Sign in
 
HomeWindows 8Windows 7Windows VistaWindows XPMDOPWindows IntuneLibraryForums
Windows Client >
> 
> 
Event ID: 4, Source: Microsoft-Windows-Kernel-EventTracing, maximum file size for session "ReadyBoot" has been reached.

Answered Event ID: 4, Source: Microsoft-Windows-Kernel-EventTracing, maximum file size for session "ReadyBoot" has been reached.

  • Tuesday, November 10, 2009 2:05 PM
     
     
    Sign In to Vote
    1
    Hello,
    I upgraded my machine to Win7 x64 Pro about 3 weeks ago. My HW is an Asus mobo, Intel Q9450 w/8GB RAM. The boot drives are two Raptors configured as RAID01. All the drivers are the latest available from Intel, Asus and 3rd party vendors. My WEI is 5.9, limited by the disk transfer rates, otherwise 7.1 and 7.2 on the other indexes.
    I've been receiving these errors at boot;

    Log Name:      Microsoft-Windows-Kernel-EventTracing/Admin
    Source:        Microsoft-Windows-Kernel-EventTracing
    Date:          11/10/2009 7:51:03 AM
    Event ID:      4
    Task Category: Logging
    Level:         Warning
    Keywords:      Session
    User:          SYSTEM
    Computer:      herbt-PC
    Description:
    The maximum file size for session "ReadyBoot" has been reached. As a result, events might be lost (not logged) to file "C:\Windows\Prefetch\ReadyBoot\ReadyBoot.etl". The maximum files size is currently set to 20971520 bytes.
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Microsoft-Windows-Kernel-EventTracing" Guid="{B675EC37-BDB6-4648-BC92-F3FDC74D3CA2}" />
        <EventID>4</EventID>
        <Version>0</Version>
        <Level>3</Level>
        <Task>1</Task>
        <Opcode>10</Opcode>
        <Keywords>0x8000000000000010</Keywords>
        <TimeCreated SystemTime="2009-11-10T12:51:03.393985600Z" />
        <EventRecordID>28</EventRecordID>
        <Correlation />
        <Execution ProcessID="4" ThreadID="164" />
        <Channel>Microsoft-Windows-Kernel-EventTracing/Admin</Channel>
        <Computer>herbt-PC</Computer>
        <Security UserID="S-1-5-18" />
      </System>
      <EventData>
        <Data Name="SessionName">ReadyBoot</Data>
        <Data Name="FileName">C:\Windows\Prefetch\ReadyBoot\ReadyBoot.etl</Data>
        <Data Name="ErrorCode">3221225864</Data>
        <Data Name="LoggingMode">0</Data>
        <Data Name="MaxFileSize">20971520</Data>
      </EventData>
    </Event>

    The image for PID 4 is listed as System.

    My searches have turned up similar events listed but no solutions.
    Any help would be appreciated.
    Cheers!
     

All Replies

  • Wednesday, November 11, 2009 7:27 AM
     
     
    Sign In to Vote
    1

    Hi,

     

    I would like to know if you are able to boot into the system now and if the ReadyBoost is used.

     

    To troubleshoot this issue, please check if it occurs in Safe mode first.

     

    If it persists, try enabling the Superfetch service:

     

    Start Superfetch service

    ===========================

    1. Click the Start Button, type "services.msc" (without quotes) in Start Search box, and press Enter.

    2. Double click the service "Superfetch".

    3. Click on the "General" tab; make sure the "Startup Type" is "Automatic" or "Manual". Then please click the "Start" button under "Service Status" to start the service.

    4. Click OK.

     

    Vivian Xing - MSFT
    • Marked As Answer by Vivian Xing Monday, November 16, 2009 8:37 AM
    • Unmarked As Answer by herbtea Thursday, December 17, 2009 9:03 PM
    •  
     
  • Monday, November 16, 2009 2:12 PM
     
     
    Sign In to Vote
    1

    Hi Vivian,
    Thanks for the reply.
    This error is popping up about every other day.

    - I'm not using ReadyBoost, system has 8GB RAM
    - Superfetch is set to "Automatic" and was started when I checked it's state this morning. I did get the ReadyBoot error this morning too.
    - In about half the instances where the error above occurs it is immediately preceded in the events log by the following error that has the same time stamp but I'm assuming as it's listed first that at a higher time resolution it is occurring first.

    Log Name:      Microsoft-Windows-Kernel-EventTracing/Admin
    Source:        Microsoft-Windows-Kernel-EventTracing
    Date:          11/16/2009 8:16:35 AM
    Event ID:      3
    Task Category: Session
    Level:         Error
    Keywords:      Session
    User:          SYSTEM
    Computer:      herbt-PC
    Description:
    Session "ReadyBoot" stopped due to the following error: 0xC0000188
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Microsoft-Windows-Kernel-EventTracing" Guid="{B675EC37-BDB6-4648-BC92-F3FDC74D3CA2}" />
        <EventID>3</EventID>
        <Version>0</Version>
        <Level>2</Level>
        <Task>2</Task>
        <Opcode>14</Opcode>
        <Keywords>0x8000000000000010</Keywords>
        <TimeCreated SystemTime="2009-11-16T13:16:35.547197100Z" />
        <EventRecordID>31</EventRecordID>
        <Correlation />
        <Execution ProcessID="4" ThreadID="164" />
        <Channel>Microsoft-Windows-Kernel-EventTracing/Admin</Channel>
        <Computer>herbt-PC</Computer>
        <Security UserID="S-1-5-18" />
      </System>
      <EventData>
        <Data Name="SessionName">ReadyBoot</Data>
        <Data Name="FileName">C:\Windows\Prefetch\ReadyBoot\ReadyBoot.etl</Data>
        <Data Name="ErrorCode">3221225864</Data>
        <Data Name="LoggingMode">0</Data>
      </EventData>
    </Event>

    As this isn't an every boot occurrance let me know if you would still like me to try booting in safte mode.
    Thanks,
    Herb

     
  • Thursday, December 17, 2009 9:12 PM
     
     
    Sign In to Vote
    0
    Hi Vivian, any ideas on this?
    Thanks
     
  • Friday, December 18, 2009 12:19 PM
     
     
    Sign In to Vote
    0
    You can ignore this. This only shows, that the log file is too small and the kernel can't save all ETW (Event Tracing for Windows) Events for ReadyBoot (not ReadyBoost). ReadyBoot is the improved Bootprefetcher, you know from XP.

    André
    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
     
  • Friday, December 18, 2009 7:07 PM
     
     
    Sign In to Vote
    0
    I have the exact same errors.  I don't want to ignore it.   Wouldn't I want the system to log events that need to be logged???    If a log file is too big, shouldn't it rollover automatically?

    I did disable Superfetch a couple of weeks ago when I was trying (unsuccessfully) to address the constant disk activity light.   When I read about superfetch at the time, I concluded it was not necessary for my system needs.  If that's the culprit to this issue, why are these things optional?  But may not be related as the OP has superfetch enabled.

    Also, I use hibernate nearly all the time.   WHen I just came out of hibernation now, an alert on the screen flashed by, but it was too fast to read it.   Something about "last boot...".    That's when I went to the Event Viewer to see what that alert was, but nothing applicable seen, except maybe this.   And I don't exactly know if its applicable to the ReadyBoot error because I couldn't read the screen error.

    It doesn't help that the "More Information" link for event_log_online never comes back with anything.   :-(  Besides,  regular users shouldnt have to be troubleshooting the kernel!!!  I just want to drive the car.  If a light comes on and says I need an oil change, okay, I can handle that.   :-)




     
  • Saturday, December 19, 2009 4:19 PM
     
     
    Sign In to Vote
    0
    I have exactly the same problem. I am running Windows 7 x64bit with 12 GB of RAM. Superfetch is already in Auto. I assume this is just a Windows 7 quirk.
     
  • Sunday, April 11, 2010 3:22 PM
     
     
    Sign In to Vote
    0

    Session "Circular Kernel Context Logger" failed to start with the following error: 0xC0000035

    As suggested above I assume this is a microsoft issue?  It has been discussed here and other forums for quite some time.  I never have seen a fix?  I wish when we received errors of this nature microsoft would tell us what they were.  How is this related to superfetch?  What is superfetch?  Why would superfetch have changed?

     

    BY THE WAY....  Superfetch is on(started) is on automatic and logs on as local system.  So this is not the cause of my issue.  Also what is readyboot?  Does the average computer really know what these programs/services or unique microsoft words/terms are?
    - System
       
    - Provider
          [ Name] Microsoft-Windows-Kernel-EventTracing
          [ Guid] {B675EC37-BDB6-4648-BC92-F3FDC74D3CA2}
       
      EventID 2
       
      Version 0
       
      Level 2
       
      Task 2
       
      Opcode 12
       
      Keywords 0x8000000000000010
       
    - TimeCreated
          [ SystemTime] 2010-04-11T14:35:49.829600000Z
       
      EventRecordID 25
       
      Correlation
       
    - Execution
          [ ProcessID] 4
          [ ThreadID] 48
       
      Channel Microsoft-Windows-Kernel-EventTracing/Admin
       
      Computer Daddy-PC
       
    - Security
          [ UserID] S-1-5-18
    - EventData
        SessionName Circular Kernel Context Logger
        FileName  
        ErrorCode 3221225525
        LoggingMode 268436608
    Windows7, Windows, Win7
     
  • Friday, April 23, 2010 5:02 PM
     
     
    Sign In to Vote
    0
    Same issues here, have searched for months & months for a solution but found none.  Please update if you have any ideas.
     
  • Sunday, May 09, 2010 8:56 PM
     
     Answered
    Sign In to Vote
    6

    Hey guys, the solution is simple - just increase the max file size! Go to:

     

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\ReadyBoot

     

    The MaxFileSize key is a DWORD with a default decimal value of 20. Increase this to, say 60, and the problem will go away.

     

    Luck to ya!

     
  • Thursday, November 11, 2010 5:18 AM
     
     
    Sign In to Vote
    0
    Sorry gang - I will have to report results back as they roll in for changing the MaxFileSize key.  However - this is why EVERYONE I know laughs in my face with vigor for bothering to attempt WIN 7/64 bit in a (small, no IT nerds) business production environment.  It is almost time to can this bleeding edge jive and go back to an OS that works.
     
  • Friday, December 17, 2010 12:43 PM
     
     
    Sign In to Vote
    1
    Change the setting in the registry, please.
    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
     
  • Sunday, September 18, 2011 9:56 AM
     
     
    Sign In to Vote
    1
    Thank you Andre.Ziegler, this fix worked perfectly!
     
  • Friday, April 27, 2012 8:08 PM
     
     Proposed
    Sign In to Vote
    6

    I ran into this as well and just wanted to suggest another way to set the MaxFileSize without having to use regedit.exe.

    ----

    * Open the Performance Monitor management console, e.g., "Administrative Tools" -> "Performance Monitor", or, "perfmon.msc /s" from the Command Prompt.

    * Under the management console sub-folder "Data Collector Sets" -> "Startup Event Trace Sessions", Open the "ReadyBoot" Trace Session Property Sheet.

    * Select the "Stop Condition" panel.

    * Increase the "Maximum Size" value as needed.

    * Press OK, and exit.

    ----

    This method is a bit safer than using regedit.exe.

    Hope this is helpful.

    Regards,

    Rob


    • Proposed As Answer by Rob Penn Friday, April 27, 2012 8:08 PM
    • Edited by Rob Penn Friday, April 27, 2012 8:10 PM Readability
    •  
     
  • Sunday, July 01, 2012 6:46 PM
     
     
    Sign In to Vote
    0
    Hello all, i have had a similar issue and posted the same question with screenshots and have got the answer similar to what voxmuta is saying. in the link here http://social.technet.microsoft.com/Forums/en-US/w7itprogeneral/thread/bcc0b664-9082-46bb-a3f1-465bd4621f42 you can see the screenshot of what is being talked about here.
     
  • Sunday, July 01, 2012 10:02 PM
     
     
    Sign In to Vote
    1

    Thanks, Rob, your non-regedit suggestion was very clearly written. Changed Readyboot to 60, now let's see if pc quiets down.

    Erin

     
  • Tuesday, July 10, 2012 8:03 PM
     
     
    Sign In to Vote
    0

    I ran into this as well and just wanted to suggest another way to set the MaxFileSize without having to use regedit.exe.

    ----

    * Open the Performance Monitor management console, e.g., "Administrative Tools" -> "Performance Monitor", or, "perfmon.msc /s" from the Command Prompt.

    * Under the management console sub-folder "Data Collector Sets" -> "Startup Event Trace Sessions", Open the "ReadyBoot" Trace Session Property Sheet.

    * Select the "Stop Condition" panel.

    * Increase the "Maximum Size" value as needed.

    * Press OK, and exit.

    ----

    This method is a bit safer than using regedit.exe.

    Hope this is helpful.

    Regards,

    Rob


    Rob,

    Great tip. Thanks.

    Would it not help if I check the checkbox next to "Circular" in the Log Mode on File tab. That would keep the file at 20 MB and eliminate the errors, right?

     
  • Friday, November 16, 2012 11:03 PM
     
     
    Sign In to Vote
    0
    fwiw;   Somewhere in Microsoft support pages it discusses log file sizes,,, and to eliminate a known problem of non stop growing memory use,   to clear all of the event log files properly,  after properly changing any one of their file sizes.