You want to generate event log files to troubleshoot issues with Autodesk products run on the Windows Vista™ operating system.

For more information on this issue, including potential causes, workarounds, and resolutions, see: AutoDesk Knowledge Base Article TS1077466.

The Simple Network Management Protocol (SNMP) Event Log Extension Agent does not initialize correctly on a computer that is running Windows Vista with Service Pack 1 (SP1) or Windows Server 2008. Therefore, network management middleware cannot use SNMP to retrieve event log information. When this problem occurs, the following events are logged in the Application log:

Event ID 1020

Log Name: Application
Source: EvntAgnt
Date: Date_Time
Event ID: 1020
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: ComputerName
Description:
Error processing registry parameters. Extension agent terminating.

Event ID 2019

Log Name: Application
Source: EvntAgnt
Date: Date_Time
Event ID: 2019
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: ComputerName
Description:
SNMP Event Log Extension Agent did not initialize correctly.

Event ID 2020

Log Name: Application
Source: EvntAgnt
Date: Date_Time
Event ID: 2020
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: ComputerName
Description:
SNMP Event Log Extension Agent has terminated.

Event ID 3003

Log Name: Application
Source: EvntAgnt
Date: Date_Time
Event ID: 3003
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: ComputerName
Description:
Error positioning to end of log file — can’t get oldest log record. Handle specified is 15728660. Return code from GetOldestEventLogRecord is 223.

Consider the following scenario:

• You are running a Windows Vista-based computer in a network environment. There are multiple computers in this network.
• You assign or change the IP address for the Windows Vista-based computer. You do this either manually or by using an application.

In this scenario, you receive the following error message about a network error that concerns duplicate address detection (DAD):

Windows has detected an IP address conflict. Another computer on this network has the same IP address as this computer. Contact your network administrator for help resolving this issue. More details are available in the System event log.

Additionally, the following event is logged in the System log:

Event ID: 4199
Event Source: Tcpip
Event Type: Error
Description:
The system detected an address conflict for IP address  with the system having network hardware address . Network operations on this system may be disrupted as a result. 

When you have a Trusted Platform Module (TPM) device running on a Windows Server 2008-based computer or on a Windows Vista-based computer, one of the following events may be logged in the Application log.
Message 1

Event ID: 10
Event Source: TPM
Event Type: Error
Event Description: A buffer underflow was detected

Message 2

Event ID: 11
Event Source: TPM
Even Type: Error
Event Description: A buffer overflow was detected

The TPM driver may log these errors when the TPM status register has the bit set to indicate an overrun or an underrun during communication between the driver and the TPM device. Generally, this error indicates a platform problem.

These events are logged when the TPM device cannot be accessed successfully because of hardware issues or because of firmware issues.

On a Windows Vista-based client computer, the following event may be logged in the Application log:

Log Name: Application
Source: Microsoft-Windows-User Profiles Service
Date: Date
Event ID: 1530
Task Category: None
Level: Warning
Keywords: Classic
User: SYSTEM
Computer: ComputerName

Description:
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.

DETAIL -
1 user registry handles leaked from \Registry\User\S-1-5-21-3112862306-1016156048-4130204762-1000: Process 932 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3112862306-1016156048-4130204762-1000 

On a Windows Vista-based computer, you enable the Event Tracing for Windows (ETW) trace log. After you extract a large .psf file, and then you exam the log output, some trace events are randomly lost. If you extract the .psf file again, you may find that a random subset of the trace events is lost.

Consider the following scenario. On a Windows Vista-based computer, you start the Microsoft iSCSI Initiator service. Then, you log off an iSCSI target. In this scenario, the following event is written to the System log:

Log Name: System
Source: PlugPlayManager
Event ID: 12
Task Category: None
Level: Error
Keywords: Classic
Description: The device Device_Name (SCSI\Disk&Ven_EQLOGIC&Prod_100E-00\1&1c121344&0&000000) disappeared from the system without first being prepared for removal.

Note: This event occurs only if the target is an unformatted (RAW) volume.

In the Application Event log on a Windows Vista computer, you may see Event 2004 as follows:

Source: usbperf
Event ID: 2004
Level: Error
Usbperf data collection failed. Collect function called with usupported Query Type.

A computer that is running Windows Vista may stop responding. Or, programs that are running on this computer may stop responding. Also, you may receive a Stop error in Windows Vista. Moreover, an event that resembles the following may be logged in the System log:

Source: Application Popup
Event ID: 1801
Level: Error
User: N/A
Text: The hardware has reported an uncorrectable memory error. 

On a Windows Vista-based computer, events that resemble the following events are logged in the Diagnostics-Performance/Operational event log:

Example 1

Event Type: Error, Warning, or Critical
Event Source: Diagnostic-Performance
Event ID: 203
Description:
This service caused a delay in the system shutdown process.

Example 2

Event Type: Error, Warning, or Critical
Event Source: Diagnostic-Performance
Event ID: 101
Description:
This application took longer than usual to start up, resulting in a performance degradation in the system startup process.

Example 3

Event Type: Error, Warning, or Critical
Event Source: Diagnostic-Performance
Event ID: 401
Description:
This process is using up processor time and is impacting the performance of Windows