This bug has been migrated to another issue tracking site. It has been closed here and may no longer be being monitored.

If you would like to get updates for this issue, or to participate in it, you may do so at Red Hat Issue Tracker .
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1993824 - [virtio-win]Balloon Service is generating the following WMI errorID:5858
Summary: [virtio-win]Balloon Service is generating the following WMI errorID:5858
Keywords:
Status: CLOSED MIGRATED
Alias: None
Product: Red Hat Enterprise Linux 9
Classification: Red Hat
Component: virtio-win
Version: 9.0
Hardware: x86_64
OS: Windows
medium
medium
Target Milestone: rc
: ---
Assignee: Kostiantyn Kostiuk
QA Contact: xiagao
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2021-08-16 08:05 UTC by xiagao
Modified: 2023-10-08 06:36 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2023-10-08 06:36:06 UTC
Type: ---
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Issue Tracker   RHEL-12116 0 None Migrated None 2023-10-08 06:36:02 UTC
Red Hat Issue Tracker RHELPLAN-93568 0 None None None 2021-08-16 08:05:30 UTC

Description xiagao 2021-08-16 08:05:14 UTC 
Description of problem:
Balloon Service is generating the following WMI errorID:5858
"
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HOSTNAME; User = NT AUTHORITY\SYSTEM; ClientProcessId = 964; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PerfRawData_PerfOS_Memory; ResultCode = 0x80041032; PossibleCause = Unknown
"


Version-Release number of selected component (if applicable):
kernel-4.18.0-325.el8.x86_64
qemu-kvm-6.0.0-26.module+el8.5.0+12044+525f0ebc.x86_64
virtio-win-1.9.16-2.el8.iso
virtio-win-prewhql-215

How reproducible:
100%

Steps to Reproduce:
1.Boot up win10-64 guest with balloon device, machine type is q35.
2.Installed Balloon Service and *restart* it in service manager
3.Check Applications and Servics -> Microsoft-Windows-WMI-Activity in event viewer

Actual results:

Hit ErrorID:5858 and the error event keeps popping up。
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = DESKTOP-3S4705U; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1700; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\WMI : SELECT * FROM BatteryStaticData; ResultCode = 0x80041010; PossibleCause = Unknown


Expected results:
No WMI-Activity error

Additional info:
detailed info:
  
Microsoft-Windows-WMI-Activity/perational

Log Name:      Microsoft-Windows-WMI-Activity/Operational
Source:        Microsoft-Windows-WMI-Activity
Date:          8/16/2021 3:41:31 AM
Event ID:      5858
Task Category: None
Level:         Error
Keywords:
User:          SYSTEM
Computer:      DESKTOP-3S4705U
Description:
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = DESKTOP-3S4705U; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1700; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\WMI : SELECT * FROM BatteryStaticData; ResultCode = 0x80041010; PossibleCause = Unknown
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WMI-Activity" Guid="{1418ef04-b0b4-4623-bf7e-d74ab47bbdaa}" />
    <EventID>5858</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x4000000000000000</Keywords>
    <TimeCreated SystemTime="2021-08-15T19:41:31.7414122Z" />
    <EventRecordID>240</EventRecordID>
    <Correlation />
    <Execution ProcessID="3128" ThreadID="7940" />
    <Channel>Microsoft-Windows-WMI-Activity/Operational</Channel>
    <Computer>DESKTOP-3S4705U</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <Operation_ClientFailure xmlns="http://manifests.microsoft.com/win/2006/windows/WMI">
      <Id>{00000000-0000-0000-0000-000000000000}</Id>
      <ClientMachine>DESKTOP-3S4705U</ClientMachine>
      <User>NT AUTHORITY\SYSTEM</User>
      <ClientProcessId>1700</ClientProcessId>
      <Component>Unknown</Component>
      <Operation>Start IWbemServices::ExecQuery - ROOT\WMI : SELECT * FROM BatteryStaticData</Operation>
      <ResultCode>0x80041010</ResultCode>
      <PossibleCause>Unknown</PossibleCause>
    </Operation_ClientFailure>
  </UserData>
</Event>
Comment 1 xiagao 2021-08-16 09:05:12 UTC 
Use virtio-win-guest-tools to update drivers/start balloon service, also hit WMI-Activity error(ID: 5858)
Comment 2 Vadim Rozenfeld 2022-01-18 09:24:32 UTC 
Does it happen on a freshly installed VM?
Is it a 100% reproducible or does it happen on a some particular VM?

The return code 0x80041010 returned from IWbemServices::ExecQuery call
means WBEM_E_INVALID_CLASS which probably indicates that WMI repository 
has been corrupted.
Can you please run "winmgmt /verifyrepository" from the elevated command prompt on this
VM to see if the repository has an issue?

Thanks,
Vadim.
Comment 3 xiagao 2022-01-18 09:56:25 UTC 
(In reply to Vadim Rozenfeld from comment #2)
> Does it happen on a freshly installed VM?
> Is it a 100% reproducible or does it happen on a some particular VM?
It can be 100% reproduced.
I tried with two vms(win2019,win10-64),all hit this issue, one is old and the other is freshly installed.

> 
> The return code 0x80041010 returned from IWbemServices::ExecQuery call
> means WBEM_E_INVALID_CLASS which probably indicates that WMI repository 
> has been corrupted.
> Can you please run "winmgmt /verifyrepository" from the elevated command
> prompt on this
> VM to see if the repository has an issue?
The repository seems works
It returnes that "WMI repository is consistent"

> 
> Thanks,
> Vadim.
Comment 4 Vadim Rozenfeld 2022-01-18 10:58:58 UTC 
(In reply to xiagao from comment #3)
> (In reply to Vadim Rozenfeld from comment #2)
> > Does it happen on a freshly installed VM?
> > Is it a 100% reproducible or does it happen on a some particular VM?
> It can be 100% reproduced.
> I tried with two vms(win2019,win10-64),all hit this issue, one is old and
> the other is freshly installed.
> 
> > 
> > The return code 0x80041010 returned from IWbemServices::ExecQuery call
> > means WBEM_E_INVALID_CLASS which probably indicates that WMI repository 
> > has been corrupted.
> > Can you please run "winmgmt /verifyrepository" from the elevated command
> > prompt on this
> > VM to see if the repository has an issue?
> The repository seems works
> It returnes that "WMI repository is consistent"

But we are still getting Event 5858 in the event log, right?
Could you please upload the event log?

Best,
Vadim.

> 
> > 
> > Thanks,
> > Vadim.
Comment 6 Kostiantyn Kostiuk 2022-09-22 08:34:36 UTC 
About ResultCode = 0x80041032:

From MS docs: https://learn.microsoft.com/en-us/troubleshoot/windows-client/system-management-components/wmi-activity-event-5858-logged-with-resultcode-0x80041032

```
WMI-Activity Error 5858 with ResultCode = 0x80041032 (WBEM_E_CALL_CANCELLED) indicates that the WMI caller has successfully issued IWbemServices:ExecQuery, but has released the IWbemContext object before retrieving the full result set using the IEnumWbemClassObject::Next method. 
```

The balloon driver does absolutely the same. We have a separate thread that periodically sends WMI requests. If the service manager sends the stop request, the separate thread just exits. I think this is correct, we don't need to wait until the WMI request finishes.


About ResultCode = 0x80041010 - continue investigation.
Comment 9 RHEL Program Management 2023-10-08 06:32:31 UTC 
Issue migration from Bugzilla to Jira is in process at this time. This will be the last message in Jira copied from the Bugzilla bug.
Comment 10 RHEL Program Management 2023-10-08 06:36:06 UTC 
This BZ has been automatically migrated to the issues.redhat.com Red Hat Issue Tracker. All future work related to this report will be managed there.

Due to differences in account names between systems, some fields were not replicated.  Be sure to add yourself to Jira issue's "Watchers" field to continue receiving updates and add others to the "Need Info From" field to continue requesting information.

To find the migrated issue, look in the "Links" section for a direct link to the new issue location. The issue key will have an icon of 2 footprints next to it, and begin with "RHEL-" followed by an integer.  You can also find this issue by visiting https://issues.redhat.com/issues/?jql= and searching the "Bugzilla Bug" field for this BZ's number, e.g. a search like:

"Bugzilla Bug" = 1234567

In the event you have trouble locating or viewing this issue, you can file an issue by sending mail to rh-issues. You can also visit https://access.redhat.com/articles/7032570 for general account information.
Note You need to log in before you can comment on or make changes to this bug.