Question Event Viewer is being spammed with 1001 ID logs ?

Toggle sidebar Toggle sidebar
124124

124124

May 24, 2025
35
1
35
Hello, my pc keeps getting spammed with event logs, i dont get any crashes and my GPU performs perfectly fine under stress & also when being benchmarked but it is still worrying . I won't post the logs because they're very large but I will comment the important parts;

They are Fault bucket , type 0 with event Name: LiveKernelEvent, under the event ID 1001. The problem signatures I get on P1 are 193, 1b8, and 1a8. They dont necessarily appear when an app crashes, or anything similar. Nothing happens at the time that these events pop (from what I know) however I am scared they'll eventually hinder performance. Any help? It's driving me a bit crazy and I'd rather fix it before it does something bad.

PC Specs
GPU: 4070 VENTUS 3X OC 12GB
CPU: i5-12600KF
MOBO: B760M GAMING X AX DDR4
RAM: Kingston FURY Beast DDR4 3200 MHz 16GB 2x8GB CL16
SSD: WD Black SN850X
PSU: ATX 750W THERMALTAKE SMART BM2
HDD: Seagate barracuda st1000dm010 1tb 3.5" sata3
MOUSE: Corsair Harpoon
KEYBOARD: Tactical Ozone Mini
 
Last edited:
Sort by date Sort by votes
Lutfij said:
Welcome to the forums, newcomer!

MOBO: B760M GAMING X AX DDR4
BIOS version for your motherboard?

PSU: ATX 750W THERMALTAKE SMART BM2
How old is the unit? That's a low end PSU. IMHO I wouldn't pair that PSU with a system that has an RTX4070 in it.

Perhaps this would be of assistance to you;
Click to expand...
Hi, my BIOS version is F14, not sure which one specifically so I apologize. The unit is about 2 years old. I know the PSU isn't exactly the best to have paired the 4070 with, nor is the CPU, and even though I am planning on upgrading, I haven't gotten any serious issues aside from some reduced GPU usage under certain circumstances. The power draw is usually all fine, though.
 
Upvote 0 Downvote
Lutfij said:
Welcome to the forums, newcomer!

MOBO: B760M GAMING X AX DDR4
BIOS version for your motherboard?

PSU: ATX 750W THERMALTAKE SMART BM2
How old is the unit? That's a low end PSU. IMHO I wouldn't pair that PSU with a system that has an RTX4070 in it.

Perhaps this would be of assistance to you;
Click to expand...
I looked at the Reddit thread you linked and I can see in the reliability monitor that I do have a similar problem. However I do seem to have had the error about 3 days ago, but since then, it has not popped up. I'll clear the logs and I'll see if it happens again.
 
Upvote 0 Downvote
Live kernel events are problems from which Windows was able to recover. The bugcheck codes you list (0x193, 0x1B8, and 0x1A8) are all graphics related, they are coming from the DirectX kernel, so all is not completely happy in your graphics area.

There should be dumps in sub-folders under C:\Windows\LiverKernelReports and these might tell us what is causing these. Upload any dumps you find in there.
 
Upvote 0 Downvote
ubuysa said:
Live kernel events are problems from which Windows was able to recover. The bugcheck codes you list (0x193, 0x1B8, and 0x1A8) are all graphics related, they are coming from the DirectX kernel, so all is not completely happy in your graphics area.

There should be dumps in sub-folders under C:\Windows\LiverKernelReports and these might tell us what is causing these. Upload any dumps you find in there.
Click to expand...
No, there are no logs at all. Ever since I noticed this error, there has been nowhere for me to grab the logs. Could this be a virus?
 
Upvote 0 Downvote
Upvote 0 Downvote
Ralston18 said:
And the 1001 Event ID errors continue - correct?

What do you see in Reliability History/Monitor?

The timeline format may reveal some pattern - look for other entries just before or at the time of the 1001 errors.
Click to expand...
Yes, they do continue. I can't really see a specific pattern.. Except for there being a Security Intelligence Update for Windows basically everyday.
 
Upvote 0 Downvote
Ralston18 said:
Security update - something like:

"Installation Successful: Windows successfully installed the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.429.119.0) - Current Channel (Broad)" ?

FYI regarding 1001 - delving in a bit deeper:

https://www.thewindowsclub.com/windows-error-reporting-event-id-1001-fixed
Click to expand...
Yes, thats exactly it. I get some like these: Installation Successful: Windows successfully installed the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.429.200.0) - Current Channel (Broad)
and also some like these: Installation Successful: Windows successfully installed the following update: 9N3RK8ZV2ZR8-Microsoft.WidgetsPlatformRuntime
 
Upvote 0 Downvote
Event Viewer has multiple logs.

E.g., Application, Security, Setup, etc....

Which log/where are the Event ID 1001's being captured?

Application - likely.

My thought simply being to determine if the captured events are "harmless" and can generally be ignored and the source log(s) cleared every so often.

Some bit of code being over zealous....

= = = =

FYI:

https://learn.microsoft.com/en-us/p...l.management/get-eventlog?view=powershell-5.1

Just try the Get-EventLog -List cmdlet

Results from my PC:

PS C:\WINDOWS\system32> Get-EventLog -List

Max(K) Retain OverflowAction Entries Log
------ ------ -------------- ------- ---
20,480 0 OverwriteAsNeeded 38,329 Application
512 7 OverwriteOlder 2,756 Dell
20,480 0 OverwriteAsNeeded 0 HardwareEvents
512 7 OverwriteOlder 0 Internet Explorer
20,480 0 OverwriteAsNeeded 0 Key Management Service
128 0 OverwriteAsNeeded 834 OAlerts
512 7 OverwriteOlder 3,274 OneApp_IGCC
5,056 7 OverwriteOlder 0 PRTG Network Monitor
20,480 0 OverwriteAsNeeded 21,582 Security
20,480 0 OverwriteAsNeeded 40,031 System
15,360 0 OverwriteAsNeeded 8,794 Windows PowerShell


PS C:\WINDOWS\system32>
 
Last edited:
Upvote 0 Downvote
Ralston18 said:
Which log/where are the Event ID 1001's being captured?
Click to expand...
Oh - sorry. They're being logged as Hardware.
This is the command results
Max(K) Retain OverflowAction Entries Log
------ ------ -------------- ------- ---
20.480 0 OverwriteAsNeeded 1.628 Application
20.480 0 OverwriteAsNeeded 0 HardwareEvents
512 7 OverwriteOlder 0 Internet Explorer
20.480 0 OverwriteAsNeeded 0 Key Management Service
128 0 OverwriteAsNeeded 10 OAlerts
20.480 0 OverwriteAsNeeded 27.408 Security
20.480 0 OverwriteAsNeeded 2.103 System
512 7 OverwriteOlder 0 Visual Studio
15.360 0 OverwriteAsNeeded 1.015 Windows PowerShell
 
Upvote 0 Downvote
The log in question being Event Viewer > Windows Logs > Security

or

Event Viewer > Applications & Services Logs > Hardware Events?

- - - -

Does this Powershell cmdlet list the 1001 EventIDs on your system?

Get-WinEvent -FilterHashtable @{logname='*';id=1001}|ft TimeCreated,Id,Message

There may a be error presented at first, but the cmdlet should continue to run.

Results are likely to be lengthy and we may need to filter it all a bit more.

The objective being to "collect" those EventID 1001 errors to examine as a group no matter which log(s) contained the errors.
 
Upvote 0 Downvote
Ralston18 said:
The log in question being Event Viewer > Windows Logs > Security

or

Event Viewer > Applications & Services Logs > Hardware Events?

- - - -

Does this Powershell cmdlet list the 1001 EventIDs on your system?

Get-WinEvent -FilterHashtable @{logname='*';id=1001}|ft TimeCreated,Id,Message

There may a be error presented at first, but the cmdlet should continue to run.

Results are likely to be lengthy and we may need to filter it all a bit more.

The objective being to "collect" those EventID 1001 errors to examine as a group no matter which log(s) contained the errors.
Click to expand...
The logs are being shown in Event Viewer > Windows Logs > Application. There are 0 events in Event Viewer > Applications & Services Logs > Hardware Events. Yes, the Powershell cmdlet shows too many 1001 logs. I'm not entirely sure how to filter the logs - so I uploaded everything to a Pastebin. Here is a link to the pastebin.
 
Upvote 0 Downvote
I have many of the same entries plus a few others that may not bode well with respect to my system. 🙁

For the most part those "1001's" seem to be reporting sucesses.

I am going to revise the cmdlet to, hopefully, identify the "1001's" that may be of more concern. Some additional filtering....

Event ID 1001 is a broad "catch-all".

FYI:

https://techviral.net/event-id-1001-error/

You can easily find other similar links with explanations and "fixes". I would avoid any "fixes" for now.

Especially any third party apps or tools claiming to fix the problem. Or edit the Registry.

One thing to revisit is finding and posting those dump files as suggested by @ubuysa .

Look for the files again - you have learned more and perhaps, in the meantime, there may now be some files available that can reveal more about some hardware problem.
 
Upvote 0 Downvote
Ralston18 said:
I have many of the same entries plus a few others that may not bode well with respect to my system. 🙁

For the most part those "1001's" seem to be reporting sucesses.

I am going to revise the cmdlet to, hopefully, identify the "1001's" that may be of more concern. Some additional filtering....

Event ID 1001 is a broad "catch-all".

FYI:

https://techviral.net/event-id-1001-error/

You can easily find other similar links with explanations and "fixes". I would avoid any "fixes" for now.

Especially any third party apps or tools claiming to fix the problem. Or edit the Registry.

One thing to revisit is finding and posting those dump files as suggested by @ubuysa .

Look for the files again - you have learned more and perhaps, in the meantime, there may now be some files available that can reveal more about some hardware problem.
Click to expand...
Still no dump files 🙁. What I have been able to get though, is a temporary file through the Reliablity Monitor. I'm not sure how to upload it directly onto the forum, so I'll share a Pixeldrain link. https://pixeldrain.com/u/e3iPCUKX
 
Upvote 0 Downvote
Via the receding pastebin link and the reference to dwm.exe

Take a look in Process Explorer (Microsoft, free) and watch what dwm.exe is doing.

https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer

Reference:

https://www.howtogeek.com/1119/what-is-dwmexe-and-why-is-it-running/

Not sure about how dwm.exe ties into the DirectX kernel etc. per @ubuysa 's comments in Post #5.

However, Process Explorer may provide further details especially if you note some pattern that corresponds to the 1001 event ID and pattern - dwm.exe or otherwise.

There are "dx" entries in the pastebin dump (dxgkrnl) and watchdog entries as well.

Not sure if all that is hardware or software related. Or maybe both.

At least there is now more information and other members may post further analysis and suggestions.
 
Upvote 0 Downvote
Ralston18 said:
Via the receding pastebin link and the reference to dwm.exe

Take a look in Process Explorer (Microsoft, free) and watch what dwm.exe is doing.

https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer

Reference:

https://www.howtogeek.com/1119/what-is-dwmexe-and-why-is-it-running/

Not sure about how dwm.exe ties into the DirectX kernel etc. per @ubuysa 's comments in Post #5.

However, Process Explorer may provide further details especially if you note some pattern that corresponds to the 1001 event ID and pattern - dwm.exe or otherwise.

There are "dx" entries in the pastebin dump (dxgkrnl) and watchdog entries as well.

Not sure if all that is hardware or software related. Or maybe both.

At least there is now more information and other members may post further analysis and suggestions.
Click to expand...
I can't see anything weird... the usage seems to be normal. The only "weird" thing I can find, is that, for some reason, Process Explorer can't seem to find the path to the file.
https://imgur.com/a/k0oJaD5
https://imgur.com/a/N6yHN61
 
Upvote 0 Downvote
what is parsec virtual usb driver for?
parsecvusba.sys Fri Aug 23 08:16:11 2024

note: you need to change memory dump type to kernel and provide memory.dmp file to figure out usb related issues and watchdog timeout issues.

dump could not read bios info/mahine info

parsec must be this:
https://parsec.app/pricing

you might just download microsoft autorun64.exe and disable or delete parsecvusba.sys
reboot and see if it was the cause of your issue.
https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns

if it does what it is supposed to do i can see it causing timeouts in the graphic kernel.
 
Last edited:
Upvote 0 Downvote
You must log in or register to reply here.

TRENDING THREADS

Latest posts

Moderators online

Share this page

COMPANY
RESOURCES
FOLLOW
Top Bottom