I am seeing the following event in event viewer:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
<EventID Qualifiers="49152">7024</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8080000000000000</Keywords>
<TimeCreated SystemTime="2013-02-26T15:38:20.264489900Z" />
<EventRecordID>151689</EventRecordID>
<Correlation />
<Execution ProcessID="716" ThreadID="3976" />
<Channel>System</Channel>
<Computer>***</Computer>
<Security />
</System>
<EventData>
<Data Name="param1">Our service name</Data>
<Data Name="param2">%%1</Data>
</EventData>
</Event>
Please notice the param1 and param2 values – while the first one is ok, the second one shows %%1 for some reason, and (maybe) thats why the event text states something like that (I replaced the actual service name):
Our service name service terminated with service-specific error Incorrect function..
What does %%1 mean and how can I further investigate the issue?
Best Answer
Unless I'm confused as to your question, and using your quoted text, then:
Those are the parameters that are put into the text of the event.
For instance if it were:
Then the event error would read as:
So the param2 value in your case looks to be a variable "%%1" that refers to "Incorrect Function".
You'd need to investigate why that particular service is failing with an Incorrect Function at this point...that's a whole other question based around the actual service/app you are running.