When a Windows server based system has started, this could be logged in the System event log:
Event ID: 7000
Description: The AenService service failed to start due to the following error:
The system cannot find the file specified.
Source: Service Control Manager
Task Category: None
It seems a registered Windows service called “AenService” failed to start at Windows’ boot time, because “the file” could not be “specified”. Translation: the file needed to start the service could not be found. This is logged by the Service Control Manager (SCM).
The description doesn’t talk about the name or location of the file and probably you have never heard of this service neither. What we should do is take a look in the registry. Open the Registry Editor and search for a key named “AenService” under the key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services. With other words, go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\AenService.
You can see the service has a Start value of 2 (Auto load, meaning it’s loaded at startup) and the code file related to AenService is C:\Users\ADMINI~1\AppData\Local\Temp\2\PORTAB~1\WINDOW~1\image\pmc\bin\AenDaemon.exe (see the named value ImagePath). I’m betting my left hand on it this path doesn’t exist on the system logging the event I’ve just described! Weird is the fact the path refers to the local application data folder of a certain user (in my case it’s the local Administrator, hence the shortened ADMINI~1). The folder “temp” obviously learns us the path (sorry, was) temporary. With other words, somehow a temporary folder structure was created containing AenDaemon.exe, which was used for the AenService Windows service. Because it was temporary, there was no problem all this was located under the user profile of the user who did “something”.
Did what? What is this AenService/AenDaemon.exe? Let’s look again at the path and watch the word “pmc”. And let’s take a look at the Description named value. It says: “Svc Aens & Hndls Evnts Based frm maxRAID HBA. Version < 188.8.131.52 >”. Aha! We see the word “maxRAID”! PMC is a registered trademark from PMC Sierra, Inc and is a RAID technology that’s implemented by a SCSI miniport driver called “pmcraid”. Our IBM servers contain this technology and there is a “device” for it (“called “pmcraid”), that uses this driver. maxRAID is a Linux storage management application from IBM. Don’t be confused with ServeRAID, a storage controller family from IBM, or MegaRAID, a cache controller technology from LSI that’s used on ServeRAID controllers. But it is related! The servers getting this error event are all IBM servers (in my case System x3650 M3 (7945)) and I have installed the whole set of IBM updates on them recently. Probably one or more of those updates related to ServeRAID (which is present on “my” IBM servers) has tried to do/install something related to maxRAID (for example, some component that also belongs to the real maxRAID software package). It wouldn’t surprise me if that something is the installation of the pmcraid driver: first of all because we see the word “pmc” and “maxRAID” in the same context and secondly because there is some kind of relation between them (read http://delivery04.dhe.ibm.com/sar/CMA/XSA/ibm_sw_pmcraid_maxraid-184.108.40.206_linux_32-64.txt)!
pmcraid. Sight… Wait a minute… pmcraid! Yup, that’s actually what is included in the ServeRAID B Series Controller Driver for Windows (dunno if the package also contains other stuff, haven’t checked that out)! This package for my IBM servers installs the driver for the ServeRAID storage controller of the “B” series. My final storage controller is actually something else, but it contains this B series controller as a component to drive the SDD disks in my servers. For this subcomponent (B series controller) a separate driver package is available. I have installed version 220.127.116.11 (the latest version at the time of writing), but I don’t know if the “AenService thing” also occurs after installing another version of this driver. I also don’t know which IBM servers (or better for which ServeRAID controllers) this SSD controller is supported or if other disk controllers need or contain pmcraid too. Personally I have the ServeRAID M5015 SAS/SATA Controller with SSD disks (this controller was the standard controller delivered with the IBM servers and has a cache on board).
Side note: the next screenshot shows how I’ve used IBM’s UpdateXpress System Pack Installer (UXSPI) to get a list of updates UXSPI sees for the current system (although UXSPI doesn’t always see all updates or the most recent updates!). You can clearly see pmcraid.sys is mentioned.
There is also another leftover from the installation: HKEY_LOCAL_MACHINE\SOFTWARE\PMC-Sierra. It contains a part of the path I was talking about: C:\Users\ADMINI~1\AppData\Local\Temp\2\PORTAB~1\WINDOW~1\image\pmc. Personally I don’t remove this, as it can be considered as a piece of information, i.e. the temporary install dir for pmcraid (or a part of “maxRAID” if you want). It doesn’t block a thing.
Scary is the fact the installation was tried through a Windows service. And the scariest thing is it wasn’t even cleaned up afterwards, as this is obviously meant as a temporary component! IBM, perhaps you should take a look at this…?
The good news is it doesn’t really harm. The only negative result is the error event being logged and a very small performance loss, because the system did try to load a Windows service that doesn’t exist (anymore). The best news is you can fix this J Just delete the AenService key from the registry and you’re ready!