After installing guest module, giappdef.sys and the gisvc service which helps with In-Memory Process Forensics (IMPF), automatic upgrades, collecting process metadata, and so on, starts running. You might see error messages in the vmware.log file when the gisvc and giappdef service module starts. You can ignore any failed or error message when the service starts.

Problem

You see error messages in the vmware.log file when the gisvc and giappdef service module starts.

Solution

  1. When the gisvc and giappdef service module starts, go to thevmware.log file.
  2. You see error messages in the vmware.log file. The following error messages are seen only at the time of module startup. You can safely ignore these error messages during the module startup phase.

Solution

2019-09-24T14:43:04.723Z| vcpu-0| I125: Guest: GIAppDef: ERROR: GIAppDefInitPolicy : GIReadPolicy failed with 0x00000004. Loading default policy.
This error occurs as GIReadPolicy returns fail at the time of initialization phase of the Giappdef policy.
2019-09-24T14:43:04.724Z| vcpu-0| I125: Guest: GIAppDef: ERROR: GetMSDosName : Unable to open file (null), ns = c000003b

This error occurs as it is expected to convert the filename into the MSDOS format.

2019-09-24T14:43:04.724Z| vcpu-0| I125: Guest: GIAppDef: ERROR: RetrieveProcessName : GetProcessImageName returned status 0xc000003b, ImageNameLength = 0

This error occurs because the process handler is unable to get the process image name.

2019-09-24T14:43:04.900Z| vcpu-0| I125: Guest: GIAppDef: ERROR: WFPInspectRegisterCallouts : FwpmProviderDeleteByKey failed as expected with status 0xc0220005

You can safely ignore these error messages during the module startup phase.