Solved Suppress the Suppression of Eventlog messages.

VaultDweller · Apr 3, 2023

On my system running Windows 11 22H2 I am getting the following re occur in the Application log.

The EventSystem sub system is suppressing duplicate event log entries for a duration of 86400 seconds.
The suppression timeout can be controlled by a REG_DWORD value named SuppressDuplicateDuration under the following registry key: HKLM\Software\Microsoft\EventSystem\EventLog.

When checking the details all it shows is a process ID which is useless for identifying the root cause of the repetitive messages as when you reboot it is no longer valid.

Microsoft threw their hands up in the air at how to deal with this and I came up with my own idea..
1) Back up the system using Macrium reflect to another PC
2) Delete the suspected entries from the registry under HKLM\Software\Microsoft\EventSystem which are the items for which messages are being suppressed a group at a time I.E all the GUIDS related to comobjects.
3) Note what is happening and if there is anything can be done about it.
4) Do something or not do something to rectify the messages and stop them causing the over all message.
5) Restore to my backup or carry on with my system with the messages sorted.

Either way at that point the problem should be fixed or I know its a non issue however at the moment I feel it is an issue as:
There are messages being logged that may not really need to be.
There are so many of these messages being logged that it became necessary to hide them all inside a bulk one off message.
Hiding the fact that they are happening by doing this is not really fixing anything its just hiding it and making things inefficient.

Anyone have any thoughts on this or a quicker way of doing it?, as Microsofts techs had no idea how to suppress the suppression.

glasskuter · Apr 3, 2023

The explanation I found on the web about this error says it is stating that an application is attempting to record several identical events. In order to prevent a possible performance degradation because of this, the system is supressing the logging of these events for the time interval specified (usually 86400 seconds or 24 hours).

I believe this is only an informational message telling you that duplicate log entries will not be shown for the specified time. The other events recorded before this one should provide some clues about the actual problem.

THINGS TO TRY
What does reliability monitor show? Search reliability>select view reliability history You can click on any fault in red and expand it for more information.

Make sure you are running the latest bios.

Perform a clean boot to eliminate software conflict causing the issue. If it doesn't happen in a clean boot, you have some software conflicting with Windows. Brink's procedure will help you weed out which one. Perform a Clean Boot in Windows 11 to Troubleshoot Software Conflicts Tutorial

Make sure you have no corrupt system files that is causing this problem. Open a command prompt as administrator and type sfc /scannow
Pay attention to the scan results to see if SFC found anything it could not repair. If it found corruption it could not fix followup with this command (note the spaces)
dism /online /cleanup-image /restorehealth
Restart computer

garlin · Apr 3, 2023

I'm wondering why MS support hasn't suggested running Process Monitor from Sysinternals. If something is spamming event logs fast enough to trigger SuppressDuplicateDuration, it should be busy enough to view from ProcMon.

If you enable Audit Process Creation policy, Windows will log every process ID, and its command line or executable. Reference that PID against what was reported as the suppressed event source.

zbook · Apr 3, 2023

No definitive solution but these were some links that I found:

EventTracker KB --Event Id: 4625 Source: EventSystem

Windows Security Log Event ID 4625 - An account failed to log on

4625(F) An account failed to log on. - Windows 10

Describes security event 4625(F) An account failed to log on. This event is generated if an account logon attempt failed for a locked out account.

learn.microsoft.com

VaultDweller · Apr 3, 2023

glasskuter said:
The explanation I found on the web about this error says it is stating that an application is attempting to record several identical events. In order to prevent a possible performance degradation because of this, the system is supressing the logging of these events for the time interval specified (usually 86400 seconds or 24 hours).

I believe this is only an informational message telling you that duplicate log entries will not be shown for the specified time. The other events recorded before this one should provide some clues about the actual problem.

THINGS TO TRY
What does reliability monitor show? Search reliability>select view reliability history You can click on any fault in red and expand it for more information.

glasskuter said:
>> It's perfectly fine I had Microsoft Techs check it.

glasskuter said:
Make sure you are running the latest bios.
>> I am this machine is only a couple of weeks old.

glasskuter said:
Perform a clean boot to eliminate software conflict causing the issue. If it doesn't happen in a clean boot, you have some software conflicting with Windows. Brink's procedure will help you weed out which one. Perform a Clean Boot in Windows 11 to Troubleshoot Software Conflicts Tutorial

O.K Have noted that link and will check it out.

glasskuter said:
Make sure you have no corrupt system files that is causing this problem. Open a command prompt as administrator and type sfc /scannow
Pay attention to the scan results to see if SFC found anything it could not repair. If it found corruption it could not fix followup with this command (note the spaces)
dism /online /cleanup-image /restorehealth
Restart computer

Already done by both myself and Microsoft Techs.

zbook · Apr 3, 2023

Please run the V2 log collector and post a share link into this thread using one drive, drop box, or google drive.

BSOD - Posting Instructions

BSOD - Posting Instructions This will show you how to help provide needed information about your system and dump files. It will not contain any personal or sensitive information about you or your data. To get better help with your Windows BSOD issue, please read these instructions and follow...

www.elevenforum.com

VaultDweller · Apr 3, 2023

garlin said:
I'm wondering why MS support hasn't suggested running Process Monitor from Sysinternals. If something is spamming event logs fast enough to trigger SuppressDuplicateDuration, it should be busy enough to view from ProcMon.

If you enable Audit Process Creation policy, Windows will log every process ID, and its command line or executable. Reference that PID against what was reported as the suppressed event source.

I don't think their support is advanced enough for this and in some cases work on scripted responses.
The Process Monitor is a good recommendation barring a couple of things, more oft than not you don't realize the event has occurred until after you have rebooted and you don't really want to spend all day waiting for that message to turn up 86400 seconds = one day. The PID has gone out the Window <forgive the pun> or it is a completely generic thing like Shell host or dcom services but no explicit explanation of what the shell host was executing or which dcom service was running or what it was doing. So this may help but you have to be really on top of things if you are sitting on top of the machine at the time it happens.
Audit Process Creation Policy sounds like a good idea Ive not tried that before so I'll have a bit of a learning curve ahead.

Thanks for the response.

VaultDweller · Apr 3, 2023

zbook said:
Please run the V2 log collector and post a share link into this thread using one drive, drop box, or google drive.

BSOD - Posting Instructions

BSOD - Posting Instructions This will show you how to help provide needed information about your system and dump files. It will not contain any personal or sensitive information about you or your data. To get better help with your Windows BSOD issue, please read these instructions and follow...

www.elevenforum.com

Does it still count if I don't have a BSOD?

VaultDweller · Apr 3, 2023

zbook said:
No definitive solution but these were some links that I found:

EventTracker KB --Event Id: 4625 Source: EventSystem

Windows Security Log Event ID 4625 - An account failed to log on

4625(F) An account failed to log on. - Windows 10

Describes security event 4625(F) An account failed to log on. This event is generated if an account logon attempt failed for a locked out account.

learn.microsoft.com

Saw that one and was passed on to me by the MS Techs too, I don't think anything there is relevant as the install is quite new, the only thing I can think of is third party apps like GCC and that sort of thing spamming the Application log but the events are being suppressed.

zbook · Apr 3, 2023

VaultDweller said:
Does it still count if I don't have a BSOD?

The log collector was designed for BSOD and collects files (event viewer, etc.)

VaultDweller · Apr 3, 2023

garlin said:
I'm wondering why MS support hasn't suggested running Process Monitor from Sysinternals. If something is spamming event logs fast enough to trigger SuppressDuplicateDuration, it should be busy enough to view from ProcMon.

If you enable Audit Process Creation policy, Windows will log every process ID, and its command line or executable. Reference that PID against what was reported as the suppressed event source.

I'm just looking at Process monitor at the moment - one very painful aspect to it you can't sort by the column headers. UGGH! I feel like I need a big wooden club and a beard at this point.

zbook · Apr 3, 2023

Curiosity: On a very frequent basis I'm viewing system and application event logs.

How often do you search the application event logs and what are you generally looking for?

Also what methods are you using to search?

garlin · Apr 3, 2023

VaultDweller said:
I don't think their support is advanced enough for this and in some cases work on scripted responses.
The Process Monitor is a good recommendation barring a couple of things, more oft than not you don't realize the event has occurred until after you have rebooted and you don't really want to spend all day waiting for that message to turn up 86400 seconds = one day. The PID has gone out the Window <forgive the pun> or it is a completely generic thing like Shell host or dcom services but no explicit explanation of what the shell host was executing or which dcom service was running or what it was doing. So this may help but you have to be really on top of things if you are sitting on top of the machine at the time it happens.
Audit Process Creation Policy sounds like a good idea Ive not tried that before so I'll have a bit of a learning curve ahead.

I presume you've installed the March 2023 updates? Because we've passed the DCOM hardening deadline.

See if this applies to your system:
KB5004442 Manage changes for Windows DCOM Server Security Feature Bypass (CVE-2021-26414)

VaultDweller · Apr 3, 2023

Okay this is just the first 8% of what I can see in Process Monitor.

VaultDweller · Apr 3, 2023

All of this overly complicated for something that should be very simple. Suppress Messages Yes / No.

VaultDweller · Apr 3, 2023

zbook said:
Curiosity: On a very frequent basis I'm viewing system and application event logs.

How often do you search the application event logs and what are you generally looking for?

Also what methods are you using to search?

Simply viewing the event logs saw this event then sorted by event id and found it happening on a daily basis.

VaultDweller · Apr 3, 2023

VaultDweller said:
Does it still count if I don't have a BSOD?

Here we go...

VaultDweller · Apr 3, 2023

Okay the I found the event occurring again and I filtered the the data for it in Process Monitor and all I ended up getting was a lot of lines mentioning ServiceHost but nothing else related to it, I am going to have a read of the Process Monitor doco again because I must have done something wrong.

zbook · Apr 3, 2023

All of the entries were preceded by a user profile entry: The User Profile Service has stopped.

Consider google searching problems related to the user profile.

One or more of these may be related:

Delete User Profile in Windows 10

How to Delete User Profile of an Account in Windows 10

www.tenforums.com

Fix User Profile Service Failed the Sign-in Error in Windows 10

How to Fix 'The User Profile Service service failed the sign-in. User Profile cannot be loaded.' Error in Windows 10

www.tenforums.com

User Profile Service Event IDs 1500, 1511, 1530, 1533, 1534, 1542

Learn how to troubleshoot User Profile Service Event IDs on Windows. This is applicable to Event IDs, 1500, 1511, 1530, 1533, 1534, 1542.

www.thewindowsclub.com

The logs displayed BSOD.

Did you want to open a thread in the applicable forum room or continue in this thread?

These were some findings that were not related to the thread title seen in the log files:

Code:

Event[7402]
  Log Name: Application
  Source: Microsoft-Windows-User Profiles Service
  Date: 2023-04-03T19:43:38.1610000Z
  Event ID: 1532
  Task: N/A
  Level: Information
  Opcode: Info
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: AMD-X670E
  Description:
The User Profile Service has stopped. 



Event[7403]
  Log Name: Application
  Source: Microsoft-Windows-EventSystem
  Date: 2023-04-03T19:44:18.8000000Z
  Event ID: 4625
  Task: N/A
  Level: Information
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: AMD-X670E
  Description:
The EventSystem sub system is suppressing duplicate event log entries for a duration of 86400 seconds.  The suppression timeout can be controlled by a REG_DWORD value named SuppressDuplicateDuration under the following registry key: HKLM\Software\Microsoft\EventSystem\EventLog.

Code:

Event[16952]
  Log Name: System
  Source: volmgr
  Date: 2023-04-02T01:46:13.6040000Z
  Event ID: 46
  Task: N/A
  Level: Error
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: AMD-X670E
  Description:
Crash dump initialization failed!

Code:

Event[17128]
  Log Name: System
  Source: volmgr
  Date: 2023-04-02T02:00:52.5590000Z
  Event ID: 46
  Task: N/A
  Level: Error
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: AMD-X670E
  Description:
Crash dump initialization failed!

Code:

Event[17291]
  Log Name: System
  Source: volmgr
  Date: 2023-04-02T02:26:07.3870000Z
  Event ID: 46
  Task: N/A
  Level: Error
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: AMD-X670E
  Description:
Crash dump initialization failed!

Code:

Event[17743]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2023-04-03T10:48:14.0430000Z
  Event ID: 29
  Task: N/A
  Level: Error
  Opcode: Info
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: AMD-X670E
  Description:
Windows failed fast startup with error status 0xC00000D4.

Code:

Event[10278]
  Log Name: System
  Source: Microsoft-Windows-StartupRepair
  Date: 2023-03-17T16:14:22.1840000Z
  Event ID: 1002
  Task: N/A
  Level: Information
  Opcode: Info
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: AMD-X670E
  Description:
Startup Repair failed.

Event[10279]
  Log Name: System
  Source: Microsoft-Windows-StartupRepair
  Date: 2023-03-17T16:14:22.1840000Z
  Event ID: 1121
  Task: N/A
  Level: Information
  Opcode: Info
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: AMD-X670E
  Description:
The following file necessary for Windows startup was corrupt: e:\windows\system32\drivers\tpm.sys

VaultDweller · Apr 4, 2023

I think I will skip it this time, I think I've found the source of some of those BSODS, I manually o/c'd my RAM with manual settings, spent quite a lot of time doing it too, then just in case I had caused any system corruption in the process I re installed windows - so there would be no evidence of any issues from that ; however my system just got a new BIOS update not so long ago after it was discovered there was a problem with the TPM in the previous one and in the process of doing that update it cleared all the CMOS values related to the O/C except for the main one memory multiplier was set at 62x with the voltage at 1.1 no wonder it was having problems.
Today I started receiving Post code 46 which is generally related to memory failure and I had to use the button to go to BIOS so as to not lose any settings ; but there were no settings to lose as they had all been killed by the update and to top it all off they changed the minimum voltage alteration for the memory. Where I used to be able to adjust in .10v increments now it's .50v which really sucks as I had my memory stable at 6200Mhz 30-36-36-76 at VDD 1.280v / VDQ 1.180V with all the timings dialed in manually over the course of a week.

I've got it back to pre dialed in values but the voltage has now been pushed to 1.400 / 1.300 I don't think I'll go through the hassle again even though it did add nearly 5000 points to my superposition score.

I will keep an eye on things with Processmonitor now that I have figured it out and if it happens again I'll jump on it and here. Needless to say most of the messages and there were a LOT about 4.6 million in 15 mins were all saying this thing or that thing succeeded but there were others like buffer overflow, lost files, insufficient permissions, timeouts, a hole plethora of errors.