Event ID 5612 — Provider Host Quota Maintenance

  • Article

Applies To: Windows Server 2008

The provider host quota allows limits to be set on the host process usage of system resources.

Event Details

Product: Windows Operating System
ID: 5612
Source: Microsoft-Windows-WMI
Version: 6.0
Symbolic Name: WBEM_MC_WBEM_HOST_KILLED
Message: WMI has stopped WMIPRVSE.EXE because a quota reached a warning value. Quota: %1 Value: %2 Maximum value: %3 WMIPRVSE PID: %4

Resolve

Specify providers usage

WMI Provider hosts have the following hard-coded limits:

  • Handle count < 0x1000
  • Thread count < 0x1000
  • Private page count < 0x10000000

When a quota has been exceeded, there is no specific action required other than reducing the scope or number of operations requested of the provider hosted in the WMIPRVSE process. Event ID 5612 lists the PID of the WMIPRVSE process that hosted the provider that exceeded the quota.

A provider hosted in WMIPRVSE is implemented as a DLL. You can determine the list of DLLs hosted by WMIPRVSE by typing tasklist /m /fi "IMAGENAME eq wmiprvse.exe" at an elevated command prompt. You can determine which DLL is actually a WMI provider by running WMIDIAG CorrelateClassAndProvider and find matching DLLs from the two lists. Knowing this information will help you to isolate the provider subject to the quota violation and so the operations requested causing this issue. For computers running on the Vista operating system, you can also use the WMI ETW (Event Tracing for Windows) to trace requests and providers handling these requests. The correlation of these traces with the timestamp of this message should give you the name of the provider subject to the quota violation.

Verify

Ensure that the WMI providers in question stay within the following limits for quota parameters:

  • Handle count < 0x1000

  • Thread count < 0x1000

  • Private page count < 0x10000000

Provider Host Quota Maintenance

Management Infrastructure