Share via

Solarwind Kiwi Syslog - Show Error

Himanshu Dwivedi 100 Reputation points
2025-08-20T02:31:34.0566667+00:00

I have a server Running with Windows Server 2022 and installed Kiwi Syslog Server 9.8.3 in it, also installed a log forwarder in the machine, but when I try to see the logs it shows something like :

"The description for Event ID 2050 from source Microsoft-Windows-SystemDataArchiver cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.If the event originated on another computer, the display information had to be saved with the event.The following information was included with the event: [SDP Base] SRUM calling FreeMemory for provider data type 1 into provider CPU Provider.. FormatMessage failed with error 15033, The locale specific resource for the desired message is not present."

I am not sure what is the issue with it, is it windows issue or Kiwi Syslog Issue?

Windows for business | Windows Server | Devices and deployment | Set up, install, or upgrade
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Domic Vo 1,015 Reputation points Independent Advisor
    2025-08-21T06:14:55.3966667+00:00

    Dear Himanshu Dwivedi,

    The message you're seeing — "The description for Event ID 2050 from source Microsoft-Windows-SystemDataArchiver cannot be found..." — typically indicates that the event source is present, but the corresponding message resource DLL is either missing, not properly registered, or not accessible by the logging tool.

    Here are a few key points to consider:

    Windows Component Behavior This event is generated by the SystemDataArchiver, a Windows component tied to SRUM (System Resource Usage Monitor). If the event originated locally but the message cannot be rendered, it may suggest that the required resource files are not available or are not being interpreted correctly by the log viewer.

    Third-Party Tool Limitation Kiwi Syslog Server may not have access to the localized message resources needed to display the full event description. This is common when third-party tools collect logs from Windows Event Viewer but do not include the necessary DLLs to interpret certain proprietary event messages.

    Confirm that the SystemDataArchiver component is properly installed and not disabled or corrupted. You can do this by checking sfc /scannow and reviewing component health.

    Ensure that the log forwarder is configured to include event message text, not just event metadata.

    If the event is being forwarded from another machine, verify that the original system has the necessary message resources and that the forwarding method preserves them.

    Consider reviewing the event directly in Windows Event Viewer on the source machine to confirm whether the full message is visible there.

    I hope this helps. Just kindly tick Accept Answer that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

    B`est regards,

    Domic Vo

    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.