For some reason, my C# application is being terminated by svchost.exe and I'm trying to understand why. It was terminating the application silently until I turned on Silent Process Exit logging using Gflags.exe from the Windows Debugging Tools. It happens infrequently on machines that I can't running debugging tools on (customer pcs).
The event doesn't really provide me with much info to go on. The termination code is 805306369=0x30000001, but I can't seem to find anything useful online that would tell me how to interpret that number.
I was hoping that the Silent Process Exit log would shed some light on this, but now I just have more questions.
Any advice would be appreciated. Thanks for your help in advance!
Here is the event in question:
Log Name: Application
Source: Microsoft-Windows-ProcessExitMonitor
Date: 06/05/2013 04:12:17 PM
Event ID: 3001
Task Category: None
Level: Information
Keywords: Classic
User: SYSTEM
Computer: PC
Description:
The process 'C:\Users\Administrator\AppData\Local\MyApp.exe' was terminated by the process 'C:\Windows\System32\svchost.exe' with termination code -805306369. The creation time for the exiting process was 0x01ce61ad4e81c70c.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-ProcessExitMonitor" Guid="{FD771D53-8492-4057-8E35-8C02813AF49B}" EventSourceName="Process Exit Monitor" />
<EventID Qualifiers="16384">3001</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2013-06-05T20:12:17.000000000Z" />
<EventRecordID>2350</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>Application</Channel>
<Computer>PC</Computer>
<Security UserID="xxxxx" />
</System>
<EventData Name="EVENT_PROCESSTERMINATION_CROSSPROCESS">
<Data Name="param1">C:\Users\Administrator\AppData\Local\MyApp.exe</Data>
<Data Name="param2">C:\Windows\System32\svchost.exe</Data>
<Data Name="param3">-805306369</Data>
<Data Name="param4">01ce61ad4e81c70c</Data>
</EventData>
</Event>
User contributions licensed under CC BY-SA 3.0