7

For some reason, my C# application is being terminated by svchost.exe and I'm trying to understand why. It was terminating the application silently until I turned on Silent Process Exit logging using Gflags.exe from the Windows Debugging Tools. It happens infrequently on machines that I can't running debugging tools on (customer pcs).

The event doesn't really provide me with much info to go on. The termination code is 805306369=0x30000001, but I can't seem to find anything useful online that would tell me how to interpret that number.

I was hoping that the Silent Process Exit log would shed some light on this, but now I just have more questions.

Any advice would be appreciated. Thanks for your help in advance!

Here is the event in question:

Log Name:      Application
Source:        Microsoft-Windows-ProcessExitMonitor
Date:          06/05/2013 04:12:17 PM
Event ID:      3001
Task Category: None
Level:         Information
Keywords:      Classic
User:          SYSTEM
Computer:      PC
Description:
The process 'C:\Users\Administrator\AppData\Local\MyApp.exe' was terminated by the process 'C:\Windows\System32\svchost.exe' with termination code -805306369. The creation time for the exiting process was 0x01ce61ad4e81c70c.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-ProcessExitMonitor" Guid="{FD771D53-8492-4057-8E35-8C02813AF49B}" EventSourceName="Process Exit Monitor" />
    <EventID Qualifiers="16384">3001</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2013-06-05T20:12:17.000000000Z" />
    <EventRecordID>2350</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>PC</Computer>
    <Security UserID="xxxxx" />
  </System>
  <EventData Name="EVENT_PROCESSTERMINATION_CROSSPROCESS">
    <Data Name="param1">C:\Users\Administrator\AppData\Local\MyApp.exe</Data>
    <Data Name="param2">C:\Windows\System32\svchost.exe</Data>
    <Data Name="param3">-805306369</Data>
    <Data Name="param4">01ce61ad4e81c70c</Data>
  </EventData>
</Event>
Mike
  • 185
  • 1
  • 1
  • 7
  • Could this be machine shutdown where you're being forced to shutdown because you didn't react to the shutdown message fast enough? – Oren Jun 07 '13 at 20:22
  • Thanks for your feedback. I can tell from the logs that the computer is not being shutdown in any of the instances that I've seen so far. – Mike Jun 07 '13 at 21:37
  • `svchost.exe` does a lot of different things, so the first thing to do is to use Task Manager to work out which actual service the process ID corresponds to. (Since the PIDs are different on each run, you need to do this before the machine is rebooted, and preferably as soon as possible after the error occurs.) – Harry Johnston Jun 09 '13 at 21:57
  • I don't actually see the process id for the specific svchost.exe process in the event. There are the event id and the evernt record id, but that seems to be it unless I'm missing something obvious (wouldn't be surprising). Thanks. – Mike Jun 10 '13 at 16:36
  • 1
    @Mike did you ever find the cause of this? We are having similar issues with an application being terminated by `svchost.exe`. – nietras Sep 03 '18 at 09:40
  • I have the same issue. Does anyone found why this happens? – ekalchev Oct 15 '20 at 08:15

0 Answers0