ESENT Event ID 508,510 and 533 warnings in Event Viewer

Hi, 

I am running a 2012 iMac using Bootcamp to run Windows 10 for Visual Studio. When browsing event viewer I noticed these warning reoccurring:

ESENT 508:

wuaueng.dll (124) SUS20ClientDataStore: A request to write to the file "C:\WINDOWS\SoftwareDistribution\DataStore\Logs\edb.log" at offset 335872 (0x0000000000052000) for 4096 (0x00001000) bytes succeeded, but took an abnormally long time (36 seconds) to be serviced by the OS. This problem is likely due to faulty hardware. Please contact your hardware vendor for further assistance diagnosing the problem.

ESENT 510:

wuaueng.dll (440) SUS20ClientDataStore: A request to write to the file "C:\WINDOWS\SoftwareDistribution\DataStore\Logs\edb.log" at offset 884736 (0x00000000000d8000) for 4096 (0x00001000) bytes succeeded, but took an abnormally long time (53 seconds) to be serviced by the OS. In addition, 1 other I/O requests to this file have also taken an abnormally long time to be serviced since the last message regarding this problem was posted 167 seconds ago. This problem is likely due to faulty hardware. Please contact your hardware vendor for further assistance diagnosing the problem.

ESENT 533:

wuaueng.dll (112) SUS20ClientDataStore: A request to write to the file "C:\WINDOWS\SoftwareDistribution\DataStore\Logs\edb.log" at offset 1077248 (0x0000000000107000) for 4096 (0x00001000) bytes has not completed for 36 second(s). This problem is likely due to faulty hardware. Please contact your hardware vendor for further assistance diagnosing the problem.

I have run Apple Hardware Test to check for hardware faults and all tests pass without issue. Any idea what these warnings are caused by and how I can fix this?

Many Thanks

 

Question Info


Last updated September 20, 2018 Views 27,879 Applies to:

Hello,

We regret for the inconvenience. Let me assist you to resolve the issue.

The Event ID you are receiving are as follows

Esent Event ID 508 and 533  This warning can also be caused by an insufficient (or potentially even just low) amount of unused space on your currently running Operating System's HDD/SSD

Esent Event ID 510  Event ID 510 is a performance warning, which indicates slow writing behavior, if the computer is connected to a server. This issue could be related with the performance of the server.

We would like to know if the system you are using is a standalone PC or if it is connected to any Domain/server?

If it is a standalone PC, the following suggestions may help to identify the issue.

Method 1

I suggest you to refer to the below link written by one of our MVPs, Andre Da Costa, and check if it helps.

How to free up disk space in Windows

Also, try to perform a defragmentation of the drives and check with the results.

Follow the below steps.

  1. Sign in to your Windows 10 computer with an administrator account. It is important to use an administrator account because standard account holders cannot defrag the hard disk drive.
  2. Click the Start button.
  3. From the left pane of the Start menu, click File Explorer.
  4. On the opened window, from the navigation pane in the left, expand the This PC tree.
  5. From the expanded list, right-click Local Disk (C: ) or any other partition on which Windows 10 is installed.
  6. From the context menu, click Properties.
  7. On the opened Local Disk (C: ) Properties box, go to the Tools tab.
  8. From the displayed interface, under the Optimize and defragment drive section, click the Optimize button.
  9. On the Optimize Drives box, from the displayed list, ensure that the system drive (C: in this example) is selected.
  10. Click the Analyze button from below the list.
  11. Wait until Windows completes the analysis and displays the percentage of the fragmented files in the selected drive.
    Note: If there are no fragmented files in the drive, Windows displays a message box stating that the disk does not need to be defragmented.

Next, run the Disk utility in Windows to detect and fix disk corruption, if any.

To do so, right-click on the Drive which you wish to check and select Properties. Next, click on Tools tab and under Error checking, click on the Check button.  This option will check the drive for file system errors.

Method 2

If it still does not help, place the computer in a Clean Boot state and check if there are any third party application/software to be causing the issue.

A clean boot is performed to start Windows by using a minimal set of startup programs. This helps eliminate software conflicts.

How to perform a clean boot in Windows

Disclaimer: Please go through the section: How to reset the computer to start as usual after troubleshooting with clean boot of the Kb article to boot the computer in normal startup after fixing the issue.

Method 3

This issue may happen due to system file corruption. I suggest you to run System file checker. System File checker (SFC) scan is done to check if there are any corrupted system files that could be causing this issue. Kindly follow the below given steps: 

  • Press Windows key + X, select Command prompt (Admin) to bring up elevated Command prompt.

  • In Command prompt type sfc /scannow and press enter.

  • Restart the computer.

Ref: Using System File Checker in Windows 10

Write to us with the update dstatus and the required information for us to be able to assist  you further.

Thank You.

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

The computer is a standalone PCs but is connected to the Internet. Could starting up applications e.g a game cause the performance issue straight after boot?

Many thanks for the prompt reply I will try the above steps and get back to you.

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

Hello Summez,

I would be too soon to ascertain the root cause of the issue.

I recommend you to try the suggested resolutions if it helps. If it still doesn't help, here are a few relevant information.

The edb.log is a database file of the indexing service. If you have enabled Windows Indexing, this file will be utilized.

In this case, if the file is corrupt, you can run a System Restore in Windows to fix the file.

If you already have one in the recent time, to check if there is any Restore Point already created, follow the below steps.
  1. Press Windows key + X, select System.

  2. In the left pane, click on System Protection.

  3. Select the option to system restore > next. It will show all restore points already created.

Kindly keep us posted on the status of the issue, for us to be able to assist you further.

Thank You.

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

Hi,

I have completed all the above steps

Regarding Method 1 

I have completed this and the drive is not fragmented. The drive is a 1TB drive and the Windows partition has 149GB free of 372GB. My last restore point is the 4th July.

Regarding Method 2

I have not disabled all items. the only ones running are

Apple OS Switch Manager

Intel Services

NVIDIA Services

Should I disable these as well ?

Regarding Method 3

System File checker (SFC) scan found corrupt files and I used DISM to fix them.

I had not received an ESENT warning until yesterday (508 and 533).  Windows indexing is enabled for the drive. Any ideas how to proceed?

Many Thanks

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

Hello Summez,

We appreciate the time and effort you have put in to resolve the issue.

If the ESENT Event Ids have stopped logging in Event Viewer, we might be looking at a positive picture here. Also, certain Windows components were fixed after running SFC and DISM tools.

However, if you still see any issues, I suggest you to check if the same issue occur when logged in through a different Local Administrator user account. 

 

Follow the steps mentioned below:

  1. Assuming that you are already logged on to your user account in Windows 10, click the Start button.
  2. From the Start menu, click your name from the top of the left pane.
  3. From the displayed options click Sign out.
  4. From the login screen, click to the different user account you want to switch to.

 

However, if you do not have a separate user account, I suggest you to create another Local administrator user account by referring to the Microsoft article here: Set up accounts.

Write to us again, in case you need further assistance on the issue.

Thank You.

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

Hi,

Just an update, Had the ESENT warnings again today so, I have decided to try to clean boot windows 10 will get back to you with the results.

Thanks

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

Hi,

The clean install has fixed the issue? I have same issues in my PC

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

Hi,

A clean boot is performed to start Windows by using a minimal set of drivers, and startup programs.  It only disables software which might be causing conflict on the programs that you have. It doesn't remove the software, programs, and data on your computer. On the other hand, a clean install is removing all data from your hard disk by re-partitioning, reformatting your hard disk, and reinstalling the Operating System to an empty hard disk. A clean install removes all data, and programs that you have.

Have you tried the methods provided by Sayan_Ghosh found on this thread?

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

Regarding..

ESENT 508:

wuaueng.dll (124) SUS20ClientDataStore: A request to write to the file "C:\WINDOWS\SoftwareDistribution\DataStore\Logs\edb.log" at offset 335872 (0x0000000000052000) for 4096 (0x00001000) bytes succeeded, but took an abnormally long time (36 seconds) to be serviced by the OS. This problem is likely due to faulty hardware. Please contact your hardware vendor for further assistance diagnosing the problem.

I had a very similar error and noticed that the folder C:\WINDOWS\SoftwareDistribution\DataStore\Logs\ on my PC was read only! Made it writable and this went away.

54 people were helped by this reply

·

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

I had this problem for a while but it got worse a few days ago, after a popup opened in Edge that spoke and said my computer was infested, blah blah the usual. From that moment the ESENT events increased to about every five minutes for up to 45 seconds. I suspected a rootkit or trojan, and while windows defender found nothing, Hitman Pro found a trojan right away, removed it, and the esent events ceased. The trojan was Powelik, designed to simulate website clicks and do background downloading, hence the esent error related to webcache. Just went two hours without an esent event or a freeze, so its a relief. Clearly a lapse in security for microsoft. You can get a free powelik remover from symantec. Just takes a few minutes, or use Hitman for the 30 day free trial. 

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.