Reliability Monitor suddenly shows blank history (except critical events and stability index)

Understood.

I'm fairly sure the issue is pretty trivial and requires minor nudge somewhere. But where?!

There's probably also very simple reason why this has happened... My current and only bet is that it's been triggered by the dated program that I ultimately decided to run on this day - had it installed since 2017 but never had opportunity to sort it out - that was continuously crashing despite applying various compatibility settings (Windows 7 and the likes); and I eventually decided to remove it and reinstall it from scratch - and it then worked. But then I spotted that Reliability Monitor contains the aforementioned crashes only.

It's also interesting to know why Windows suddenly got stuck in this state and cannot be repaired by itself. But I don't think I will get an answer to this question.

The fact that something allowed for this to happen does not add glory to Windows 10 itself as it reminds me form that respect of the other issue you guys helped me to resolve year ago or so.

In either case I will continue to investigate - I do have backup image back from early June and can compare relevant files etc. And will keep you posted.
 
Right, in my quest I just landed here:

ReliabilityMetricsProvider Provider


And all I can say is that the second WMI class (Win32_ReliabilityStabilityMetrics class) works as expected and returns all results in PowerShell:

Code: 
PS C:\WINDOWS\system32> get-wmiobject Win32_ReliabilityStabilityMetrics -computername 127.0.0.1 -property "SystemStabilityIndex" |
>>   select-object -first 1 SystemStabilityIndex | format-table *

SystemStabilityIndex
--------------------
               5.949

matching what I see in the Reliability Monitor, the first one (Win32_ReliabilityRecords class) seems also returning some errors:

Code: 
PS C:\WINDOWS\system32> get-wmiobject Win32_ReliabilityRecords -computername 127.0.0.1 -property Message |
>>   select-object -first 5 Message | format-list *


Message : Installation Successful: Windows successfully installed the following update:
          9NBLGGH4QGHW-Microsoft.MicrosoftStickyNotes

get-wmiobject : Generic failure
At line:1 char:1
+ get-wmiobject Win32_ReliabilityRecords -computername 127.0.0.1 -prope ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [Get-WmiObject], ManagementException
    + FullyQualifiedErrorId : GetWMIManagementException,Microsoft.PowerShell.Commands.GetWmiObjectCommand

Sticky notes app got actually updated today, so this entry is present somewhere. I am investigating...
 
My Windows 8.1 laptop returns in the latter case:

Code: 
PS C:\WINDOWS\system32> get-wmiobject Win32_ReliabilityRecords -computername 127.0.0.1 -property Message |
>>   select-object -first 5 Message | format-list *
>>


Message : Installation Successful: Windows successfully installed the following update: Security Intelligence Update
          for Microsoft Defender Antivirus - KB2267602 (Version 1.317.1926.0)

Message : Installation Successful: Windows successfully installed the following update: Security Intelligence Update
          for Microsoft Defender Antivirus - KB2267602 (Version 1.317.1900.0)

Message : Installation Successful: Windows successfully installed the following update: Security Intelligence Update
          for Microsoft Defender Antivirus - KB2267602 (Version 1.317.1832.0)

Message : Faulting application name: wwahost.exe, version: 6.3.9600.17415, time stamp: 0x545036ce
          Faulting module name: KERNELBASE.dll, version: 6.3.9600.19724, time stamp: 0x5ec5262a
          Exception code: 0xe0434352
          Fault offset: 0x0000000000007afc
          Faulting process id: 0x46d8
          Faulting application start time: 0x01d6474c8ea2162e
          Faulting application path: C:\WINDOWS\system32\wwahost.exe
          Faulting module path: C:\WINDOWS\system32\KERNELBASE.dll
          Report Id: 13732712-b340-11ea-8156-7c5cf83b9b05
          Faulting package full name: AppUp.IntelExperienceCenter_1.9.1.8_x64__8j3eq9eme6ctt
          Faulting package-relative application ID: App

Message : Installation Successful: Windows successfully installed the following update: Security Intelligence Update
          for Microsoft Defender Antivirus - KB2267602 (Version 1.317.1777.0)

And:
Code: 
PS C:\WINDOWS\system32> get-wmiobject Win32_ReliabilityRecords -property @("SourceName", "EventIdentifier") |
>>   group-object -property SourceName,EventIdentifier -noelement | sort-object -descending Count |
>>   select-object Count,Name | format-table *
>>

                                                      Count Name
                                                      ----- ----
                                                         54 Microsoft-Windows-WindowsUpdateClient, 19
                                                         18 Application Error, 1000
                                                         14 MsiInstaller, 1035
                                                         11 MsiInstaller, 1033
                                                          8 Microsoft-Windows-UserPnp, 20001
                                                          5 MsiInstaller, 1036
                                                          2 MsiInstaller, 1038


Without any errors. So I think I'm onto something here.
 
Did not have much chance or time to play with it - just found some today.

Came across this useful page:

WMI: Repository Corruption, or Not?

And can confirm that WMI repository is intact by the looks of it:

Code: 
PS C:\WINDOWS\system32> winmgmt /verifyrepository
WMI repository is consistent
PS C:\WINDOWS\system32>

Looking into the contents of the C:\Windows\System32\wbem folder I just found and launched this utility (wbemtest.exe):

1593698899245.png​


Going slowly through details:

1593698962514.png

1593698976557.png​

We're getting to this familiar choice (as per my previous posts):

1593699021411.png​

The second one gives us this:

1593699032094.png​

And its instances;

1593699074707.png​

So this is all good.

The other, problematic one:

1593699104244.png​

When I click instances I get this:

1593699149801.png
​
I'm none the wiser so far as whole WMI subject is not something I dreamed about even remotely. But the above seems confirming that some kind of data corruption has happened somewhere - and in some log possibly.

Now if I only know how to find out where exactly.

Will keep digging.
 
Nice find. Or it could simply be a logging failure not necessarily a data function failure.

You seem to have the tenacity and wits to figure it out for sure.
 
xrobwx71 said:
Or it could simply be a logging failure not necessarily a data function failure.
Click to expand...

That's quite possible - and as Reliability Monitor clears itself up somehow few weeks back every week then the issue might go away on its own in couple of weeks' time.

Or next CU will resolve it.

Or ultimately upgrade to 2004 (which I'm not inclined to allow for quite some time though) as it resets all OS logs.
 
So I played with this tool for a too long yesterday - quite an interesting one in any other circumstances, and I did learn a thing or two as well - and although still have to run it on another PC to confirm my findings and cross-reference the outputs, it would appear that although this tool produces some errors, these are simply missing WMI classes etc. due to rather messy OS itself in the first place: One can see for example recurrent and continuous since I remember WMI perf markers errors in the EventLog - yes, they are there on the list.

So I'm nearly 100% sure WMI assembly itself is fine. And nothing to see there.

Thus my attention then shifted back on the Application Event Log itself and entries surrounding midday 12/06 - so since when this problem commenced. And I can see two candidates - triggered by aforementioned dated software that I was trying to run that was then crashing - that looks like it may obfuscate something and prevent from working correctly: Error entries although looking correct, they differ syntax-wise from other errors with the same ID.

Talk about data sanity checks and system robustness against duff input!

As I'm really reluctant to clear Application Event Log which I think will resolve this problem, a question: is there a way to remove single event from it (I don't think so)?

(I sincerely trust nobody here minds me mumbling to myself about it!)
 
Manual deployment of out-of-band CU (KB4567512) has not changed a thing, obviously.

I also established that it's not possible to remove single entry from Event log - it's either everything that's get deleted, or nothing.

So assuming that duff entries in Application Event Log are a problem - which I think they are - I am guessing that upgrade to 2004 will kind-of resolve it for me as at that time all system logs will get zeroed. I will update this thread if/when that happens.

Still, I guess it's something that Microsoft should look into.
 
There we go - self-solving problem!

1595007459987.png​

Obviously what happened is this: Reliability Monitor stopped looking further than the last 5 weeks:

1595007520559.png​

And now that duff entry in the Application Event Log on 12/06 is no longer relevant, and everything works as expected.

So this thread can be marked as resolved and ultimately closed.

Regarding feedback via Feedback Hub: thanks, but no, thanks - have provided some in the past and it has just never been picked up and worked...

I probably should also have added that all commands based on

Code: 
get-wmiobject

as quoted above return normal result now. Which actually is quite interesting...
 

Has Sysnative Forums helped you? Please consider donating to help us support the site!

Back
Top