother me is some attributes of these logs have values of all 0x0 , such as RankNumber, Bank, Row, Column. Are these value credible. If not, could I do something to make it correct.

One example from Windows Server 2022.

<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>
  <System>
    <Provider Name='Microsoft-Windows-WHEA-Logger' />
    <EventID>47</EventID>
    <Version>0</Version>
    <Level>3</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    ...
  </system>
  <EventData>
    <Data Name='ErrorSource'>0</Data>
    <Data Name='ValidBits'>0x2</Data>
    <Data Name='ErrorStatus'>0x0</Data>
    <Data Name='PhysicalAddress'>0x36efcfc2c0</Data>
    <Data Name='PhysicalAddressMask'>0x0</Data>
    <Data Name='Node'>0x0</Data>
    <Data Name='Card'>0x0</Data>
    <Data Name='Module'>0x0</Data>
    <Data Name='Bank'>0x0</Data>
    <Data Name='Device'>0x0</Data>
    <Data Name='Row'>0x0</Data>
    <Data Name='Column'>0x0</Data>
    <Data Name='BitPosition'>0x0</Data>
    <Data Name='TargetId'>0x0</Data>
    <Data Name='ErrorType'>0</Data>
    <Data Name='Extented'>0</Data>
    <Data Name='RankNumber'>0</Data>
    ...
  </EventData>
</Event>

Thank you!

Answer 1

Hello there,

You can try out other windows tools to isolate the log and find the exact reason for these values or the process causing these.

Process Monitor is an advanced monitoring tool for Windows that shows real-time file

system, Registry and process/thread activity. You can get the tool from here

https://docs.microsoft.com/enus/sysinternals/downloads/procmon

System Monitor (Sysmon) is a Windows system service and device driver that, once installed on a system, remains resident across system reboots to monitor and log

system activity to the Windows event log.You can get the tool from here

https://docs.microsoft.com/enus/sysinternals/downloads/sysmon

Hope this resolves your Query !!

--If the reply is helpful, please Upvote and Accept it as an answer--