Event Viewer Shows Failed Read of USN Log

  • Thread starter Thread starter Sunny
  • Start date Start date
S

Sunny

My OS is Win XP Home Edition
Here's what Event Viewer is showing me:

Event Type: Warning
Event Source: Ci
Event Category: CI Service
Event ID: 4149
Date: 11/27/2008
Time: 5:49:01 PM
User: N/A
Computer: DELL
Description:
Read of USN log for NTFS volume c: failed with error code 0xC000000D.
Volume will remain offline until the Indexing Service (cisvc) is restarted.

This error occurs whenever I reboot. I did an online search and found a
suggestion to enter the following at a cmd (DOS) prompt:
secedit /configure /cfg %windir%\repair\secsetup.inf /db secsetup.sdb
/verbose

When I do this, I get an error stating that "secedit" is not a
recognized program, command, or batch file on my computer.

Can anyone help me with this?
 
Sunny said:
My OS is Win XP Home Edition
Here's what Event Viewer is showing me:

Event Type: Warning
Event Source: Ci
Event Category: CI Service
Event ID: 4149
Date: 11/27/2008
Time: 5:49:01 PM
User: N/A
Computer: DELL
Description:
Read of USN log for NTFS volume c: failed with error code 0xC000000D.
Volume will remain offline until the Indexing Service (cisvc) is restarted.

This error occurs whenever I reboot. I did an online search and found a
suggestion to enter the following at a cmd (DOS) prompt:
secedit /configure /cfg %windir%\repair\secsetup.inf /db secsetup.sdb
/verbose

When I do this, I get an error stating that "secedit" is not a
recognized program, command, or batch file on my computer.

Can anyone help me with this?
Click to expand...

Make sure that the System Account has full control on the drive and its
objects. You can verify the System Account's ACL by using the Cacls
command at the Command Prompt:

cacls c:

In the output you should see: NT AUTHORITY\SYSTEM:(OI)(CI)F

If the System account is not shown you can it grant full control with
the cacls command:

cacls c:\ /t /e /c /g System:f

John
 
Thanks for your reply.

Before I read your message, in Windows Explorer I right-clicked on the
"C:" drive and then clicked on properties in the context menu. After
making sure that "Allow Indexing Service to index this disk for fast
file searching" was selected, I clicked "OK". Perhaps this solved the
problem, because I am not getting the Event ID: 4149 error message now
after rebooting.

After I read your message, I tried the "cacls" command and the relevant
result was:
NT AUTHORITY\SYSTEM:(OI)(CI)(IO)F
 
Good to see that the error resolved itself when you allowed the drive to
be indexed, but you should note that the Indexing Services can have a
considerable negative effect on performance. Go in the Services
Management Console (services.msc) and set the Indexing Service to Manual
Start (or Disable it) and reboot the computer and see if the error
manifests itself again.

John
 
John

"considerable negative effect on performance". Isn't this for the first
few days after enabling? It is supposed to improve performance
thereafter.


--
Regards.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~
 
John

I can see it all depends on how the computer is used. If a user never
searches for anything there is no point in Indexing so they would
benefit from turning off the Indexing Service.

Earkier today I answered a question from someone who didn't want his
music files indexed. I had never thought about doing something like this
before. The answer seems simple -change the attribute of the folder
containing the music files. In my own situation I have thousands of
excel and word files in a personalised folder structure, which makes it
easy to find any file without using the search function. I could all
these files out of indexing. Indeed I might do just that. If I do that
do I need to turn off indexing, change the attributes and restart the
indexing service to rebuild the index. Alternatively does changing the
attribute remove exting files from the index or merely stop new files
being indexed?

My main use of the Search function is research what system files I have
when endeavouring to answer newsgroup questions. Clean indexing helps
here.

BTW the first of your links generated an Event Viewer error.

Event Type: Error
Event Source: Application Error
Event Category: None
Event ID: 1000
Date: 28/11/2008
Time: 17:17:24
User: N/A
Computer: PC0939
Description:
Faulting application iexplore.exe, version 7.0.6000.16735, faulting
module avgssie.dll, version 8.0.0.152, fault address 0x000190f8.

Your second link left me wondering which of the 485,000 options you were
expecting me to read?

--
Regards.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~
 
Gerry said:
John

I can see it all depends on how the computer is used. If a user never
searches for anything there is no point in Indexing so they would
benefit from turning off the Indexing Service.

Earkier today I answered a question from someone who didn't want his
music files indexed. I had never thought about doing something like this
before. The answer seems simple -change the attribute of the folder
containing the music files.
Click to expand...

You can exclude directories from the indexing catalog, I would have to
set it up and take a look at the catalog but I believe that you can also
exclude file types.

In my own situation I have thousands of
excel and word files in a personalised folder structure, which makes it
easy to find any file without using the search function. I could all
these files out of indexing. Indeed I might do just that. If I do that
do I need to turn off indexing, change the attributes and restart the
indexing service to rebuild the index. Alternatively does changing the
attribute remove exting files from the index or merely stop new files
being indexed?
Click to expand...


See here:
http://www.theregister.co.uk/2007/05/10/tattletale_convenience/print.html


My main use of the Search function is research what system files I have
when endeavouring to answer newsgroup questions. Clean indexing helps
here.

BTW the first of your links generated an Event Viewer error.

Event Type: Error
Event Source: Application Error
Event Category: None
Event ID: 1000
Date: 28/11/2008
Time: 17:17:24
User: N/A
Computer: PC0939
Description:
Faulting application iexplore.exe, version 7.0.6000.16735, faulting
module avgssie.dll, version 8.0.0.152, fault address 0x000190f8.
Click to expand...

Sounds like it was thrown up by AVG?

Your second link left me wondering which of the 485,000 options you were
expecting me to read?
Click to expand...

The first couple of pages have answers to many questions.

John
 
Back
Top