Bug 1993824

Summary: [virtio-win]Balloon Service is generating the following WMI errorID:5858
Product: Red Hat Enterprise Linux 9 Reporter: xiagao
Component: virtio-winAssignee: Kostiantyn Kostiuk <kkostiuk>
virtio-win sub component: virtio-win-prewhql QA Contact: xiagao
Status: CLOSED MIGRATED Docs Contact:
Severity: medium    
Priority: medium CC: kkostiuk, vrozenfe, yvugenfi
Version: 9.0Keywords: CustomerScenariosInitiative, Triaged
Target Milestone: rc   
Target Release: ---   
Hardware: x86_64   
OS: Windows   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2023-08-13 09:09:12 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description xiagao 2021-08-16 08:05:14 UTC 
Description of problem:
Balloon Service is generating the following WMI errorID:5858
"
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HOSTNAME; User = NT AUTHORITY\SYSTEM; ClientProcessId = 964; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PerfRawData_PerfOS_Memory; ResultCode = 0x80041032; PossibleCause = Unknown
"


Version-Release number of selected component (if applicable):
kernel-4.18.0-325.el8.x86_64
qemu-kvm-6.0.0-26.module+el8.5.0+12044+525f0ebc.x86_64
virtio-win-1.9.16-2.el8.iso
virtio-win-prewhql-215

How reproducible:
100%

Steps to Reproduce:
1.Boot up win10-64 guest with balloon device, machine type is q35.
2.Installed Balloon Service and *restart* it in service manager
3.Check Applications and Servics -> Microsoft-Windows-WMI-Activity in event viewer

Actual results:

Hit ErrorID:5858 and the error event keeps popping up。
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = DESKTOP-3S4705U; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1700; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\WMI : SELECT * FROM BatteryStaticData; ResultCode = 0x80041010; PossibleCause = Unknown


Expected results:
No WMI-Activity error

Additional info:
detailed info:
  
Microsoft-Windows-WMI-Activity/perational

Log Name:      Microsoft-Windows-WMI-Activity/Operational
Source:        Microsoft-Windows-WMI-Activity
Date:          8/16/2021 3:41:31 AM
Event ID:      5858
Task Category: None
Level:         Error
Keywords:
User:          SYSTEM
Computer:      DESKTOP-3S4705U
Description:
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = DESKTOP-3S4705U; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1700; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\WMI : SELECT * FROM BatteryStaticData; ResultCode = 0x80041010; PossibleCause = Unknown
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WMI-Activity" Guid="{1418ef04-b0b4-4623-bf7e-d74ab47bbdaa}" />
    <EventID>5858</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x4000000000000000</Keywords>
    <TimeCreated SystemTime="2021-08-15T19:41:31.7414122Z" />
    <EventRecordID>240</EventRecordID>
    <Correlation />
    <Execution ProcessID="3128" ThreadID="7940" />
    <Channel>Microsoft-Windows-WMI-Activity/Operational</Channel>
    <Computer>DESKTOP-3S4705U</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <Operation_ClientFailure xmlns="http://manifests.microsoft.com/win/2006/windows/WMI">
      <Id>{00000000-0000-0000-0000-000000000000}</Id>
      <ClientMachine>DESKTOP-3S4705U</ClientMachine>
      <User>NT AUTHORITY\SYSTEM</User>
      <ClientProcessId>1700</ClientProcessId>
      <Component>Unknown</Component>
      <Operation>Start IWbemServices::ExecQuery - ROOT\WMI : SELECT * FROM BatteryStaticData</Operation>
      <ResultCode>0x80041010</ResultCode>
      <PossibleCause>Unknown</PossibleCause>
    </Operation_ClientFailure>
  </UserData>
</Event>
Comment 1 xiagao 2021-08-16 09:05:12 UTC 
Use virtio-win-guest-tools to update drivers/start balloon service, also hit WMI-Activity error(ID: 5858)
Comment 2 Vadim Rozenfeld 2022-01-18 09:24:32 UTC 
Does it happen on a freshly installed VM?
Is it a 100% reproducible or does it happen on a some particular VM?

The return code 0x80041010 returned from IWbemServices::ExecQuery call
means WBEM_E_INVALID_CLASS which probably indicates that WMI repository 
has been corrupted.
Can you please run "winmgmt /verifyrepository" from the elevated command prompt on this
VM to see if the repository has an issue?

Thanks,
Vadim.
Comment 3 xiagao 2022-01-18 09:56:25 UTC 
(In reply to Vadim Rozenfeld from comment #2)
> Does it happen on a freshly installed VM?
> Is it a 100% reproducible or does it happen on a some particular VM?
It can be 100% reproduced.
I tried with two vms(win2019,win10-64),all hit this issue, one is old and the other is freshly installed.

> 
> The return code 0x80041010 returned from IWbemServices::ExecQuery call
> means WBEM_E_INVALID_CLASS which probably indicates that WMI repository 
> has been corrupted.
> Can you please run "winmgmt /verifyrepository" from the elevated command
> prompt on this
> VM to see if the repository has an issue?
The repository seems works
It returnes that "WMI repository is consistent"

> 
> Thanks,
> Vadim.
Comment 4 Vadim Rozenfeld 2022-01-18 10:58:58 UTC 
(In reply to xiagao from comment #3)
> (In reply to Vadim Rozenfeld from comment #2)
> > Does it happen on a freshly installed VM?
> > Is it a 100% reproducible or does it happen on a some particular VM?
> It can be 100% reproduced.
> I tried with two vms(win2019,win10-64),all hit this issue, one is old and
> the other is freshly installed.
> 
> > 
> > The return code 0x80041010 returned from IWbemServices::ExecQuery call
> > means WBEM_E_INVALID_CLASS which probably indicates that WMI repository 
> > has been corrupted.
> > Can you please run "winmgmt /verifyrepository" from the elevated command
> > prompt on this
> > VM to see if the repository has an issue?
> The repository seems works
> It returnes that "WMI repository is consistent"

But we are still getting Event 5858 in the event log, right?
Could you please upload the event log?

Best,
Vadim.

> 
> > 
> > Thanks,
> > Vadim.
Comment 6 Kostiantyn Kostiuk 2022-09-22 08:34:36 UTC 
About ResultCode = 0x80041032:

From MS docs: https://learn.microsoft.com/en-us/troubleshoot/windows-client/system-management-components/wmi-activity-event-5858-logged-with-resultcode-0x80041032

```
WMI-Activity Error 5858 with ResultCode = 0x80041032 (WBEM_E_CALL_CANCELLED) indicates that the WMI caller has successfully issued IWbemServices:ExecQuery, but has released the IWbemContext object before retrieving the full result set using the IEnumWbemClassObject::Next method. 
```

The balloon driver does absolutely the same. We have a separate thread that periodically sends WMI requests. If the service manager sends the stop request, the separate thread just exits. I think this is correct, we don't need to wait until the WMI request finishes.


About ResultCode = 0x80041010 - continue investigation.