XBMC windows logon events
#1
I noticed a slight problem recently, i am using xbmc with tmt 5 as an external player. Everything is smooth mainly playing video, I have it setup so xbmc minimizes when tmt is launched.

I only get a slight stuttering issue occasionally, and i checked the event viewer in windows, it appears the stutter occurs because xbmc keeps logging on every so often while its running? I dont have any profiles setup in xbmc. I just noticed the stutter and checked event viewer time and it keeps occurring when it reports an account was successfully logged on, I noticed this event happens whenever i start xbmc, but why is it happening when xbmc is running and has been running in the background when I am using an external player? It is not often, just happens occasionally and tmt always slightly stutters when it happens.

I unfortunately cant match it up with a xbmc logfile time to see what was happening then, because i restarted xbmc twice already and the log info from that session seems to have vanished.
Reply
#2
You should track it with XBMC debugging on. Then match the time in the event viewer with the times in XBMC's log.
Reply
#3
I was just thinking about that out of curiosity, i did not have debugging on, but the event just occurred while xbmc was sitting minimized in my desktop and xbmc log reported no events. These events are generated in windows event viewer when xbmc is either booted, or sitting idle. The event makes sense when i boot up xbmc, im just perplexed its occurring when xbmc is just sitting already running.

I will turn debugging on and try again and report back. It seems to occur about every hour and half to 2 hours.

Thanks for the reply by the way. Here was the event id im not sure if this is any help. Will post more details later.

Log Name: Security
Source: Microsoft-Windows-Security-Auditing
Date: 10/16/2012 7:54:27 AM
Event ID: 4624
Task Category: Logon
Level: Information
Keywords: Audit Success
User: N/A
Computer: Admin
Description:
An account was successfully logged on.

Subject:
Security ID: SYSTEM
Account Name: ADMIN$
Account Domain: WORKGROUP
Logon ID: 0x3e7

Logon Type: 5

New Logon:
Security ID: SYSTEM
Account Name: SYSTEM
Account Domain: NT AUTHORITY
Logon ID: 0x3e7
Logon GUID: {00000000-0000-0000-0000-000000000000}

Process Information:
Process ID: 0x258
Process Name: C:\Windows\System32\services.exe

Network Information:
Workstation Name:
Source Network Address: -
Source Port: -

Detailed Authentication Information:
Logon Process: Advapi
Authentication Package: Negotiate
Transited Services: -
Package Name (NTLM only): -
Key Length: 0

This event is generated when a logon session is created. It is generated on the computer that was accessed.


Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
<EventID>4624</EventID>
<Version>0</Version>
<Level>0</Level>
<Task>12544</Task>
<Opcode>0</Opcode>
<Keywords>0x8020000000000000</Keywords>
<TimeCreated SystemTime="2012-10-16T13:54:27.762863900Z" />
<EventRecordID>12035</EventRecordID>
<Correlation />
<Execution ProcessID="616" ThreadID="4380" />
<Channel>Security</Channel>
<Computer>Admin</Computer>
<Security />
</System>
<EventData>
<Data Name="SubjectUserSid">S-1-5-18</Data>
<Data Name="SubjectUserName">ADMIN$</Data>
<Data Name="SubjectDomainName">WORKGROUP</Data>
<Data Name="SubjectLogonId">0x3e7</Data>
<Data Name="TargetUserSid">S-1-5-18</Data>
<Data Name="TargetUserName">SYSTEM</Data>
<Data Name="TargetDomainName">NT AUTHORITY</Data>
<Data Name="TargetLogonId">0x3e7</Data>
<Data Name="LogonType">5</Data>
<Data Name="LogonProcessName">Advapi </Data>
<Data Name="AuthenticationPackageName">Negotiate</Data>
<Data Name="WorkstationName">
</Data>
<Data Name="LogonGuid">{00000000-0000-0000-0000-000000000000}</Data>
<Data Name="TransmittedServices">-</Data>
<Data Name="LmPackageName">-</Data>
<Data Name="KeyLength">0</Data>
<Data Name="ProcessId">0x258</Data>
<Data Name="ProcessName">C:\Windows\System32\services.exe</Data>
<Data Name="IpAddress">-</Data>
<Data Name="IpPort">-</Data>
</EventData>
</Event>
Reply
#4
What makes you believe XBMC is responsible for that event? I am no event expert, but I thought that type of event only happens when you logon, or when a scheduled task is set to run with logon privileges. Have you checked your scheduled tasks to see what could be running every hour to 2 hours?
Reply
#5
Yes did all of that, nothing is running.

Whenever i open xbmc the entry occurs.

I am going to keep xbmc off for 24 hours and see if it occurs, it happens a few times daily. Xbmc debug log shows no activity matching up the times.

I have 2 scheduled tasks, one is ccleaner runs once a week, and one is google update running once a week.


The only reason I think its xbmc is because it shows up when xbmc is launched, and only when xbmc is running. But I am about to verify that, with xbmc being off for a day if its still running, then im incorrect, but so far it appears to only happen when xbmc is running.
Reply

Logout Mark Read Team Forum Stats Members Help
XBMC windows logon events0