Event ID 5612 — Provider Host Quota Maintenance
Applies To: Windows Server 2008
.jpg)
The provider host quota allows limits to be set on the host process usage of system resources.
Event Details
| Product: | Windows Operating System |
| ID: | 5612 |
| Source: | Microsoft-Windows-WMI |
| Version: | 6.0 |
| Symbolic Name: | WBEM_MC_WBEM_HOST_KILLED |
| Message: | WMI has stopped WMIPRVSE.EXE because a quota reached a warning value. Quota: %1 Value: %2 Maximum value: %3 WMIPRVSE PID: %4 |
Resolve
Specify providers usage
WMI Provider hosts have the following hard-coded limits:
- Handle count < 0x1000
- Thread count < 0x1000
- Private page count < 0x10000000
When a quota has been exceeded, there is no specific action required other than reducing the scope or number of operations requested of the provider hosted in the WMIPRVSE process. Event ID 5612 lists the PID of the WMIPRVSE process that hosted the provider that exceeded the quota.
A provider hosted in WMIPRVSE is implemented as a DLL. You can determine the list of DLLs hosted by WMIPRVSE by typing tasklist /m /fi "IMAGENAME eq wmiprvse.exe" at an elevated command prompt. You can determine which DLL is actually a WMI provider by running WMIDIAG CorrelateClassAndProvider and find matching DLLs from the two lists. Knowing this information will help you to isolate the provider subject to the quota violation and so the operations requested causing this issue. For computers running on the Vista operating system, you can also use the WMI ETW (Event Tracing for Windows) to trace requests and providers handling these requests. The correlation of these traces with the timestamp of this message should give you the name of the provider subject to the quota violation.
Verify
Ensure that the WMI providers in question stay within the following limits for quota parameters:
Handle count < 0x1000
Thread count < 0x1000
Private page count < 0x10000000