Problem Description
Intel Network Adapters can log Event ID 27 (Warning) and Event ID 32 (Information) in System Event Log. In this article I will explain in detail why this problem occurs and why the Event Description cannot be found. Furthermore how you can fix it. I would strongly recommend to read this article carefully. Event ID 27 (Warning) and Event ID 32 (Information) can be logged from the following Intel Network Driver Event Provider Sources. A list of the “Affected Intel Network Adapters” are at the bottom of this article. The below Event Log’s are an example and logged on my PC.
Intel Network Adapter Event Provider Sources which are Logging Event ID 27 and 32
Sources : e1cexpress, e1kexpress, e1dexpress, e1express, e1qexpress, e1sexpress, e1rexpress, e2fexpress, e1yexpress .
Event Logs
Log Name: System Source: e1dexpress Date: 8/13/2020 3:08:07 PM Event ID: 27 Task Category: None Level: Warning Keywords: Classic User: N/A Computer: ThinkPadXY Description: The description for Event ID 27 from source e1dexpress cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer. If the event originated on another computer, the display information had to be saved with the event. The following information was included with the event: Intel(R) Ethernet Connection I219-V The message resource is present but the message was not found in the message table
Log Name: System Source: e1dexpress Date: 8/13/2020 3:08:42 PM Event ID: 32 Task Category: None Level: Information Keywords: Classic User: N/A Computer: ThinkPadXY Description: The description for Event ID 32 from source e1dexpress cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer. If the event originated on another computer, the display information had to be saved with the event. The following information was included with the event: Intel(R) Ethernet Connection I219-V The message resource is present but the message was not found in the message table
New Articles
1. Task Manager can show 0% CPU Usage on Windows 10 and Windows Server 2019
2. WordPress Classic Editor Plugin Not Working after Update to WordPress 5.5
Root Cause Analysis
1. Why the Event Description cannot be found ?
2. Why Event ID 27 and 32 gets logged ?
1. Why the Event Description cannot be found ?
All Intel Driver "*.INF" files mentioned in the “Affected Intel Network Adapters” section below are affected from this problem. The "*.INF" files doesn’t have, all the required "INF Directives" to log the "Problem Description" from the related Event Source Providers listed above. As an example "Intel(R) Ethernet Connection I219-V" Adapter’s Driver components shows us that the Event Descriptions are placed inside "e1d68x64.sys" and "e1dmsg.dll". A list of all registered Event Descriptions inside the Event Message DLL ("e1dmsg.dll") are at the end of this article.
To be able to see the Event Descriptions inside an Event Log, the Drivers "*.INF" file must have the "EventMessageFile" and "EventLogMessageDllPath" Directives. Unfortunately, this is not the case with the above Event Source Providers from Intel.
The "Event Message DLLs" are copied successfully during the Driver Installation based on Process Monitor Logs but not all the required Registry Entries are created during the Installation. The Event Source Providers listed above don’t know where to look for the Event Messages because of missing Registry Entries.
Below an example of a GOOD and BAD Intel "*.INF" file. As you can see below, Intel creates the Event Source Provider Registry Key but doesn’t create the "EventMessageFile" string registry entry and also doesn’t set the "%EventLogMessageDllPath%" value for that string.
This is exactly the reason why the Events Description throws the following Message : "The description for Event ID 32 from source e1dexpress cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer".
Below the related part from the drivers "*.INF" file :
Good *.INF File
;------------------------------------------------------------------------------- ; Common base for all drivers for Eventlog and TextModeFlags ; [win8.EventLog] AddReg = win8.AddEventLog.reg ; [win8.AddEventLog.reg] HKR, , EventMessageFile, 0x00020000, %EventLogMessageDllPath% HKR, , TypesSupported, 0x00010001, 7
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\e1i65x64
Bad *.INF File
;-------------------------------------------------------------------------------
; Common base for all drivers for Eventlog and TextModeFlags
;
[winblue.EventLog]
AddReg = winblue.AddEventLog.reg
;
[winblue.AddEventLog.reg]
HKR, , TypesSupported, 0x00010001, 7
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\e1dexpress
Solution :
We have two options to fix this problem :
1. Either revert back to an Windows Inbox Driver. The Inbox Drivers will always work properly because they are WHQL Certified. In our case the old Windows Inbox Driver was the solution. As you can see below the Event Description can be read inside the Event Log.
2. Or Open a Support Ticket at Intel and let the "*.INF" file fix. If you are a corporate customer you have a good chance to let this problem fix. You can basically search for the following section inside your drivers "*.INF" file. "Common base for all drivers for Eventlog and TextModeFlags". Copy and send this part to Intel. This is the problematic part with the driver.
Once the "INF Directives" are fixed inside the "*.INF" file the exact Event Descriptions for Event ID 27 and 32 are as follows. I have unplugged the Ethernet cable for test purposes to get the Link State Events below for your info.
Log Name: System Source: e1i65x64 Date: 8/15/2020 11:01:45 PM Event ID: 27 Task Category: None Level: Warning Keywords: Classic User: N/A Computer: ThinkPadXY Description: Intel(R) Ethernet Connection I219-V Network link is disconnected.
Log Name: System Source: e1i65x64 Date: 8/15/2020 11:01:48 PM Event ID: 32 Task Category: None Level: Information Keywords: Classic User: N/A Computer: ThinkPadXY Description: Intel(R) Ethernet Connection I219-V Network link has been established at 1Gbps full duplex.
2. Why Event ID 27 and 32 gets logged ?
During our investigation we saw two type of Users getting Event ID 27 and 32.
2.1. Users who really got disconnected from the Network.
2.2. Users who didn’t get disconnected from the Network.
Solution :
Users who really get disconnected from the Network can either revert back to an Inbox Driver or can open an Ticket at Intel.
Users who doesn’t get disconnected from the Network, can disable the logging for Event ID 27 and 32 if these Events are causing any kind of Alerts in your environment. This can be done via the "Intel ProSet Adapter Configuration Utility".
Intel ProSet Configuration Utility
Affected Intel Network Adapters
Affected Brandnames.Str inside the Driver’s "*.INF" files.
Intel® Network Adapter Driver for Windows® 10 and Windows® Server 2019
Version: 25.2 (Latest) Date: 7/14/2020
1. e1d68x64.inf, e1d64x64.inf, e1d63x64.inf, e1d65x64.inf, e1d68x64.inf
Intel(R) Ethernet Connection I217-LM Intel(R) Ethernet Connection I217-V Intel(R) Ethernet Connection I218-LM Intel(R) Ethernet Connection I218-V Intel(R) Ethernet Connection I219-LM Intel(R) Ethernet Connection I219-V Intel(R) Ethernet Connection I219-L
2. e1s63x64.inf, e1s64x64.inf, e1s65x64.inf, e1s68x64.inf
Intel(R) Ethernet Connection I354 1.0 GbE Backplane Intel(R) Ethernet Connection I354 Intel(R) Ethernet Connection I354 2.5 GbE Backplane
3. i40eb64.inf, i40eb65.inf, i40eb68.inf
Intel(R) X722 Multi-Function Network Device HPE Ethernet 10Gb 2-port 568i Adapter Intel(R) Ethernet Network Adapter X722-2 Intel(R) Ethernet Network Adapter X722-4 Intel(R) Ethernet Connection X722 for 10GbE backplane Intel(R) Ethernet Connection X722 for 10GbE SFP+ Intel(R) Ethernet Connection X722 for 10GBASE-T Intel(R) Ethernet Connection X722 for 10GbE QSFP+ Intel(R) Ethernet Connection X722 for 1GbE Intel(R) Ethernet Connection X722 HPE Ethernet 10Gb 2-port 568FLR-MMT Adapter HPE Ethernet 10Gb 2-port 568FLR-MMSFP+ Adapter HPE Ethernet 1Gb 2-port 368FLR-MMT Adapter HPE Ethernet 1Gb 2-port 368i Adapter HPE Ethernet 1Gb 4-port 369i Adapter
4. sxb63x64.inf, sxb64x64.inf, sxb65x64.inf, sxb68x64.inf
Intel(R) X552 Multi-Function Network Device Intel(R) Ethernet Connection X552 10 GbE Backplane Intel(R) Ethernet Connection X552 10 GbE Backplane Intel(R) Ethernet Connection X552 10 GbE SFP+ Intel(R) Ethernet Connection X552/X557-AT 10GBASE-T Intel(R) Ethernet Connection X552 1000BASE-T
5. sxa63x64.inf, sxa64x64.inf, sxa65x64.inf, sxa68x64.inf
Intel(R) X553 Multi-Function Network Device Intel(R) Ethernet Connection X553 Backplane Intel(R) Ethernet Connection X553 Backplane Intel(R) Ethernet Connection X553 10 GbE SFP+ Intel(R) Ethernet Connection X553/X557-AT 10GBASE-T Intel(R) Ethernet Connection X553 1GbE Intel(R) Ethernet Connection X553 1GbE
Event Descriptions for “Intel(R) Ethernet Connection I217-LM, I217-V, I218-LM, I218-V, I219-LM, I219-V, I219-L,” inside “e1d68x64.sys” and “e1dmsg.dll”
1. Supported Brandname.Str inside the Drivers “*.INF” File "\PROWinx64\PRO1000\Winx64\NDIS68\e1d68x64.inf" .
Intel(R) Ethernet Connection I217-LM Intel(R) Ethernet Connection I217-V Intel(R) Ethernet Connection I218-LM Intel(R) Ethernet Connection I218-V Intel(R) Ethernet Connection I219-LM Intel(R) Ethernet Connection I219-V Intel(R) Ethernet Connection I219-L
2. Registered Event Descriptions inside the Driver "\PROWinx64\PRO1000\Winx64\NDIS68\e1d68x64.sys" .
PROBLEM: The network adapter is configured for auto-negotiation but the link partner is not. This may result in a duplex mismatch.%n PROBLEM: PCI Express bandwidth available for this adapter is not sufficient for optimal performance.%n PROBLEM: The driver failed to initialize properly. You may not be able to change the adapter settings.%n PROBLEM: The network adapter driver did not unload successfully.%n PROBLEM: A malicious VF driver has been detected on VF ID %3.%n PROBLEM: Virtualization features disabled because NumVFs was set to zero while SRIOV is enabled.%n PROBLEM: Unable to allocate the map registers necessary for operation.%n PROBLEM: Could not assign an interrupt for the network adapter.%n PROBLEM: The EEPROM on the network adapter may be corrupt.%n PROBLEM: Unable to start the network adapter.%n PROBLEM: The MAC address on the network adapter is invalid.%n PROBLEM: Could not allocate shared memory necessary for operation.%n PROBLEM: Could not allocate memory necessary for operation.%n PROBLEM: Could not allocate a resource pool necessary for operation.%n PROBLEM: Could not initialize scatter-gather DMA resources necessary for operation.%n PROBLEM: Could not map the network adapter flash.%n PROBLEM: The fan on the network adapter has failed.%n PROBLEM: The driver was unable to load due to an unsupported SFP+ module installed in the adapter.%n PROBLEM: The network adapter has been stopped because it has overheated.%n PROBLEM: The network adapter link speed was downshifted because it overheated.%n PROBLEM: The network adapter has been stopped because it has overheated.%n
3. Registered Event Descriptions inside the Event Message DLL "\PROWinx64\PRO1000\Winx64\NDIS68\e1dmsg.dll" .
PROBLEM: Virtualization features disabled because NumVFs was set to zero while SRIOV is enabled.%n PROBLEM: The network adapter is configured for auto-negotiation but the link partner is not. This may result in a duplex mismatch.%n PROBLEM: PCI Express bandwidth available for this adapter is not sufficient for optimal performance.%n PROBLEM: The driver failed to initialize properly. You may not be able to change the adapter settings.%n PROBLEM: The network adapter driver did not unload successfully.%n PROBLEM: A malicious VF driver has been detected on VF ID %3.%n PROBLEM: Virtualization features disabled because NumVFs was set to zero while SRIOV is enabled.%n PROBLEM: Unable to allocate the map registers necessary for operation.%n PROBLEM: Could not assign an interrupt for the network adapter.%n PROBLEM: The EEPROM on the network adapter may be corrupt.%n PROBLEM: Unable to start the network adapter.%n PROBLEM: The MAC address on the network adapter is invalid.%n PROBLEM: Could not allocate shared memory necessary for operation.%n PROBLEM: Could not allocate memory necessary for operation.%n PROBLEM: Could not allocate a resource pool necessary for operation.%n PROBLEM: Could not initialize scatter-gather DMA resources necessary for operation.%n PROBLEM: Could not map the network adapter flash.%n PROBLEM: The fan on the network adapter has failed.%n PROBLEM: The driver was unable to load due to an unsupported SFP+ module installed in the adapter.%n PROBLEM: The network adapter has been stopped because it has overheated.%n PROBLEM: The network adapter link speed was downshifted because it overheated.%n PROBLEM: The network adapter has been stopped because it has overheated.%n Page 1 of 2 PROBLEM: Virtualization features disabled because NumVFs was set to zero while SRIOV is enabled.%n PROBLEM: Virtualization features disabled because NumVFs was set to zero while SRIOV is enabled.%n
Good luck !