Share via

Event ID 28 Error setting traits on Provider

Question

Wednesday, August 16, 2017 6:23 PM

Hi!

Today when I started my laptop, there was more then usual harddisk activity during showing of the login-screen of Windows 10. You know, there where you have to type your password etc. Very rarely this happens, I learned to count to ten to let it ease a bit. Just to avoid weird Windows starts. :-)

I found unfortunately two event ID 28's, as can be seen in the screenshot below. In English it means 'Error setting traits on Provider' followed by some weird codes. The only thing different I noticed this start of Windows was that almost immedieatly after logging in a notification of NVIDIA appeared telling me there are - once again - driver updates available. That would explain the 'extra' HD-activity, namely downloading and unpacking the update files. Not that I wanted to update anyway, but no one seems to care about that anymore.

For the rest all works fine, after shutting down the computer and later todat starting it again, event ID 28 did not happen again. So I will - teeth grinding - ignore it. I am curious what this means however, never saw it before. Can it indeed have something to do with the NVIDIA driver download and unpacking? When should I actually be REALLY alarmed over events in the Windows logs? Is there some kind of general 'rule of thumb' for that?

From what I understand and what was always told me, as an end user I shouldn't care too much about it as long as everything works fine. I try to behave like that, although sometimes that is hard to do :-) The only thing I do know for sure is that there is nothing to be done to avoid those errors. They just sometimes happen. I also understand that Kernel event traces are mainly meant for developers of software and so on, to get informed if something doesn't go as planned. But what does 'provider' mean? And are such errors 'destructive' or can I assume if they do not appear again (or at least just rarely) I am safe?

Greetings!

Ron.

All replies (9)

Monday, August 21, 2017 4:54 AM ✅Answered

Hi Ron,

It’s OK. You could continue use your computer normally. As you said, no need to restore from image for an event.

Best regards,

Carl

Please remember to mark the replies as answers if they help.
If you have feedback for TechNet Subscriber Support, contact [email protected].

Thursday, August 17, 2017 8:28 AM

Hi Ron1970,

If you could work fine, you don’t need to monitor this event.

Always the event occurred by event tracing provider. You could use Regedit and searched your local machine for{03a70c9d-084b-4905-b341-f6377e734858}.

Also you could update the video driver from the official website of the manufacturer.

Or you could update the system version.

For event viewer log, it has no rule of thumb. the system generates a lot of event log. Some are useful and some are useless. When your system can’ work fine, you could check it and some event ID could provide information to help you.

Event Tracing for Windows (ETW) provides application programmers the ability to start and stop event tracing sessions, instrument an application to provide trace events, and consume trace events. Trace events contain an event header and provider-defined data that describes the current state of an application or operation. You can use the events to debug an application and perform capacity and performance analysis.

Hope it will be helpful to you

Please remember to mark the replies as answers if they help.
If you have feedback for TechNet Subscriber Support, contact [email protected].

Thursday, August 17, 2017 11:33 AM

Hi!

Thanks for the answer! I did a search in regedit, but it didn't find any of both keys that were associated with both errors. Does that mean anything? When I googled on those strings, it looks like they might have something to do with 'appraiser instrumentation'. Whatever that is.

In the past, I restored images for such errors, but it really started to get too time consuming and tyering for me. Must accept Windows generates errors and I as a humble end user can't do anything about that.

By the way: are such incidental event id's SESSION-based? With that I mean, that if you shut down or restart a system and they don't appear again, all is fine? They can't be destructive and break something seriously permanently deep inside Windows?

Greetings,

Ron.

Friday, August 18, 2017 12:40 PM

Hi Ron,

Thank you for your update.

Yes, if it is a incidental event id’s session, it is fine. For example, if you want to open something, but it can’t be opened. It also could be recorded in event viewer. It could be caused by some process hang or are stuck. If you close it or restart, it could be OK.

Each machine will produce various kinds of event, but the machine can work normally.(It's my test PC)

If we can’t get something work, we could check the event log to get information to help troubleshoot.

I guess that this issue could be caused by application. After you restart, it works fine.

I suggest that you could create a system restore point, you could use the system restore to get an earlier state.

Hope it will be helpful to you

Please remember to mark the replies as answers if they help.
If you have feedback for TechNet Subscriber Support, contact [email protected].

Friday, August 18, 2017 1:27 PM

Hi!

Thanks again! So basically I should ignore those errors, including event ID 28 ;o) I already suspected that. But sometimes I just am curious what's going on. Probably I will never find an answer to that. Restore points are something I make daily. However, I noticed that system restore regularly generates new events, some even worse then the ones you would do a restore for. So I use that one very sparse nowadays. In worst case I prefer restoring an image from an earlier date. But I assume in this case that would be a huge waste of time.

Greetings,

Ron.

Saturday, August 19, 2017 6:51 AM

Hi Ron,

Yes, I agree with you.

Also sometimes we may not find the error, but after a restart, the issue could be solved automatically. But for event log, it still has a useful information to help us troubleshooting. Just in most cases we can ignore.

System Restore is a way to revert to an earlier state, but sometimes there may be a restore failure, so we also could set several restore points.

I think that you also could create a system image backup. Then we could use the backup image to restore.

https://support.microsoft.com/en-us/help/17127/windows-back-up-restore

Hope it will be helpful to you

Please remember to mark the replies as answers if they help.
If you have feedback for TechNet Subscriber Support, contact [email protected].

Saturday, August 19, 2017 9:40 AM

HI! Yes, images I make. But I think in this specific case I shouldn't waste a lot of time on restoring an image, right? After all, everything is working fine. Do you agree with me I should leave everything as it is now and just continue? Greetings, Ron.

Monday, August 21, 2017 10:27 AM

Hi! Super, once again thanks for all your answers and help!!!! Greetings, Ron.

Monday, August 21, 2017 11:11 AM

Hi Ron,

You're welcome.

If any further help needed, please feel free to post back.

Best regards,

Carl

Please remember to mark the replies as answers if they help.
If you have feedback for TechNet Subscriber Support, contact [email protected].