none
How to deal with Kernel-EventTracing Event ID:2

    Question

  • This message dominates my Error log and simply drowns out the error messages I'd like to see.  I understand this is one of those "safe to ignore" errors what won't get fixed.  Is there any simple way to make it stop or at least make it disappear from all the logs?  My SBS customer looks at the Event Viewer Overview and Summary screen and just can't accept that there have been 113/767/3631 errors in the last hour/day/week on their brand new server!

    Am I the only person who finds this level of ROP noise a problem?

    Monday, September 05, 2011 6:25 PM

Answers

  • Have you guys tried this?

    http://blogs.technet.com/b/sbs/archive/2012/01/16/managing-event-alerts-in-your-reports-an-sbs-monitoring-feature-enhancement.aspx


    Robert Pearman SBS MVP (2011) | www.titlerequired.com | www.itauthority.co.uk

    Wednesday, February 29, 2012 8:39 PM

All replies

  • Hi JMB1972, can you let us know the detailed information in the Event ID:2 ? Can you use event filter function?

    http://support.microsoft.com/kb/308427

    How to Filter Log Events

    To filter log events, follow these steps:

    1. Click Start, and then click Control Panel. Click Performance and Maintenance, then click Administrative Tools, and then double-click Computer Management. Or, open the MMC containing the Event Viewer snap-in.
    2. In the console tree, expand Event Viewer, and then click the log that contains the event that you want to view.
    3. On the View menu, click Filter.
    4. Click the Filter tab (if it is not already selected).
    5. Specify the filter options that you want, and then click OK.

    Only events that match your filter criteria are displayed in the details pane.

    To return the view to display all log entries, click Filter on the View menu, and then click Restore Defaults.


    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
    Wednesday, September 07, 2011 5:31 AM
  • The error comes in two flavors, which seem only to differ in terms of the User being either SYSTEM or the Domain Admin:

    Log Name:      Microsoft-Windows-Kernel-EventTracing/Admin
    Source:        Microsoft-Windows-Kernel-EventTracing
    Date:          9/9/2011 10:36:38 AM
    Event ID:      2
    Task Category: Session
    Level:         Error
    Keywords:      Session
    User:          XXXDOM1\Administrator
    Computer:      XXXSERVER.xxxdom1.local
    Description:
    Session "WBCommandletInBuiltTracing" failed to start with the following error: 0xC0000035
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Microsoft-Windows-Kernel-EventTracing" Guid="{B675EC37-BDB6-4648-BC92-F3FDC74D3CA2}" />
        <EventID>2</EventID>
        <Version>0</Version>
        <Level>2</Level>
        <Task>2</Task>
        <Opcode>12</Opcode>
        <Keywords>0x8000000000000010</Keywords>
        <TimeCreated SystemTime="2011-09-09T15:36:38.984384300Z" />
        <EventRecordID>17670</EventRecordID>
        <Correlation />
        <Execution ProcessID="532" ThreadID="13276" />
        <Channel>Microsoft-Windows-Kernel-EventTracing/Admin</Channel>
        <Computer>XXXSERVER.xxxdom1.local</Computer>
        <Security UserID="S-1-5-21-864700552-4176957043-3725871085-500" />
      </System>
      <EventData>
        <Data Name="SessionName">WBCommandletInBuiltTracing</Data>
        <Data Name="FileName">
        </Data>
        <Data Name="ErrorCode">3221225525</Data>
        <Data Name="LoggingMode">2</Data>
      </EventData>
    </Event>

    ============================

    Log Name:      Microsoft-Windows-Kernel-EventTracing/Admin
    Source:        Microsoft-Windows-Kernel-EventTracing
    Date:          9/8/2011 1:00:18 PM
    Event ID:      2
    Task Category: Session
    Level:         Error
    Keywords:      Session
    User:          SYSTEM
    Computer:      XXXSERVER.xxxdom1.local
    Description:
    Session "WBCommandletInBuiltTracing" failed to start with the following error: 0xC0000035
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Microsoft-Windows-Kernel-EventTracing" Guid="{B675EC37-BDB6-4648-BC92-F3FDC74D3CA2}" />
        <EventID>2</EventID>
        <Version>0</Version>
        <Level>2</Level>
        <Task>2</Task>
        <Opcode>12</Opcode>
        <Keywords>0x8000000000000010</Keywords>
        <TimeCreated SystemTime="2011-09-08T18:00:18.317540600Z" />
        <EventRecordID>17505</EventRecordID>
        <Correlation />
        <Execution ProcessID="4060" ThreadID="12640" />
        <Channel>Microsoft-Windows-Kernel-EventTracing/Admin</Channel>
        <Computer>XXXSERVER.xxxdom1.local</Computer>
        <Security UserID="S-1-5-18" />
      </System>
      <EventData>
        <Data Name="SessionName">WBCommandletInBuiltTracing</Data>
        <Data Name="FileName">
        </Data>
        <Data Name="ErrorCode">3221225525</Data>
        <Data Name="LoggingMode">2</Data>
      </EventData>
    </Event>

     

    Friday, September 09, 2011 3:58 PM
  • I am getting exactly the same error. Newly built SBS2011 box.

    Description:
    Session "WBCommandletInBuiltTracing" failed to start with the following error: 0xC0000035
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Microsoft-Windows-Kernel-EventTracing" Guid="{B675EC37-BDB6-4648-BC92-F3FDC74D3CA2}" />
        <EventID>2</EventID>
        <Version>0</Version>
        <Level>2</Level>
        <Task>2</Task>
        <Opcode>12</Opcode>
        <Keywords>0x8000000000000010</Keywords>
        <TimeCreated SystemTime="2011-09-13T15:23:56.040387300Z" />
        <EventRecordID>1194</EventRecordID>
        <Correlation />
        <Execution ProcessID="11568" ThreadID="11120" />
        <Channel>Microsoft-Windows-Kernel-EventTracing/Admin</Channel>
        <Computer>server.domain.local</Computer>
        <Security UserID="S-1-5-21-18192932-3258504041-2016429919-1191" />
      </System>
      <EventData>
        <Data Name="SessionName">WBCommandletInBuiltTracing</Data>
        <Data Name="FileName">
        </Data>
        <Data Name="ErrorCode">3221225525</Data>
        <Data Name="LoggingMode">2</Data>

     

    Tuesday, September 13, 2011 3:34 PM
  • I am getting the same error "De sessie WBCommandletInBuiltTracing is niet gestart met de volgende fout: 0xC0000035" in dutch sbs 2011

    does anyone have a solution yet, i know its save to ingnore and i know how to set filters but A error i A error and needs to be solved.

     


    Erik
    Tuesday, September 20, 2011 2:32 PM
  • Session "WBCommandletInBuiltTracing" failed to start with the following error: 0xC0000035 

     

    I'm getting the same error too, it occurs every three minutes.  Has anyone found a solution?

    Thursday, October 20, 2011 8:19 PM
  • Session "WBCommandletInBuiltTracing" failed to start with the following error: 0xC0000035 

     

    I'm getting the same error too, it occurs every three minutes.  Has anyone found a solution?


    While I don't get this error as frequently (once every 3 hours in my case) as you do, it does represent 50% of the errors my system logs on a daily basis.  While I find this level of error log noise excessive, as do some of my customers, Microsoft apparently thinks otherwise.  I'd be happy if Microsoft could at least reclassify this event as a Warning or Information but for now I just keep explaining it away.
    Friday, October 21, 2011 5:08 AM
  • Thanks for your reply/post I won't worry to much about it then. I too see this in my daily check, but that makes sense, microsoft should maybe reclassify the event. Good point.
    trigity
    Thursday, November 03, 2011 5:13 AM
  • I'm getting 2000 of these errors logged every day!  Brand new system, and MS say it's safe to ignore.  Well, Microsoft, if it's not a problem, why are you filling up everybody's logs with error messages?  SBS 2011 has been out for a year, now.  FIX THIS.  And all the other little "safe to ignore" issues that a thoroughly tested new product shouldn't have.
    • Proposed as answer by denwarf Monday, February 06, 2012 11:36 AM
    Friday, January 13, 2012 10:02 AM
  • Just want to add my 2 cents.  Just deployed a new server on 4-Feb-12 and after two weeks, it is currently still logging 72 event 2 errors per hour, and 1800 per day.  If it can't be fixed properly, can we at least get a hot fix to demote it to a warning???  I have about the same number on several other SBS 2011 servers that I manage for clients.

    regards, dg

    Monday, February 13, 2012 2:35 AM
  • I agree as well.  I am seeing this issue on several production boxes.  Why are we having to resolve this when these are fresh builds?

    -Scott


    Scott M. Phoenix, AZ

    Friday, February 24, 2012 5:23 AM
  • I too have a fresh SBS 2011 box with hundreds of these a day. I don't accept the answer "Don't worry about it" I'm tired of purchasing a retail product and becoming a beta tester. If I wanted to beta test I'd get a technet subscription. Microsoft! FIX THIS!!

    -Kelly

    Wednesday, February 29, 2012 4:44 PM
  • Have you guys tried this?

    http://blogs.technet.com/b/sbs/archive/2012/01/16/managing-event-alerts-in-your-reports-an-sbs-monitoring-feature-enhancement.aspx


    Robert Pearman SBS MVP (2011) | www.titlerequired.com | www.itauthority.co.uk

    Wednesday, February 29, 2012 8:39 PM
  • Mine is related to SBS Console. If I don't open it and no more auto start up of SBS Console when log on, then there is no more error. Make sure no one is using it. See if it helps to stop this forever error flooding message.

    TO MICROSOFT> Safe to ignore is NOT the solution!!! We need to know the cause and a real solution. Every single warning means something and it uses the server resource to track the warning and display the warning!


    Friday, May 04, 2012 7:05 PM
  • So Microsoft wrote this neat little report that my customer gets every morning that says "Microsoft, you can't write a server product that works".

    Fix this on the next update!

    Friday, May 11, 2012 10:52 PM
  • I went, I saw and I read. But the links led nowhere to the little program or script that would solve all my problems.

    That's another 23 minutes of my life wasted on Microsoft trying to fix a "crtical" error.

    If I counted up all the time I spend doing these things and multiplied it by the rate I charge people for my time, I think I can justify the difference between a PC and a Mac?

    Sunday, July 08, 2012 9:55 PM
  • I'm unsure that I understand you.  The link provided, http://blogs.technet.com/b/sbs/archive/2012/01/16/managing-event-alerts-in-your-reports-an-sbs-monitoring-feature-enhancement.aspx, provides a means of dropping events which have little meaning in the context of an SBS server from the summary and detailed reports.  If you or your customers receive these reports, that's less noise in them.  The events are still logged and, if you read the event logs you will need to keep a crib sheet of these and others which you needn't spend any time investigating and diagnosing.  While it's not the same as a fix for the cause of the log being generated, it's not nothing. 

    And there may be good reason for not being able to readily provide a "fix" for everything that seems to show up in SBS logs, not the least of which is the complexity of the product combination, coupled with the fact that the combinations are unsupported outside SBS environment.  I refer to running Exchange on a DC, having databases on a SharePoint server, and so on. Fixes may be worse than the original complaint, and expensive beyond the value of the remedy.  If you don't want to use the workaround then I'm sorry to have wasted yet more of your time with this reply, but I found the workaround to have at least some value in trimming out events which aren't worth any of my time at all.

    • Proposed as answer by s.mcknight Friday, October 12, 2012 6:49 PM
    Sunday, July 08, 2012 11:23 PM
  • ..the folks who have made it this far...are bright...persistant...and knowledgable as to thier individual scenearios...and as it is less than a perfect world...well as for me....... a do not worry is sufficient on this one.


    • Edited by s.mcknight Monday, October 15, 2012 6:27 AM
    Friday, October 12, 2012 6:59 PM
  • Well put

    Thanks

    Tuesday, November 27, 2012 1:42 AM
  • Will this work on a DC? 
    Friday, March 15, 2013 4:40 PM
  • The entire context of this thread and of this entire forum is Small Business Server.  It has no applicability or relevance to a DC that isn't a Small Business Server.  Any problem with a DC that isn't SBS needs to go to http://social.technet.microsoft.com/Forums/en-US/winservergen/.  If you are asking a question about SBS please make it a new post and provide full details.  You can link back to this thread if you think it might be relevant.  This way we keep each question associated with a specific answer, in case your question requires a different answer than the original poster's question.

    Saturday, March 16, 2013 2:22 AM
  • ...@Buck Dance City of Detroit...you are very much welcome.
    Saturday, March 23, 2013 6:49 PM
  • Well YOU were the one who brought up DC in the first place with your other post. Besides It doesn't matter whether its DC or SBS the event continues to happen in both as well as others with NO FIX TO DATE: JULY 2013! Only been going on for 5 years as far as I can tell. Guess thats not long enough for Microsoft.....

    I'm so frustrated with these canned answers from the MS Windows volunteer camp. If it doesn't work just ignore it. In the meantime your hardware becomes more and more degraded because of these errors.


    Of course, it's just my opinion....I could be wrong!

    Thursday, July 04, 2013 5:59 AM
  • This is the SBS Forum, not the Windows Server Forum; we don't do non-SBS systems here.  The ability of those who post on this forum to understand, diagnose, and replicate issues reported is limited by the fact that we may not have a repro environment or significant current experience with non-SBS systems.  So if you're reporting something not involving an SBS server, you're in the wrong place.  We've seen a number of postings regarding Event 2 Kernel Event Tracing errors in the SBS forum and elsewhere.  We've been told that this specific Event 2, Session "WBCommandletInBuiltTracing" failed to start with the following error: 0xC0000035, is benign if not meaningless in the context of an SBS server.  In this forum some reports seem to correlate the Event 2 the SBS Console being open.  My own experience is that the specific Event 2 that's the subject of this post isn't logged when the SBS Console isn't open on the server.  More to the point, I've not found any issue with the server related to Event 2 being logged other than its presence in the log itself.  In short, SBS appears to work the same whether or not Event 2 is logged.  Event 2 logged with different parameters or for a non-SBS system, including Windows 7, are not necessarily benign and would require diagnosis to determine the cause and remedy.

    At any rate, posting to someone else's issue, particularly one that is old and closed, is counterproductive and confusing, particularly for those researching current problems.  If you are reporting this event for an SBS, and the parameters are different, please open a new thread and post the log and any diags.

    • Proposed as answer by ChuckWA Tuesday, July 09, 2013 6:32 PM
    Sunday, July 07, 2013 9:40 PM
  • Microsoft calls me all the time saying errors are being reported but I never send error messages. They are all over the event viewer but I don't have any issues with my system. They also mentioned my daughters name but my daughter has never used this computer and they want me to let them have access to my system to correct the problem.

    I do not trust them...all they do is read off of cards

    Saturday, January 11, 2014 7:24 PM
  • Your post to this closed thread appears to be off-topic and unrelated.  That said, what you are reporting sounds suspiciously like well-known scams where some one alleges they are calling from "Windows Support" and they can see that your computer is reporting problems, or a virus, or sunspot activity, or whatever, and they would like you to give access to them so they can "fix it". I get these every couple of months.  Microsoft and legitimate Microsoft Partners never work this way.  These people are not from Microsoft and the only thing they will "fix" is your bank balance, which they believe is too high and should be shared with them.  Don't waste your time engaging them in conversation, humoring them, or arguing with them.  Hang up.  If _you_ think you have malware, then take appropriate action to scan and repair or rebuild your computer as appropriate or take it to a reputable local repair service.  But never, ever allow remote access to your computer to unknown or unverified third parties.
    • Proposed as answer by ChuckWA Saturday, January 11, 2014 8:02 PM
    Saturday, January 11, 2014 8:01 PM
  • I've got one SBS 2011 flooded with this error and turned out to be a faulty SBS Console.

    I turned it off from starting at every log on and the error disappeared.  Now I'm dealing with fix the console itself.

    Wednesday, February 19, 2014 2:08 AM