cancel
Showing results for 
Search instead for 
Did you mean: 

Thousands of event log Warnings from source WHEA-Logger Event ID 17

SOLVED
18 REPLIES 18
seanbirkhead
Trainee
Message 1 of 19
15,027 Views
Message 1 of 19
15,027 Views

Thousands of event log Warnings from source WHEA-Logger Event ID 17

Hi, 

I have literally thousands of these warnings occurring several times per minute.

Can anyone direct me towards a solution?

Laptop is a MEDION ERAZER P15805 (MD 61593) UK

 

This is what is in the event log :

 

A corrected hardware error has occurred.

 

Component: PCI Express Root Port

Error Source: Advanced Error Reporting (PCI Express)

 

Primary Bus:Device:Function: 0x0:0x1D:0x0

Secondary Bus:Device:Function: 0x0:0x0:0x0

Primary Device Name:PCI\VEN_8086&DEV_A336&SUBSYS_85501558&REV_F0

Secondary Device Name:

 

 

 

 

>
- <System>
  <Provider Name="Microsoft-Windows-WHEA-Logger" Guid="{c26c4f3c-3f66-4e99-8f8a-39405cfed220}" />
  <EventID>17</EventID>
  <Version>1</Version>
  <Level>3</Level>
  <Task>0</Task>
  <Opcode>0</Opcode>
  <Keywords>0x8000000000000000</Keywords>
  <TimeCreated SystemTime="2020-12-09T22:48:55.9590600Z" />
  <EventRecordID>661862</EventRecordID>
  <Correlation ActivityID="{7e1e7ee5-ec71-44d6-b42d-da86c315a368}" />
  <Execution ProcessID="6200" ThreadID="8024" />
  <Channel>System</Channel>
  <Computer>ERAZER</Computer>
  <Security UserID="S-1-5-19" />
  </System>
- <EventData>
  <Data Name="ErrorSource">4</Data>
  <Data Name="FRUId">{00000000-0000-0000-0000-000000000000}</Data>
  <Data Name="FRUText" />
  <Data Name="ValidBits">0xdf</Data>
  <Data Name="PortType">4</Data>
  <Data Name="Version">0x101</Data>
  <Data Name="Command">0x10</Data>
  <Data Name="Status">0x407</Data>
  <Data Name="Bus">0x0</Data>
  <Data Name="Device">0x1d</Data>
  <Data Name="Function">0x0</Data>
  <Data Name="Segment">0x0</Data>
  <Data Name="SecondaryBus">0x0</Data>
  <Data Name="SecondaryDevice">0x0</Data>
  <Data Name="SecondaryFunction">0x0</Data>
  <Data Name="VendorID">0x8086</Data>
  <Data Name="DeviceID">0xa336</Data>
  <Data Name="ClassCode">0x30400</Data>
  <Data Name="DeviceSerialNumber">0x0</Data>
  <Data Name="BridgeControl">0x0</Data>
  <Data Name="BridgeStatus">0x0</Data>
  <Data Name="UncorrectableErrorStatus">0x0</Data>
  <Data Name="CorrectableErrorStatus">0x1000</Data>
  <Data Name="HeaderLog">00000000000000000000000000000000</Data>
  <Data Name="PrimaryDeviceName">PCI\VEN_8086&DEV_A336&SUBSYS_85501558&REV_F0</Data>
  <Data Name="SecondaryDeviceName" />
  </EventData>
  </Event>
2 ACCEPTED SOLUTIONS

Accepted Solutions
seanbirkhead
Trainee
Message 12 of 19
14,888 Views
Message 12 of 19
14,888 Views

I installed the latest driver  from the Realtek site which was newer than the one that that Windows update had installed.

It did not solve the problem unfortunately even after installing / rebooting etc. in the sequence you suggested.

 

I rolled back to the Microsoft driver again  and the problem goes away again.

seanbirkhead_0-1607955753519.png

In fact I get faster throughput over LAN when using the Microsoft Driver than when using the Realtek driver.

 

I'm probably not going to keep chasing this any more as the Microsoft driver seems stable , error free and fast so I have created a group poilcy rule to prevent any future updates to the LAN card driver.

This should cause Windows update to fail when it tries to update the driver and then I can just hide that update when and if that happens.

 

View solution in original post

seanbirkhead
Trainee
Message 19 of 19
12,178 Views
Message 19 of 19
12,178 Views

Just adding some more detailed steps here as I have seen other posts related to similar problems.

My issue was the Realtek LAN card and more specifically the Realtek driver for that card.


To expand on my own solution:
I had to do the following steps.

1. Take the laptop offline i.e. disconnect any wifi connection or LAN cable. This is important as Windows update immediately tries to re-install the manufacturer drivers from Windows online update during later steps.
2. From device manager , I uninstalled the network card AND ticked the box to delete the existing driver. This is also important otherwise Windows will just use the same driver again when it re-installs the network card later if you don't chose the option to delete the existing driver.
3. Reboot the laptop. It is important that the laptop stays disconnected from the internet during and after reboot so if using wifi make sure it doesn't automatically re-connect. If in doubt it might be just a good idea to switch off the internet router to be sure.
4. After reboot Windows should have re-installed the device and used the Microsoft in-built drivers.
If this solves the problem and there are no more WHEA-logger entries in event viewer  then the following needs to be done before bringing the laptop back online.
5. Create a group policy to prevent future automatic driver updates for the problematic device. Group policy editing is only available through a GUI on Win 10 Pro but there is a workaround that still allows it to be done through registry entries on Win 10 Home. There are instructions for doing this (including the Win 10 Home workaround here : https://www.tenforums.com/tutorials/146562-prevent-windows-update-updating-specific-device-driver.ht... )
6. Once the group policy is in place or the registry edited you can then bring the laptop back online and the driver should not update again in future.

View solution in original post

18 REPLIES 18
sweetpoison
Mentor
Message 2 of 19
10,940 Views
Message 2 of 19
10,940 Views

Hi @seanbirkhead, welcome to the forum

 

This kind of error it's strictly related to your machine/os and without a direct inspection of the problem can be only a lot of guessing.

So here's my guess: most likely a background app using WI-FI (like One-drive or such).

Before everything, clear the logs and restart the machine because the process that cause problems might get a different ID after restart.

Check again the logs and find the current process ID (example:  <Execution ProcessID="6200" ThreadID="8024" />)

To go to task manager. 

 

Locate the process ID (PID) 6200 (or whatever ID is at that moment). Once you found it, right-click on that and at the bottom of menu select "Go to details" to see the app which calls for that process. 

More actions can be suggested once you find that information.

 

Cheers. 

seanbirkhead
Trainee
Message 3 of 19
10,928 Views
Message 3 of 19
10,928 Views

Thanks for the reply.

The process is Service Host: Diagnostic Policy Service ,   svchost.exe.

That doesn't tell us much.

So , I have begun the laborious process of disconnecting all peripherals and terminating all non-essential programs.

I have it at the point where I have stopped the warnings so now i will gradually restart programs and reconnect peripherals until I find the culprit.

I fill post any findings or solutions here as I go along.

 

sweetpoison
Mentor
Message 4 of 19
10,923 Views
Message 4 of 19
10,923 Views

That service can be stopped and switched for Start-up Type: Manual. Meaning the service will start only on demand (like windows error reporting, finding solution for errors, searching for missing drivers or other things) and will not affect windows stability or integrity.

Since it's a network related problem, if reappears try to connect the laptop via Ethernet cable instead of wi-fi just to be sure is not some address conflict on wi-fi card's driver.

seanbirkhead
Trainee
Message 5 of 19
10,919 Views
Message 5 of 19
10,919 Views

As it happens I have not managed  to stop the warnings completely , I have just reduced the frequency. I still get one randomly and around 20 per hour even though i have terminated every non-essential program where i am comfortable that I know what it does.  

I would prefer not to stop the service.

Instead I would like to understand if I have a potential hardware fault or a driver issue.

 

My laptop has never been on wifi. I have always been on ethernet.

For troubleshooting I turned off wifi in settings anyway but it had no effect.

I then turned back on wifi and connected it and unplugged the ethernet. Again, no effect. I still have intermittent warnings.

 

I have tracked the device ID in the warning messages through device manager and it appears to be linked with this device :   Intel(R) PCI Express Root Port #15 - A336

I rolled back the driver on that device and it did not stop the warnings. I also uninstalled the device , removed the driver, and allowed it to re-install but I still have warnings.

 

Maybe if there is a Medion Engineer reading this thread you could suggest more troubleshooting?

 

Thanks,

Sean

 

 

sweetpoison
Mentor
Message 6 of 19
10,911 Views
Message 6 of 19
10,911 Views

What you can do in the mean time is to remove driver=>windows restart=>install driver=>windows restart  for all networks adapters (including bluetooth) one at the time. The restart is for windows to see unallocated addresses where the "new found" device can be installed (under another version of windows I use this procedure to correct the problem where am address was shared between sound card and network card) . 

A physical fault is less probable because in most of the cases it's cut and dry: it works or not.

Also about services switching Start-up Type from Automatic to Manual does not disable the service but just switch the way that service will start, at windows start-up or only when is called. 

 

Cheers.

seanbirkhead
Trainee
Message 7 of 19
10,907 Views
Message 7 of 19
10,907 Views

I don't think it is a networking issue.

I have disabled both the LAN adapter and the wifi adapter in device manager and I still have the problem so it has to be somewhere else.

My next plan is to set windows update to only notify of updates but not to install them and then to re-install the chipset drivers from the recovery partition i.e. the drivers the machine presumably came with originally.

 

seanbirkhead
Trainee
Message 8 of 19
10,905 Views
Message 8 of 19
10,905 Views

Just got this reply from microsoft so I am on the right track already I think :

 

You have problems with Intel(R) PCI Express Root Port. Please update motherboard driver and/or firmware from PC/motherboard support site.

seanbirkhead
Trainee
Message 9 of 19
10,888 Views
Message 9 of 19
10,888 Views

My last plan (re-install old chipset drivers) didn't work.

 

While maybe a little overkill,  what I ended up doing was the following:

I booted into safe mode (no networking)

Then in device manager I uninstalled every peripheral device (except for my c: drive) and at the same time chose the option to uninstall the driver for the device.

I then immediately rebooted normally.

All the uninstalled devices got re-installed and now I have no WHEA warnings.

So, unfortunately, I can't pinpoint exactly where the problem was but that process seems to have fixed it.

seanbirkhead
Trainee
Message 10 of 19
10,871 Views
Message 10 of 19
10,871 Views

Update :

Windows update just installed this driver and the problem immediately returned :

Realtek - Net - 10.42.526.2020

I rolled back the driver and the problem went away again.

 

 

18 REPLIES 18