WHEA-Logger

armd64 0 Reputation points
2023-05-06T09:43:47.1233333+00:00

Hi, I'd like to predict and find device fault in phy by analysing WHEA-Logger. Now I got a few WHEA-Logger from Windows Server 2019 and Windows Server 2022 via wevtutil tool, what bother me is some attributes of these logs have values of all 0x0 , such as RankNumber, Bank, Row, Column. Are these value credible. If not, could I do something to make it correct.

One example from Windows Server 2022.

<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>
  <System>
    <Provider Name='Microsoft-Windows-WHEA-Logger' />
    <EventID>47</EventID>
    <Version>0</Version>
    <Level>3</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    ...
  </system>
  <EventData>
    <Data Name='ErrorSource'>0</Data>
    <Data Name='ValidBits'>0x2</Data>
    <Data Name='ErrorStatus'>0x0</Data>
    <Data Name='PhysicalAddress'>0x36efcfc2c0</Data>
    <Data Name='PhysicalAddressMask'>0x0</Data>
    <Data Name='Node'>0x0</Data>
    <Data Name='Card'>0x0</Data>
    <Data Name='Module'>0x0</Data>
    <Data Name='Bank'>0x0</Data>
    <Data Name='Device'>0x0</Data>
    <Data Name='Row'>0x0</Data>
    <Data Name='Column'>0x0</Data>
    <Data Name='BitPosition'>0x0</Data>
    <Data Name='TargetId'>0x0</Data>
    <Data Name='ErrorType'>0</Data>
    <Data Name='Extented'>0</Data>
    <Data Name='RankNumber'>0</Data>
    ...
  </EventData>
</Event>

Thank you!

Windows Server 2019
Windows Server 2019
A Microsoft server operating system that supports enterprise-level management updated to data storage.
3,537 questions
0 comments No comments
{count} votes

1 answer

Sort by: Most helpful
  1. Limitless Technology 44,046 Reputation points
    2023-05-09T13:09:23.5866667+00:00

    Hello there,

    You can try out other windows tools to isolate the log and find the exact reason for these values or the process causing these.

    Process Monitor is an advanced monitoring tool for Windows that shows real-time file

    system, Registry and process/thread activity. You can get the tool from here

    https://docs.microsoft.com/enus/sysinternals/downloads/procmon

    System Monitor (Sysmon) is a Windows system service and device driver that, once installed on a system, remains resident across system reboots to monitor and log

    system activity to the Windows event log.You can get the tool from here

    https://docs.microsoft.com/enus/sysinternals/downloads/sysmon

    Hope this resolves your Query !!

    --If the reply is helpful, please Upvote and Accept it as an answer--

    0 comments No comments