Windows Event ID 17 – WHEA-Logger: Hardware Error Architecture Corrected Error

Start by examining the specific error details to understand the hardware component and error type involved.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → System
3. Filter the log by clicking Filter Current Log in the Actions pane
4. Enter 17 in the Event IDs field and select WHEA-Logger as the Event source
5. Double-click on Event ID 17 entries to view detailed information
6. Examine the General tab for error description and the Details tab for technical data
7. Look for patterns in timing, frequency, and affected hardware components
8. Note the Error Source field which identifies the specific hardware component (processor, memory, PCIe device)

Use PowerShell to extract and analyze WHEA events programmatically for pattern identification and correlation.

1. Open PowerShell as Administrator
2. Query recent WHEA-Logger Event ID 17 entries:

   Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Microsoft-Windows-WHEA-Logger'; Id=17} -MaxEvents 50 | Select-Object TimeCreated, Id, LevelDisplayName, Message | Format-Table -Wrap

3. Analyze error frequency over time:

   $Events = Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Microsoft-Windows-WHEA-Logger'; Id=17} -MaxEvents 200
   $Events | Group-Object {$_.TimeCreated.Date} | Select-Object Name, Count | Sort-Object Name

4. Extract detailed error information:

   Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Microsoft-Windows-WHEA-Logger'; Id=17} -MaxEvents 10 | ForEach-Object {
       [xml]$EventXML = $_.ToXml()
       $EventXML.Event.EventData.Data | Where-Object {$_.Name -eq 'ErrorSource'}
   }

5. Create a summary report:

   $WHEAEvents = Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Microsoft-Windows-WHEA-Logger'; Id=17} -MaxEvents 100
   $WHEAEvents | Group-Object Message | Select-Object Name, Count | Sort-Object Count -Descending

Perform comprehensive hardware diagnostics to identify the root cause of correctable errors.

1. Run Windows Memory Diagnostic:

   mdsched.exe

2. Schedule the test and restart the system when prompted
3. After restart, check results in Event Viewer under Windows Logs → System, filtering for source MemoryDiagnostics-Results
4. For advanced memory testing, use command-line memory diagnostic:

   bcdedit /set {memdiag} memorytestreboot on
   shutdown /r /t 0

5. Check system temperature and hardware status:

   Get-WmiObject -Namespace "root/wmi" -Class MSAcpi_ThermalZoneTemperature | Select-Object InstanceName, @{Name="Temperature";Expression={($_.CurrentTemperature/10)-273.15}}

6. Verify ECC memory configuration in System Information:

   Get-WmiObject -Class Win32_PhysicalMemory | Select-Object BankLabel, Capacity, DataWidth, TotalWidth, TypeDetail

7. Run hardware vendor diagnostics if available (Dell SupportAssist, HP Support Assistant, Lenovo Vantage)

Examine WHEA configuration and error reporting settings to optimize hardware error detection and reporting.

1. Check WHEA policy configuration in Registry Editor:

   Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\WHEA\Policy"

2. Verify error reporting is enabled:

   Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\Windows Error Reporting" -Name "Disabled"

3. Check Machine Check Architecture (MCA) settings:

   Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" -Name "MoveImages"

4. Review WHEA error source configuration:

   Get-ChildItem -Path "HKLM:\SYSTEM\CurrentControlSet\Control\WHEA\ErrorSourceOverrides" -Recurse

5. Enable detailed WHEA logging if needed:

   wevtutil sl Microsoft-Windows-WHEA-Logger/Operational /e:true
   wevtutil sl Microsoft-Windows-Kernel-WHEA/Operational /e:true

6. Verify system event log size is adequate:

   Get-WinEvent -ListLog System | Select-Object LogName, MaximumSizeInBytes, RecordCount

Implement comprehensive monitoring and correlation to predict hardware failures before they occur.

1. Create a PowerShell monitoring script for continuous WHEA tracking:

   $LogPath = "C:\WHEAMonitoring\WHEA_$(Get-Date -Format 'yyyyMMdd').csv"
   Register-WmiEvent -Query "SELECT * FROM __InstanceCreationEvent WITHIN 10 WHERE TargetInstance ISA 'Win32_NTLogEvent' AND TargetInstance.LogFile = 'System' AND TargetInstance.EventCode = 17" -Action {
       $Event = $Event.SourceEventArgs.NewEvent.TargetInstance
       "$($Event.TimeGenerated),$($Event.EventCode),$($Event.Message)" | Out-File -FilePath $LogPath -Append
   }

2. Set up performance counter monitoring for hardware health:

   Get-Counter "\Memory\Corrected Hardware Errors/sec", "\Processor(_Total)\% Processor Time", "\System\Processor Queue Length" -Continuous -SampleInterval 60

3. Correlate WHEA events with system performance:

   $StartTime = (Get-Date).AddDays(-7)
   $WHEAEvents = Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Microsoft-Windows-WHEA-Logger'; Id=17; StartTime=$StartTime}
   $SystemEvents = Get-WinEvent -FilterHashtable @{LogName='System'; Id=1074,6008,41; StartTime=$StartTime}
   # Analyze temporal correlation between hardware errors and system events

4. Generate predictive maintenance reports:

   $ErrorTrend = $WHEAEvents | Group-Object {$_.TimeCreated.Date} | Select-Object @{Name='Date';Expression={$_.Name}}, @{Name='ErrorCount';Expression={$_.Count}}
   $ErrorTrend | Export-Csv -Path "C:\Reports\WHEA_Trend_$(Get-Date -Format 'yyyyMMdd').csv" -NoTypeInformation

5. Configure automated alerting for error threshold breaches:

   $Threshold = 5
   $DailyErrors = (Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Microsoft-Windows-WHEA-Logger'; Id=17; StartTime=(Get-Date).Date}).Count
   if ($DailyErrors -gt $Threshold) {
       # Send alert via email or SCOM
       Write-EventLog -LogName Application -Source "WHEA Monitor" -EventId 1001 -EntryType Warning -Message "Daily WHEA errors exceeded threshold: $DailyErrors"
   }