This bug has been migrated to another issue tracking site. It has been closed here and may no longer be being monitored.

If you would like to get updates for this issue, or to participate in it, you may do so at Red Hat Issue Tracker .
Bug 1993824 - [virtio-win]Balloon Service is generating the following WMI errorID:5858
Summary: [virtio-win]Balloon Service is generating the following WMI errorID:5858
Keywords:
Status: CLOSED MIGRATED
Alias: None
Product: Red Hat Enterprise Linux 9
Classification: Red Hat
Component: virtio-win
Version: 9.0
Hardware: x86_64
OS: Windows
medium
medium
Target Milestone: rc
: ---
Assignee: Kostiantyn Kostiuk
QA Contact: xiagao
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2021-08-16 08:05 UTC by xiagao
Modified: 2023-08-13 09:09 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2023-08-13 09:09:12 UTC
Type: ---
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Issue Tracker   RHEL-1210 0 None None None 2023-08-13 09:09:11 UTC
Red Hat Issue Tracker RHELPLAN-93568 0 None None None 2021-08-16 08:05:30 UTC

Description xiagao 2021-08-16 08:05:14 UTC 
Description of problem:
Balloon Service is generating the following WMI errorID:5858
"
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HOSTNAME; User = NT AUTHORITY\SYSTEM; ClientProcessId = 964; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PerfRawData_PerfOS_Memory; ResultCode = 0x80041032; PossibleCause = Unknown
"


Version-Release number of selected component (if applicable):
kernel-4.18.0-325.el8.x86_64
qemu-kvm-6.0.0-26.module+el8.5.0+12044+525f0ebc.x86_64
virtio-win-1.9.16-2.el8.iso
virtio-win-prewhql-215

How reproducible:
100%

Steps to Reproduce:
1.Boot up win10-64 guest with balloon device, machine type is q35.
2.Installed Balloon Service and *restart* it in service manager
3.Check Applications and Servics -> Microsoft-Windows-WMI-Activity in event viewer

Actual results:

Hit ErrorID:5858 and the error event keeps popping up。
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = DESKTOP-3S4705U; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1700; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\WMI : SELECT * FROM BatteryStaticData; ResultCode = 0x80041010; PossibleCause = Unknown


Expected results:
No WMI-Activity error

Additional info:
detailed info:
  
Microsoft-Windows-WMI-Activity/perational

Log Name:      Microsoft-Windows-WMI-Activity/Operational
Source:        Microsoft-Windows-WMI-Activity
Date:          8/16/2021 3:41:31 AM
Event ID:      5858
Task Category: None
Level:         Error
Keywords:
User:          SYSTEM
Computer:      DESKTOP-3S4705U
Description:
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = DESKTOP-3S4705U; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1700; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\WMI : SELECT * FROM BatteryStaticData; ResultCode = 0x80041010; PossibleCause = Unknown
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WMI-Activity" Guid="{1418ef04-b0b4-4623-bf7e-d74ab47bbdaa}" />
    <EventID>5858</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x4000000000000000</Keywords>
    <TimeCreated SystemTime="2021-08-15T19:41:31.7414122Z" />
    <EventRecordID>240</EventRecordID>
    <Correlation />
    <Execution ProcessID="3128" ThreadID="7940" />
    <Channel>Microsoft-Windows-WMI-Activity/Operational</Channel>
    <Computer>DESKTOP-3S4705U</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <Operation_ClientFailure xmlns="http://manifests.microsoft.com/win/2006/windows/WMI">
      <Id>{00000000-0000-0000-0000-000000000000}</Id>
      <ClientMachine>DESKTOP-3S4705U</ClientMachine>
      <User>NT AUTHORITY\SYSTEM</User>
      <ClientProcessId>1700</ClientProcessId>
      <Component>Unknown</Component>
      <Operation>Start IWbemServices::ExecQuery - ROOT\WMI : SELECT * FROM BatteryStaticData</Operation>
      <ResultCode>0x80041010</ResultCode>
      <PossibleCause>Unknown</PossibleCause>
    </Operation_ClientFailure>
  </UserData>
</Event>
Comment 1 xiagao 2021-08-16 09:05:12 UTC 
Use virtio-win-guest-tools to update drivers/start balloon service, also hit WMI-Activity error(ID: 5858)
Comment 2 Vadim Rozenfeld 2022-01-18 09:24:32 UTC 
Does it happen on a freshly installed VM?
Is it a 100% reproducible or does it happen on a some particular VM?

The return code 0x80041010 returned from IWbemServices::ExecQuery call
means WBEM_E_INVALID_CLASS which probably indicates that WMI repository 
has been corrupted.
Can you please run "winmgmt /verifyrepository" from the elevated command prompt on this
VM to see if the repository has an issue?

Thanks,
Vadim.
Comment 3 xiagao 2022-01-18 09:56:25 UTC 
(In reply to Vadim Rozenfeld from comment #2)
> Does it happen on a freshly installed VM?
> Is it a 100% reproducible or does it happen on a some particular VM?
It can be 100% reproduced.
I tried with two vms(win2019,win10-64),all hit this issue, one is old and the other is freshly installed.

> 
> The return code 0x80041010 returned from IWbemServices::ExecQuery call
> means WBEM_E_INVALID_CLASS which probably indicates that WMI repository 
> has been corrupted.
> Can you please run "winmgmt /verifyrepository" from the elevated command
> prompt on this
> VM to see if the repository has an issue?
The repository seems works
It returnes that "WMI repository is consistent"

> 
> Thanks,
> Vadim.
Comment 4 Vadim Rozenfeld 2022-01-18 10:58:58 UTC 
(In reply to xiagao from comment #3)
> (In reply to Vadim Rozenfeld from comment #2)
> > Does it happen on a freshly installed VM?
> > Is it a 100% reproducible or does it happen on a some particular VM?
> It can be 100% reproduced.
> I tried with two vms(win2019,win10-64),all hit this issue, one is old and
> the other is freshly installed.
> 
> > 
> > The return code 0x80041010 returned from IWbemServices::ExecQuery call
> > means WBEM_E_INVALID_CLASS which probably indicates that WMI repository 
> > has been corrupted.
> > Can you please run "winmgmt /verifyrepository" from the elevated command
> > prompt on this
> > VM to see if the repository has an issue?
> The repository seems works
> It returnes that "WMI repository is consistent"

But we are still getting Event 5858 in the event log, right?
Could you please upload the event log?

Best,
Vadim.

> 
> > 
> > Thanks,
> > Vadim.
Comment 6 Kostiantyn Kostiuk 2022-09-22 08:34:36 UTC 
About ResultCode = 0x80041032:

From MS docs: https://learn.microsoft.com/en-us/troubleshoot/windows-client/system-management-components/wmi-activity-event-5858-logged-with-resultcode-0x80041032

```
WMI-Activity Error 5858 with ResultCode = 0x80041032 (WBEM_E_CALL_CANCELLED) indicates that the WMI caller has successfully issued IWbemServices:ExecQuery, but has released the IWbemContext object before retrieving the full result set using the IEnumWbemClassObject::Next method. 
```

The balloon driver does absolutely the same. We have a separate thread that periodically sends WMI requests. If the service manager sends the stop request, the separate thread just exits. I think this is correct, we don't need to wait until the WMI request finishes.


About ResultCode = 0x80041010 - continue investigation.
Note You need to log in before you can comment on or make changes to this bug.