"Event: ID 0; Source: ESENT" Appears in Application Log Every Few Seconds

Article translations Article translations
Article ID: 226508 - View products that this article applies to.
This article was previously published under Q226508
Expand all | Collapse all

SYMPTOMS

When you examine the application event log in Windows 2000, you may notice the following event message appearing every few seconds:
Event: ID 0
Source: ESENT
Category: Performance

Description: grovel (1712) Unexpected Win32 error: 0x15
These events are usually preceded by the following single event:
Event ID: 12291
Source: Groveler
Category: None

Description: USN log read failure on partition drive letter
You may also receive an error message stating that the application event log is full.

CAUSE

This behavior can occur if the Single Instance Storage (SIS) Groveler service is running, but can no longer read the database file on the volume that it is supposed to manage. When the SIS Groveler service starts, it searches for volumes to manage by looking for a root folder named SIS Common Store.

The SIS service is part of the Remote Installation Service (RIS) installation and manages volumes that contain operating system images. The SIS service reduces the disk space consumed by these images by storing duplicate files in the SIS Common Store folder.

There are two situations in which the applications events listed above can occur:
  • If a volume is managed by the SIS service and is suddenly reformatted, or becomes damaged.
  • If you move a volume that contains Remote Installation images (a volume that contains a SIS Common Store folder) from one computer to an existing computer running the RIS service and then suddenly format that volume.

    NOTE: This can occur if you use the /X switch with the FORMAT command to force a volume dismount before formatting.

RESOLUTION

To resolve this issue, use the appropriate method:
  • On a computer that is no longer going to run the RIS service, remove the service with the Add/Remove Programs tool in Control Panel before formatting the volume. This also removes the SIS service and prevents the event messages from occurring.
  • Have the Groveler service reinstate your volumes by stopping and starting the Single Instance Storage Groveler service. You can do this either in the Computer Management snap-in, or by typing the following lines at a command prompt:

    net stop "Single Instance Storage Groveler"
    net start "Single Instance Storage Groveler"

MORE INFORMATION

The SIS service only manages volumes that contain a root folder named SIS Common Store.

Properties

Article ID: 226508 - Last Review: February 26, 2007 - Revision: 2.2
APPLIES TO
  • Microsoft Windows 2000 Server
  • Microsoft Windows 2000 Advanced Server
  • Microsoft Windows 2000 Datacenter Server
Keywords: 
kbenv kberrmsg kbprb KB226508

Give Feedback

 

Contact us for more help

Contact us for more help
Connect with Answer Desk for expert help.
Get more support from smallbusiness.support.microsoft.com