Aggregate Page Corruption Monitor

Microsoft.Windows.Client.Win8.Computer.PageCorruption.Monitor (UnitMonitor)

Monitor reports page corruptions

Knowledge Base article:

Summary

This monitors Windows 8 detecting the existence of page corruption in some memory released to applications by the Windows 8 Memory Manager. This can cause system and application instability.

A computer that is running Windows Vista may stop responding. Or, programs that are running on this computer may stop responding. Also, you may receive a Stop error in Windows Vista. Moreover, an event that resembles the following may be logged in the System log.

Causes

The following issues may cause the problems that are mentioned in the "Symptoms" section.

To detect possible memory problems, Windows Vista performs a consistency check on a subset of all the physical memory pages. When Windows Vista satisfies a memory request by removing a page from the zeroed list, it may first check the page to confirm whether the contents are still completely zero. For performance reasons, this check is not performed on every page. However, sampling is performed on a subset of all the allocations.

If a page that is checked does not consist of all zeros, memory corruption has occurred. The event that is described in the "Symptoms" section is logged in the System log. Then, the memory is rezeroed, and the system continues.

Resolutions

To resolve this problem, find the most likely cause that is described in the Cause section. Then, use the resolution that is appropriate for the cause.

Element properties:

TargetMicrosoft.Windows.Client.Win8.Aggregate.Computer
Parent MonitorSystem.Health.AvailabilityState
CategoryStateCollection
EnabledTrue
Alert GenerateFalse
Alert Auto ResolveFalse
Monitor TypeMicrosoft.Windows.SingleEventLogManualReset2StateMonitorType
RemotableTrue
AccessibilityPublic
RunAsSystem.PrivilegedMonitoringAccount

Source Code:

<UnitMonitor ID="Microsoft.Windows.Client.Win8.Computer.PageCorruption.Monitor" RunAs="System!System.PrivilegedMonitoringAccount" Accessibility="Public" ParentMonitorID="SystemHealth!System.Health.AvailabilityState" Target="Microsoft.Windows.Client.Win8.Aggregate.Computer" TypeID="Windows!Microsoft.Windows.SingleEventLogManualReset2StateMonitorType" Remotable="true" Enabled="true" Priority="Normal" ConfirmDelivery="false">
<Category>StateCollection</Category>
<OperationalStates>
<OperationalState ID="PageNotCorrupted" HealthState="Success" MonitorTypeStateID="ManualResetEventRaised"/>
<OperationalState ID="PageCorruption" HealthState="Error" MonitorTypeStateID="EventRaised"/>
</OperationalStates>
<Configuration>
<ComputerName>$Target/Property[Type="Windows!Microsoft.Windows.Computer"]/PrincipalName$</ComputerName>
<LogName>System</LogName>
<Expression>
<And>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery>PublisherName</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>Application Popup</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery>EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>1801</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</And>
</Expression>
</Configuration>
</UnitMonitor>