问题描述

在Azure Cloud Service的实例中，收集到各种 Error Event 内容，本文针对所收集的三种Event进行解析。

1: This operation is not supported on this filesystem. (0x89000020) 

<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>

    <System>

        <Provider Name='Microsoft-Windows-Defrag' />

        <EventID Qualifiers='32768'>257</EventID>

        <Level>2</Level>

        <Task>0</Task>

        <Keywords>0x80000000000000</Keywords>

        <TimeCreated SystemTime='2021-11-08T02:30:00.000000000Z' />

        <EventRecordID>2465</EventRecordID>

        <Channel>Application</Channel>

        <Computer>RD00155D439EE2</Computer>

        <Security />

    </System>

    <EventData>

        <Data>SYSTEM</Data>

        <Data>This operation is not supported on this filesystem. (0x89000020)</Data>

        <Binary>00000000A40500005105000000000000629468641336AAB85B55B1B5B038000000000000</Binary>

    </EventData>

</Event>


\Windows\System32\winspool.drv

<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>

    <System>

        <Provider Name='Microsoft-Windows-Perflib' Guid='{13B197BD-7CEE-4B4E-8DD0-59314CE374CE}' EventSourceName='Perflib' />

        <EventID Qualifiers='49152'>1010</EventID>

        <Version>0</Version>

        <Level>2</Level>

        <Task>0</Task>

        <Opcode>0</Opcode>

        <Keywords>0x80000000000000</Keywords>

        <TimeCreated SystemTime='2021-11-08T01:54:07.000000000Z' />

        <EventRecordID>2464</EventRecordID>

        <Correlation />

        <Execution ProcessID='0' ThreadID='0' />

        <Channel>Application</Channel>

        <Computer>RD00155D43BA04</Computer>

        <Security />

    </System>

    <UserData>

        <EventXML xmlns='Perflib'>

\Windows\System32\winspool.drv</param1>

            <param2>Spooler</param2>

            <binaryDataSize>8</binaryDataSize>

            <binaryData>BA06000000000000</binaryData>

        </EventXML>

    </UserData>

</Event>


\Windows\System32\bitsperf.dll

<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>

    <System>

        <Provider Name='Microsoft-Windows-Perflib' Guid='{13B197BD-7CEE-4B4E-8DD0-59314CE374CE}' EventSourceName='Perflib' />

        <EventID Qualifiers='49152'>1008</EventID>

        <Version>0</Version>

        <Level>2</Level>

        <Task>0</Task>

        <Opcode>0</Opcode>

        <Keywords>0x80000000000000</Keywords>

        <TimeCreated SystemTime='2021-11-08T01:54:07.000000000Z' />

        <EventRecordID>2463</EventRecordID>

        <Correlation />

        <Execution ProcessID='0' ThreadID='0' />

        <Channel>Application</Channel>

        <Computer>RD00155D43BA04</Computer>

        <Security />

    </System>

    <UserData>

        <EventXML xmlns='Perflib'>

            <param1>BITS</param1>

\Windows\System32\bitsperf.dll</param2>

            <binaryDataSize>8</binaryDataSize>

            <binaryData>0200000000000000</binaryData>

        </EventXML>

    </UserData>

</Event>


   

问题解答

 1: This operation is not supported on this filesystem. (0x89000020)

<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>
    <System>
        <Provider Name='Microsoft-Windows-Defrag' />
        <EventID Qualifiers='32768'>257</EventID>
        <Level>2</Level>
        <Task>0</Task>
        <Keywords>0x80000000000000</Keywords>
        <TimeCreated SystemTime='2021-11-08T02:30:00.000000000Z' />
        <EventRecordID>2465</EventRecordID>
        <Channel>Application</Channel>
        <Computer>RD00155D439EE2</Computer>
        <Security />
    </System>
    <EventData>
        <Data>SYSTEM</Data>
        <Data>This operation is not supported on this filesystem. (0x89000020)</Data>
        <Binary>00000000A40500005105000000000000629468641336AAB85B55B1B5B038000000000000</Binary>
    </EventData>
</Event>

Defrag 是windows系统的磁盘上进行碎片文件进行整理以提高系统性能。 以上的错误就是Windows在进行碎片整理时出的错误。

Event ID: 257. The volume was not optimized because an error was encountered: This operation is not supported on this filesystem. (0x89000020) : ​​https://social.technet.microsoft.com/Forums/en-US/ee11d4c9-a95c-4536-a438-bf9bbffcec4f/event-id-257-the-volume-was-not-optimized-because-an-error-was-encountered-this-operation-is-not​​

Defrag: ​​https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/defrag​​

 

2: Perflib 1010 D:\Windows\System32\winspool.drv

<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>
    <System>
        <Provider Name='Microsoft-Windows-Perflib' Guid='{13B197BD-7CEE-4B4E-8DD0-59314CE374CE}' EventSourceName='Perflib' />
        <EventID Qualifiers='49152'>1010</EventID>
        <Version>0</Version>
        <Level>2</Level>
        <Task>0</Task>
        <Opcode>0</Opcode>
        <Keywords>0x80000000000000</Keywords>
        <TimeCreated SystemTime='2021-11-08T01:54:07.000000000Z' />
        <EventRecordID>2464</EventRecordID>
        <Correlation />
        <Execution ProcessID='0' ThreadID='0' />
        <Channel>Application</Channel>
        <Computer>RD00155D43BA04</Computer>
        <Security />
    </System>
    <UserData>
        <EventXML xmlns='Perflib'>
            <param1>D:\\Windows\\System32\\winspool.drv</param1>
            <param2>Spooler</param2>
            <binaryDataSize>8</binaryDataSize>
            <binaryData>BA06000000000000</binaryData>
        </EventXML>
    </UserData>
</Event>

Perfilb的1010事件是在使用某个DLL时返回的错误，winspool.drv ( Windows Printer Spooler)这个文件是windows打印机的后台程序。参考：​​https://www.processlibrary.com/en/directory/files/winspool/22326/​​

 

3: 1008 D:\Windows\System32\bitsperf.dll

<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>
    <System>
        <Provider Name='Microsoft-Windows-Perflib' Guid='{13B197BD-7CEE-4B4E-8DD0-59314CE374CE}' EventSourceName='Perflib' />
        <EventID Qualifiers='49152'>1008</EventID>
        <Version>0</Version>
        <Level>2</Level>
        <Task>0</Task>
        <Opcode>0</Opcode>
        <Keywords>0x80000000000000</Keywords>
        <TimeCreated SystemTime='2021-11-08T01:54:07.000000000Z' />
        <EventRecordID>2463</EventRecordID>
        <Correlation />
        <Execution ProcessID='0' ThreadID='0' />
        <Channel>Application</Channel>
        <Computer>RD00155D43BA04</Computer>
        <Security />
    </System>
    <UserData>
        <EventXML xmlns='Perflib'>
            <param1>BITS</param1>
            <param2>D:\\Windows\\System32\\bitsperf.dll</param2>
            <binaryDataSize>8</binaryDataSize>
            <binaryData>0200000000000000</binaryData>
        </EventXML>
    </UserData>
</Event>

这个报错内容中提到bitsperf.dll是一个用于收集performance的dll。参考: ​​https://www.processlibrary.com/en/directory/files/bitsperf/4587/​​​ ， ​​https://freek.ws/2015/05/16/how-to-fix-perflib-error-1008/​​

 

当在复杂的环境中面临问题，格物之道需：浊而静之徐清，安以动之徐生。 云中，恰是如此!