Description and Explanation of the “Failed unregistering callback tracking connected process termination” Error 997 in App-V

Have you ever noticed that periodically you may see the following error in the SFTLOG.TXT and/or the Windows Application event log:

Failed unregistering callback tracking connected process termination (error: 997).

You will also see the following in the Event Log:

Log Name:      Application
Source:        Application Virtualization Client
Date:         
Event ID:     
Task Category: (3)
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      <name>
Description:
{tid=1C3C}
Failed unregistering callback tracking connected process termination (error: 997).
Event Xml:
<Event xmlns=”http://schemas.microsoft.com/win/2004/08/events/event“>
  <System>
    <Provider Name=”Application Virtualization Client” />
    <EventID Qualifiers=”16384″>3219</EventID>
    <Level>3</Level>
    <Task>3</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime=”2010-09-18T19:34:05.000000000Z” />
    <EventRecordID>834</EventRecordID>
    <Channel>Application</Channel>
    <Computer>COMPUTERNAME</Computer>
    <Security />
  </System>
  <EventData>
    <Data>{tid=1C3C}
</Data>
    <Data>997</Data>
  </EventData>
</Event>

Here is the following explanation of situations where this event may occur:

When one of the App-V client’s front-end component (i.e. UI or SFTTRAY) connects to the SFT Listener, the Listener opens a process handle to that front-end component, and will call a system API that will automatically monitor for that process handle being signaled (i.e. the process exited), and invoke a callback function in the Listener if that occurs.  If the front-end component disconnected normally, the monitoring of the handle is canceled. It appears to the App-V front end component that when the unregistration of the callback function was tried – in this case, the callback function had already been queued up or was in the process of executing which caused this warning to be reported.

In most cases this message is benign. This will often happen when the SFTDCC processes overlap with publishing refreshes and will also happen often on TS/RDS logoffs – especially with Server 2008 and beyond. You will also see this paired with User Profile Service registry closure events.