Event Log MessagesÂ
Message Format
Message Examples
Event Viewer is used by administrators, developers, and technical support personnel to gather information about the state of the hardware, the software, and the system, and to monitor security events. There are three types of events:
- Informational events indicate that a task or operation has been completed successfully.
- Warning events notify the user that a problem might occur unless action is taken.
- Error events provide information about a problem that has occurred with a component or program.
Every event report that is displayed in Event Viewer contains a message, which is located in the Description box of the event's property sheet.
.png)
Message Format
Message Body
List of Parameters
Further Message Details
User Action
Additional Data
Standard Cross-Reference
A typical event message contains some or all of the following sections.
.bmp)
Examples of correct and incorrect messages are shown at the end of this topic.
Message Body
This section of the messages states the condition of the object or function that triggered the event. The three types of messages—informational, warning, and error—correspond to the three possible types of events.
Informational
Informational messages describe the successful operation of a program, driver, or service. This message type should be used only to give the user information and should never require a user action.
| Example |
|---|
Windows is removing the remaining objects from the directory partition %1 on this local domain controller. |
Warning
Warning messages indicate that there is or will soon be a problem with the object or function that triggered the event. They usually note problems that require action by the user or administrator (see the User Action section).
| Example |
|---|
This domain controller cannot replicate the directory partition %1 from the domain controller at the network address %2 because no Connection object exists for inbound replication for the domain controller %3. |
Error
Error messages indicate that an operation cannot be completed or will not be retried.
| Example |
|---|
This local domain controller cannot complete replication for the incoming object %1 because the parent object on a read-only directory partition was deleted. |
Error messages should include the cause of the error.
List of Parameters
Any parameters contained in the message body should also appear in the list of parameters, which immediately follows the message.
| Example |
|---|
The directory replication agent cannot apply attribute changes to the object %1 because the incoming changes caused the object to exceed the maximum object record size. Object: %1 |
List the parameters in the order they appear in the message body. Parameters that do not appear in the message body, such as the GUID, also appear in the parameter list. If no parameter order is established in the message body, list the parameters in order of importance relative.
Further Message Details
This section includes additional useful information about the event. These details should be pertinent, but they should not expand on either the condition or the cause of the event.
| Example |
|---|
Additional objects will be removed at the next Knowledge Consistency Checker update. |
User Action (for warning and error event reports only)
User action presents steps the user can take to correct or avert the problem.
| Example |
|---|
User Action If this condition is caused by low system resources (for example, low physical or virtual memory), restart this local domain controller. |
If there is no user action to recommend, do not include the User Action heading or any accompanying text.
Additional Data
Additional data can be an error value, an internal ID, or both. The error value is included so that users can search Microsoft Knowledge Base, Microsoft TechNet, or Microsoft Developer Network. The internal ID helps a developer locate the problem in the code, but isn't relevant to most users. If there is no additional data, do not include the Additional Data heading or any accompanying text.
Standard Cross-Reference
A standard cross-reference that links to the Search page of Help and Support Center is automatically inserted at the bottom of all descriptions.
For more information, see Help and Support Center at https://go.microsoft.com/fwlink/events.asp
Message Examples
| Correct | Incorrect |
|---|---|
The directory replication agent could not update the object %1 with changes received from the source domain controller %3. As a result, an error occurred during the application of the changes to Active Directory on the domain controller.Object: %1GUID: %2Source domain controller: %3 Synchronization of this local domain controller with the source domain controller is blocked until this update problem is corrected. Active Directory will attempt to update this object on the next scheduled replication cycle. User ActionIf this condition is caused by low system resources (for example, low physical or virtual memory), restart this local domain controller. Additional DataError value: %5 %4 For more information, see Help and Support Center at https://go.microsoft.com/fwlink/events.asp. |
The directory replication agent could not update the following object with changes received from the following source domain controller. An error occurred during the application of the changes to Active Directory on this domain controller.Object: %1GUID: %2Source domain controller: %3 Active Directory will attempt to update this object on the next scheduled replication cycle. Synchronization of this domain controller with the source domain controller is blocked until this update problem is corrected. Subsequent updates will not be made until this update succeeds. If this condition appears to be related to low system resources (e.g. low physical or virtual memory) restart this domain controller. |
Knowledge Consistency Checker (KCC) failed to update the replication topology for this domain controller. KCC will attempt to update the replication topology at the scheduled interval %4.KCC update interval: %4 By default, updates occur every 15 minutes. User ActionIf the update fails again, restart this domain controller. Additional DataError value: %3 %1Internal ID: %2 For more information, see Help and Support Center at https://go.microsoft.com/fwlink/events.asp. |
The replication topology update task terminated abnormally with the following status:%n%n%1%nThe task will be retried. If this condition persists, stop and restart this Windows Domain Controller.%n%nThe record data is the status code. (Internal ID %2.) |