Windows event log ยท System7034 Service crashed unexpectedly
- System
- 2 fields
System.evtxService Control Manager
Fields EvtxECmd extracts
2 columns in the EvtxECmd CSV
- PayloadData1
Name: %ServiceName%- %ServiceName% = /Event/EventData/Data[@Name="param1"]
- PayloadData2
It has done this %Count% time(s)- %Count% = /Event/EventData/Data[@Name="param2"]
Sample event
Event XML from the map file
<Event>
<System>
<Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager"/>
<EventID Qualifiers="49152">7034</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8080000000000000</Keywords>
<TimeCreated SystemTime="2012-04-04 01:48:01.8866267"/>
<EventRecordID>15001</EventRecordID>
<Correlation/>
<Execution ProcessID="548" ThreadID="3352"/>
<Channel>System</Channel>
<Computer>WKS-WIN732BITA.shieldbase.local</Computer>
<Security/>
</System>
<EventData>
<Data Name="param1">PsExec</Data>
<Data Name="param2">1</Data>
</EventData>
</Event>References
4 links
- kb.eventtracker.com/evtpass/evtpages/EventId_7034_ServiceControlManager_45455.asp(opens in new tab)
- social.technet.microsoft.com/wiki/contents/articles/1363.windows-server-2008-event-id-7034-service-stop-operations.aspx(opens in new tab)
- social.technet.microsoft.com/wiki/contents/articles/13764.event-id-7034-service-terminated.aspx(opens in new tab)
- docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc756320(v=ws.10(opens in new tab)
Source: evtx/Maps/System_Service-Control-Manager_7034.map(opens in new tab) by Eric Zimmerman and Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)