When a hardware error occurs on a system that is running Windows Server 2008, the operating system creates an error record that describes the error condition and sends an event tracing for Windows (ETW) event that contains the error record to user mode. The format of the error record is based on the Common Platform Error Record as described in Appendix N of version 2.1 of the  Unified Extensible Firmware Interface (UEFI) Specification. The operating system converts the ETW hardware error event into an error-specific hardware error event and logs the error-specific event in the system event log.

User-mode applications can be written to process WHEA error records by either registering for notification of the ETW events sent by the operating system or by querying the system event log for the error-specific WHEA hardware error events.

The WHEA hardware error events that are defined and the data templates that are used to describe the hardware error events are different for the ETW hardware error events that the operating system sends up to user mode and for the error-specific hardware error events that are logged in the system event log.

WHEA ETW Hardware Error Events

In Windows Server 2008, the GUID for the provider of the WHEA ETW hardware error events that the operating system sends up to user mode is WHEA_ETW_PROVIDER. The name for the provider is Microsoft-Windows-Kernel-WHEA.

The following table describes the WHEA ETW hardware error event that is defined for Windows Server 2008.

The WHEA ETW hardware error event that is defined for Windows Server 2008 has an associated event identifier. An application can determine if a received WHEA ETW event is a hardware error event by examining the EventID system value that is associated with the WHEA ETW event. The WHEA ETW hardware error event that is defined for Windows Server 2008 uses a data template to describe the hardware error data that is associated with the event. The following table lists the event identifier and the data template that is associated with the WHEA ETW hardware error event that is defined for Windows Server 2008.

The data template is described in the following section.

Note This data template is used only for Windows Server 2008. For information about the data templates used for Windows Vista, see Windows Vista Hardware Error Events.

WHEA Error-Specific Hardware Error Events

In Windows Server 2008, the GUID for the provider of the WHEA error-specific hardware error events that are logged in the system event log is WHEA_TS_ETW_PROVIDER. The name for the provider is Microsoft-Windows-WHEA-Logger.

The following table describes each of the WHEA error-specific hardware error events that are defined for Windows Server 2008.

All of these hardware error events are recorded in the system event log.

Each of the WHEA error-specific hardware error events that are defined for Windows Server 2008 has an associated event identifier. An application can determine which types of errors have occurred by examining the EventID system value that is associated with each WHEA error-specific hardware error event found in the system event log. The following table lists the event identifier and the data template that is associated with each of the WHEA error-specific hardware error events that are defined for Windows Server 2008.

Each of the data templates is described in the following sections.

Note These data templates are used only for Windows Server 2008. For information about the data templates used for Windows Vista, see Windows Vista Hardware Error Events.