Windows event logs for Intel wi-fi drivers are broken because of wrong registration of event files

[ddbug2]

I am a support engineer and often have to read Windows event logs from PCs of various makes, ages and models,  located in many countries.

Always get hard time to grok events of Intel wi-fi adapters, that usually say: "The description for Event ID ... from source Netwtw10 cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer"

When we try to ask Intel wi-fi support what mean all these messages, they usually reply something like "this is OEM device so go bother the OEM and leave us alone'". 

Dear wi-fi team! Your event source DLL paths in the registry, under HKLM\SYSTEM\CurrentControlSet\Services\EventLog\System\Netwtw...\EventMessageFile are wrong!  

The paths there point to system32\drivers  -  but actually the driver files are under  %windir%\System32\DriverStore\FileRepository\netwtwXXX.inf_amd64_XXXX !

Kindly please fix it! 

P.

As a quick workaround, copy all these netwtw...sys files from FileRepository\* to %windir%\system32\drivers.

[Mike_Intel]

Hello ddbug2,

Thank you for posting in Intel community Forum.

For me to further check this, please help provide the following details:

1. What is the complete model of the wireless controller?
2. Can you further explain why there are wrong registrations in the event logs?
3. What is the exact fault description encountered with the wireless controller?
4. Can you also share why you are directed to OEM? There should be some explanation along with that instructions.

If you have questions, please let us know. Thank you.

Best regards,

Michael L.

Intel Customer Support Technician

[ddbug2]

Dear Michael thank you for your attention.

This issue indeed seems to exist only for some models but not others. So I apologize for generalization. 

The device in question is WIFI 6E AX211 on Dell Latitude 5440; OS: Win11 24H2.

Driver: netwtw6e.inf ; version 23.60.1.2;  netwtw14.sys

The adapter itself works well. The problem is only to decode event logs.

So for this specific model, and maybe for more newer models, the default installation directory is Driver Store.

That is, this driver runs directly from the subdirectory of C:\Windows\System32\DriverStore\FileRepository\netwtw6e.inf_amd64...

and not copied into system32\drivers, as it was with all older drivers.

But the event log definition in the registry does not point to the driver store subdirectory. EventMessageFile value is  %SystemRoot%\System32\netevent.dll;Netwtw14.sys

In the INF file this place is:

[Reg_CommonAddEventLog_14_WinT]
HKR,, EventMessageFile, 0x00020000, "%%SystemRoot%%\System32\netevent.dll;%%13%%\Netwtw14.sys"
HKR,, TypesSupported,   0x00010001, 7

[Reg_CommonAddEventLog_14_WinA]
HKR,, EventMessageFile, 0x00020000, "%%SystemRoot%%\System32\netevent.dll;%%13%%\Netwaw14.sys"
HKR,, TypesSupported,   0x00010001, 7

The dirid 13 means "driver store" - but for some reason this has not been substituted correctly. So the even viewer cannot find the sys file and decode the events.

As a "quick fix" I've changed EventMessageFile to "%SystemRoot%\System32\netevent.dll;%SystemRoot%\System32\drivers\Netwtw14.sys"

and copied Netwtw14.sys to System32\drivers.  Then the event viewer finds the driver file and can decode the logs.

On another machine I have older adapter with netwtw08.inf driver (ver. 21.80.60.2), it installs everything to system32\drivers. EventMessageFile is defined as  "%SystemRoot%\System32\netevent.dll;%SystemRoot%\System32\drivers\Netwtw08.sys" 

so  with this one all works as is.

Again thanks for your attention.

ddbug2

[Mike_Intel]

Hello ddbug2,

Thank you for the update.

Since there is no issue with the wireless card/controller. I need to clarify if the end goal of this post/thread.

Are you suggesting that Intel should edit the event logs to show the details that you need?

If yes, please tell us or enumerate the changes that you want so that I will take it as a suggestion and inform the proper team.

If you have questions, please let us know. Thank you.

Best regards,

Michael L.

Intel Customer Support Technician

[Mike_Intel]

Hello ddbug2,

I hope this message finds you well. 

Were you able to check the previous post?

Please let us know if you still need assistance.

Best regards,

Michael L.

Intel Customer Support Technician

[ddbug2]

Mike, 

Thank you again and apologize for delay.

The suggestion is to inform the owner of the WIFI 6E AX211 Windows driver (folks who maintain the inf files) of the issue and let them sort this out - how to specify the DIRID %13%  in the .inf file so that it expands to the actual path after installation and the Windows event viewer can properly display the events. 

Otherwise, I have a workaround and am ok for now.

Hopefully we all will see better, quieter, saner  times soon,

-- ddbug2

[Mike_Intel]

Hello ddbug2,

Thank you for the update.

Let me clarify, so you have 2 suggestions.

1. Is to provide the specific issue in the logs right away. And who will sort the issue of found in the logs?
2. "how to specify the DIRID %13% in the .inf file so that it expands to the actual path after installation and the Windows event viewer can properly display the events." Can you further elaborate this?

Please also understand that logs is just an event viewer. The errors and issues will be logged there however it is up to the end user if he is knowledgeable or he can contact the support team. However, I still want to help you on this suggestion so that I can forward it to the proper team.

If you have questions, please let us know. Thank you.

Best regards,

Michael L.

Intel Customer Support Technician

[Mike_Intel]

Hello ddbug2,

I hope this message finds you well. 

I am just making a follow up on the information that I asked.

Please let us know if you still need assistance.

Best regards,

Michael L.

Intel Customer Support Technician

[ddbug2]

Hi Michael,

I don't need assistance anymore, thank you.

As for suggestions: just inform the wi-fi support team that their eventlog messages do not render properly, for certain driver (INF) version which refers to DIRID %13%.

Hope they will know what to do. 

And hope we'll be ok though the time is, er, hard.

-- ddbug

[Mike_Intel]

Hello ddbug2,

I understand and I will try to forward this feedback.  

Since you mentioned that you don't need assistance anymore, I need to close this inquiry. 

If you need further assistance, please post a new question as this thread will no longer be monitored. 

Thank you and have a great day. 

Best regards,

Michael L.

Intel Customer Support Technician

[Blocky_Man]

Thanks, this problem has been annoying me for a while so while intel hasn't been much help you've solved the problem for me.  Many thanks!