Microsoft .NET Framework NGEN service starts and then immediately stops

Question

I'm reviewing the system log of a Windows Server 2008 R2 machine used as an Azure web role instance and I see the following messages from Service Control Manager:

2:28:28 PM The Microsoft .NET Framework NGEN v4.0.30319_X86 service entered the running state.
2:28:28 PM The Microsoft .NET Framework NGEN v4.0.30319_X86 service entered the stopped state.
2:28:28 PM The Portable Device Enumerator Service service entered the stopped state.
2:28:29 PM The Microsoft .NET Framework NGEN v4.0.30319_X64 service entered the running state.
2:28:29 PM The Microsoft .NET Framework NGEN v4.0.30319_X64 service entered the stopped state.

This looks suspicious - why would NGEN service start and then immediately stop?

What's going on? Is this normal behavior?

Solution

We have experienced this situation with every version of the .Net framework ever installed - it turns out the NGEN service is the Native image GENerator, not Next Gen or something else I thought it was for a while.

At any rate, what is happening is quite annoying, but it is not suspicious nor is it malware, a bug, or harming your computer. The logs you posted indicate that the service is PRE compiling the .Net framework and it shuts down the service as soon as it's done. However, as an experienced C, C++, C#, Objective-C, etc. developer for 20+ years...I'm not sure why Microsoft has it install with an "automatic" startup type. Additionally, I'm not sure why the compilation needs to ever run more than once (except should a patch come out or something). But, I'm not privy to those answers...so, I'll stick to only advice about what I have found helps!

This issue also causes numerous problems in Server Manager on 2012+ servers where it throws up a red warning that a service set to start automatically is stopped.

From all the research I (and my team) have done, we have found the best thing to do is set the service to a MANUAL start configuration.

That way, Windows Service Manager will start it when necessary but it will not attempt to needlessly start (and then stop) all the time. This should alleviate some of the log-spew for you. It has completely eliminated the warning about the services not running for us on over 100 Windows Servers and 200 Client Workstations. HOWEVER, please do not perform this change unless you are doing so on a non-production computer or are certain it will not have any adverse effects.

Even though we haven't experienced any problems with this workaround, it doesn't mean that problems do not exist - so just be careful when changing it!

Hope this helps!