Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm looking at the eventviewer logs, and I see a bunch Error entries in the Application log. (Windows Server 2008 R1). There is an error written to the logs about every 4 seconds.

I need to find out which application is causing these events, is there anyway to find this out?

Here is what each look like:

Error  12/2/2010 12:00:09 PM   Application 0   None

The details for each error:

Log Name:      Application
Source:        Application
Date:          12/2/2010 12:00:09 PM
Event ID:      0
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      computer.domain
The description for Event ID 0 from source Application cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

If the event originated on another computer, the display information had to be saved with the event.

The following information was included with the event: 

the message resource is present but the message is not found in the string/message table

Event Xml:
<Event xmlns="">
    <Provider Name="Application" />
    <EventID Qualifiers="0">0</EventID>
    <TimeCreated SystemTime="2010-12-02T20:00:09.000Z" />
    <Security />
share|improve this question

looks like an application is missing its resource dll so it does not know how to write info to the logs in a meaningful manner. Process explorer will be your friend in this case.

share|improve this answer
How can Process Explorer tell me which processes are writing to the event logs? – mlsteeves Dec 3 '10 at 14:23
if its writing every 4 secs you'll most likely see a process thats ticking at the same beat! – tony roth Dec 3 '10 at 15:04

The additional text in the event log Description field is displayed by event viewer. It does not stem from the log entry itself.

In my experience, the EventMessageFile setting of this event source is invalid, e.g. pointing to the wrong .NET version.

When confronted with the message, I replace the invalid setting in the registry with a valid EventMessageFile setting from a similar log configuration on the same machine (usual registry caution disclaimers apply).

After restarting event viewer the additional text disappears from the otherwise unchanged log entries.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.