none
Session "Circular Kernel Context Logger" failed to start with the following error: 0xC0000035

    Question

  • I have lots of the following error messages in the event viewer.

    Session "Circular Kernel Context Logger" failed to start with the following error: 0xC0000035


    Is there a doctor in the room please ?
    - What does it mean ?
    - Is something wrong with my computer ? or with me ?
    - How to avoid this ?


    Regards Picsoe
    Monday, September 14, 2009 1:36 PM

All replies

  • Seems to occur at restart/boot.  Wonder what it means.

    Doc
    Tuesday, September 15, 2009 5:09 PM
  • I have lots of the following error messages in the event viewer.

    Session "Circular Kernel Context Logger" failed to start with the following error: 0xC0000035


    Is there a doctor in the room please ?
    - What does it mean ?
    - Is something wrong with my computer ? or with me ?
    - How to avoid this ?


    Regards Picsoe
    Hi Picsoe

    In the Event Viewer, double click one of these events to see the details. At the lower/left corner of the details window, click the Copy Button and paste the results in a reply back here.

    Regards,


    Thank You for testing Windows 7

    Ronnie Vernon MVP
    • Proposed as answer by Nrg Tech Monday, April 21, 2014 7:45 AM
    Tuesday, September 15, 2009 5:17 PM
    Moderator
  • Hi Picsoe

    In the Event Viewer, double click one of these events to see the details. At the lower/left corner of the details window, click the Copy Button and paste the results in a reply back here.

    Regards,


    Thank You for testing Windows 7

    Ronnie Vernon MVP
    Thanks Ronnie, here is the copy that you asked for :

    Log Name:      Microsoft-Windows-Kernel-EventTracing/Admin
    Source:        Microsoft-Windows-Kernel-EventTracing
    Date:          15/09/2009 14:48:38
    Event ID:      2
    Task Category: Session
    Level:         Error
    Keywords:      Session
    User:          SYSTEM
    Computer:      Picsoetje-PC
    Description:
    Session "Circular Kernel Context Logger" failed to start with the following error: 0xC0000035
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Microsoft-Windows-Kernel-EventTracing" Guid="{B675EC37-BDB6-4648-BC92-F3FDC74D3CA2}" />
        <EventID>2</EventID>
        <Version>0</Version>
        <Level>2</Level>
        <Task>2</Task>
        <Opcode>12</Opcode>
        <Keywords>0x8000000000000010</Keywords>
        <TimeCreated SystemTime="2009-09-15T12:48:38.940841700Z" />
        <EventRecordID>1421</EventRecordID>
        <Correlation />
        <Execution ProcessID="4" ThreadID="52" />
        <Channel>Microsoft-Windows-Kernel-EventTracing/Admin</Channel>
        <Computer>Picsoetje-PC</Computer>
        <Security UserID="S-1-5-18" />
      </System>
      <EventData>
        <Data Name="SessionName">Circular Kernel Context Logger</Data>
        <Data Name="FileName">
        </Data>
        <Data Name="ErrorCode">3221225525</Data>
        <Data Name="LoggingMode">268436608</Data>
      </EventData>
    </Event>

    Regards Picsoe
    Tuesday, September 15, 2009 5:22 PM
  • Hi Picsoe

    I did some research on this event and it appears to be one of those 'non-event' events?

    The 'Microsoft-Windows-Kernel-EventTracing' appears to run each time the system is started along with the associated 'Circular Kernel Context Logger'. These components are part of the Performance Diagnostics.

    The '0xC0000035' error code returns as 'STATUS_OBJECT_NAME_COLLISION'. This error code has been associated with a duplicate domain security identifier (SID) being detected, also as 'the event logger is full' with Session "Circular Kernel Context Logger" failed to start.

    There are many threads that refer to this event and associate it with many different behaviors, but i think these are redundant since the users were just looking for the cause for a problem that did not actually have anything to do with this event.

    For now I would recommend that you monitor how often this event is recorded, but otherwise simply ignore it. It will likely disappear at some point.

    Hope this helps.

    Thank You for testing Windows 7


    Ronnie Vernon MVP 

    • Marked as answer by Robinson Zhang Monday, September 21, 2009 4:18 AM
    • Unmarked as answer by Picsoe Monday, September 21, 2009 5:08 AM
    Tuesday, September 15, 2009 10:16 PM
    Moderator
  • Hi,

    I have a clean install of Windows 7 downloaded from MSDN. This is running stand alone as a media centre PC. It is not a member of a domain.  I appear to get the error message

    Session "Circular Kernel Context Logger" failed to start with the following error: 0xC0000035

    Repeated ~1second. It appears to start when the computer resumes from standby and then continues. The system appears to be brought out of standby by an attempt to access something at Microsoft and I receive a warning

    Name resolution for the name dns.msftncsi.com timed out after none of the configured DNS servers responded.

    After this the kernel error starts to appear.

    There is clearly something wrong. Advice would be appreciated.


    Paul Ireland
    Sunday, September 20, 2009 10:00 AM
  • Exactly the same here.

    It goes on and on, up to 3 times per second.


    Regards Picsoe
    Monday, September 21, 2009 5:10 AM
  • Hi,

    I had the same trouble with Windows 7 (the RTM version). The Kernel context logger is a bit like a flight data recorder and takes snapshots of the system (I think every second) into a 100MB RAM file (not a log file on disk). It is needed.

    I found the fix:

    Rename this file: %windir%\panther\setup.etl to setup.old and reboot.

    Worked for me. To prove this, delete the logs in event viewer and keep an eye out for any recurrence. Can't tell you why it was broken in the first place, though!

    Regards,

    RichardVet
    • Proposed as answer by Doug Shreve Friday, March 22, 2013 11:18 PM
    Thursday, November 19, 2009 5:16 PM
  • Seems I only and always get this error when I do a logoff/logon (same user, I'm only one on my system). Doesn't happen on normal boots/reboots.
    Saturday, May 29, 2010 9:46 PM
  • I've been away for months, but I can see that the event viewer filter on our brand new Windows 7 has not made much progress in the event 35 series [processor drivers not seen as installed or running by Windows] and I can see a new thread after I installed Microsoft Security Essentials that the scanner will stop unexpectedly due to this filter not being solved?  Error code 3221225458 ? 

    In answer to your question, NO nothing is wrong with either your computer or your software and I think not you either, but you may want to check with a professional just in case?

    Tuesday, July 06, 2010 6:56 AM
  • hi,

    thanks rename solve the problem.

     

    regards

    Basel

    Tuesday, January 31, 2012 8:07 AM
  • THis fix worked for me! Using Windows 7 Ultimate 64-bit. I was getting 10 of these errors each and everytime the desktop (Dell Optiplex 780) was restarted..it was maddening! Thank you for taking the time to nail this down RichardVet!

    Doug Shreve

    • Proposed as answer by Doug Shreve Friday, March 22, 2013 11:16 PM
    • Unproposed as answer by Doug Shreve Friday, March 22, 2013 11:16 PM
    Sunday, March 10, 2013 4:47 AM
  • Hi,

    I had the same trouble with Windows 7 (the RTM version). The Kernel context logger is a bit like a flight data recorder and takes snapshots of the system (I think every second) into a 100MB RAM file (not a log file on disk). It is needed.

    I found the fix:

    Rename this file: %windir%\panther\setup.etl to setup.old and reboot.

    Worked for me. To prove this, delete the logs in event viewer and keep an eye out for any recurrence. Can't tell you why it was broken in the first place, though!

    Regards,

    RichardVet

    Thank you RichardVet!!!

    Wednesday, May 01, 2013 2:32 PM
  • Log Name:      Microsoft-Windows-Kernel-EventTracing/Admin
    Source:        Microsoft-Windows-Kernel-EventTracing
    Date:          1/16/2013 6:22:23 PM
    Event ID:      3
    Task Category: Session
    Level:         Error
    Keywords:      Session
    User:          SYSTEM
    Computer:      shahjanand-PC
    Description:
    Session "Circular Kernel Context Logger" stopped due to the following error: 0xC0000188
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Microsoft-Windows-Kernel-EventTracing" Guid="{B675EC37-BDB6-4648-BC92-F3FDC74D3CA2}" />
        <EventID>3</EventID>
        <Version>0</Version>
        <Level>2</Level>
        <Task>2</Task>
        <Opcode>14</Opcode>
        <Keywords>0x8000000000000010</Keywords>
        <TimeCreated SystemTime="2013-01-17T02:22:23.969514500Z" />
        <EventRecordID>8</EventRecordID>
        <Correlation />
        <Execution ProcessID="4" ThreadID="5440" />
        <Channel>Microsoft-Windows-Kernel-EventTracing/Admin</Channel>
        <Computer>shahjanand-PC</Computer>
        <Security UserID="S-1-5-18" />
      </System>
      <EventData>
        <Data Name="SessionName">Circular Kernel Context Logger</Data>
        <Data Name="FileName">C:\windows\system32\WDI\LogFiles\ShutdownCKCL.etl</Data>
        <Data Name="ErrorCode">3221225864</Data>
        <Data Name="LoggingMode">128</Data>
      </EventData>
    </Event>
    Monday, June 24, 2013 8:14 PM
  • Nombre de registro:Microsoft-Windows-Kernel-EventTracing/Admin

    Origen:        Microsoft-Windows-Kernel-EventTracing

    Fecha:         07/10/3013 09:42:31 a. m.

    Id. del evento:3

    Categoría de la tarea:Sesión

    Nivel:         Error

    Palabras clave:Sesión

    Usuario:       SYSTEM

    Equipo:        SERVIDOR

    Descripción:

    Finalizó la sesión "Circular Kernel Context Logger" con el siguiente error: 0xC0000188

    XML de evento:

    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

      <System>

        <Provider Name="Microsoft-Windows-Kernel-EventTracing" Guid="{B675EC37-BDB6-4648-BC92-F3FDC74D3CA2}" />

        <EventID>3</EventID>

        <Version>1</Version>

        <Level>2</Level>

        <Task>2</Task>

        <Opcode>14</Opcode>

        <Keywords>0x8000000000000010</Keywords>

        <TimeCreated SystemTime="3013-10-07T14:42:31.653255200Z" />

        <EventRecordID>4</EventRecordID>

        <Correlation />

        <Execution ProcessID="4" ThreadID="212" />

        <Channel>Microsoft-Windows-Kernel-EventTracing/Admin</Channel>

        <Computer>SERVIDOR</Computer>

        <Security UserID="S-1-5-18" />

      </System>

      <EventData>

        <Data Name="SessionName">Circular Kernel Context Logger</Data>

        <Data Name="FileName">C:\Windows\system32\WDI\LogFiles\BootCKCL.etl</Data>

        <Data Name="ErrorCode">3221225864</Data>

        <Data Name="LoggingMode">41943168</Data>

        <Data Name="FailureReason">0</Data>

      </EventData>

    </Event>

    PLEASE HELP!!!

    Monday, October 07, 2013 6:29 PM
  • Can't tell you why it was broken in the first place, though!

    Regards,

    RichardVet
    Thanks! This worked for me as well, but I too, don't know why it broke in the first place. It was a new PC, freshly joined to the domain and updated. If it is somewhat related or tied in, I was having issues with WMI that I had to deal with. Had to rebuild it and re-register everything.

    Ranie

    Tuesday, October 15, 2013 3:03 PM
  • I can't find this, I have win 7 64 SP1...help

    Sunday, October 27, 2013 11:11 PM
  • Had an incident this morning that may throw some light on this issue.

    A Win 7 Pro machine in an Active Directory Domain could not access a mapped share (H:) on the server.  I disconnected the share, then attempted to remap it but found that H: was not available among the drive letters offered.  I mapped the share to another drive letter so the user could continue.

    When I followed up to try to find the cause, I found a device named H: under Portable Devices in Device Manager.  User said that a USB flash drive had been left in the machine over the weekend and the machine had been shut down.  I would surmise that on startup, the flash drive was recognised and obtained drive H: before the network connection was re-established so mapping the share failed.

    May or may not be significant, but 20 instances of "Circular Kernel Context Logger" on each startup.

     

    Tuesday, November 05, 2013 9:49 PM
  • I cannot find the file 'setup.etl' in win7 pro.  I found a 'panther\setup.exe' and a 'panther\setup'  any advice is appreciated.
    Tuesday, November 05, 2013 10:55 PM
  • You sure you aren't looking at FOLDERS? There is a folder named setup.exe, BUT setup.etl is a FILE plainly listed (probably a bit lower on your screen), not even hidden. Check again, IMO.

    BTW, renaming the file and autocreating a new one worked for me, too. Thanks :)

    • Edited by WillB69 Thursday, November 07, 2013 5:21 PM
    Thursday, November 07, 2013 5:20 PM
  • I believe this IS VERY significant. I recently discovered my girlfriend was using a KeyLogger program to monitor all internet activity as well as gain all of my passcode information. Since she knew I would monitor activity on my PCs, all of the program data was stored on her portable device, in this case, her ipod. Every time she rebooted the system with this device attached it automatically first, discovered my system admin password, then Impersonates the Administrator. There are several other things that happen this is simply an abridged version of the event.

    Here is a complete list of privileges it assigns to this "new user" :

    Privileges:        SeSecurityPrivilege
                SeTakeOwnershipPrivilege
                SeLoadDriverPrivilege
                SeBackupPrivilege
                SeRestorePrivilege
                SeDebugPrivilege
                SeSystemEnvironmentPrivilege
                SeImpersonatePrivilege

    Monday, April 21, 2014 7:42 AM
  • First, I apologize for hitting the wrong button, as a proposed answer instead of a reply.

    My reply to this issue would be to monitor your system for a KeyLogger program. This program may be hosted on a portable device. It will usually hide from the system, and run in a cloaked mode. The intent of these programs is to take periodic snapshots of your activity, as well as monitor EVERY keystroke made. This allows the program to monitor all emails, texts, chats, messaging of all types, as well as obtain log in information to ANY site visited.

    Most are designed to email these snap shots and logged keystrokes to a designated person.. The one snooping your activity.

    Monday, April 21, 2014 7:53 AM
  • Hi,

    I had the same trouble with Windows 7 (the RTM version). The Kernel context logger is a bit like a flight data recorder and takes snapshots of the system (I think every second) into a 100MB RAM file (not a log file on disk). It is needed.

    I found the fix:

    Rename this file: %windir%\panther\setup.etl to setup.old and reboot.

    Worked for me. To prove this, delete the logs in event viewer and keep an eye out for any recurrence. Can't tell you why it was broken in the first place, though!

    Regards,

    RichardVet

    I am having this exact same error.  I tried to perform this fix, but I could not find the setup.etl file.  The only setup files in this directory close are setuperr and setupact.  Any ideas? I would like to fix this error.

    Monday, May 05, 2014 10:40 AM
  • Hi,

    I had the same trouble with Windows 7 (the RTM version). The Kernel context logger is a bit like a flight data recorder and takes snapshots of the system (I think every second) into a 100MB RAM file (not a log file on disk). It is needed.

    I found the fix:

    Rename this file: %windir%\panther\setup.etl to setup.old and reboot.

    Worked for me. To prove this, delete the logs in event viewer and keep an eye out for any recurrence. Can't tell you why it was broken in the first place, though!

    Regards,

    RichardVet

    Well, I stumbled my way in here, because I started experiencing some problems with some Windows 7 SP1 64 Bit Enterprise Virtual Machines I have running and you can imagine the headache of dealing with this error appearing 20 times after each reboot on each VM. If you have some form of consolidated Event Error Log that is "farming" all of these event logs into one then you can imagine the nightmare of seeing constant errors showing up and flooding logs, so no THANK YOU MICROSOFT... :P

    Anyway, Thank You RichardVet for your solution although I wanted to add an addendum for those of you who also found that RichardVet's solution did not actually work 100% of the time. I went ahead and renamed the file, same error. I went ahead and deleted the file, same error. It seems this file is created as part of the initial install and then might get updated over time, but I found that it must exist otherwise error is generated even though it might never be used again.

    So basically, I created a blank TXT file and renamed it setup.etl - empty file, no edit, etc. Errors stopped, so just thought I would share that with others who still gets errors after RENAME or DELETION.

    If you have issues creating the file in the Panther folder or it does not exist, then create the file on your desktop and then COPY/PASTE into the Panther folder which you can also manually create.

    C:\Windows\Panther --> setup.etl

    Thanks and Good Luck... :)



    • Edited by DonChino Sunday, June 01, 2014 6:53 AM Mention File Permission and Existence
    Saturday, May 31, 2014 12:56 AM
  • Hi DonChino,

    How do you create a blank TXT file.

    Best regards, Luis

    Thursday, June 19, 2014 12:12 PM
  • To create a blank txt file, right-click on the desktop, and select "New" -> "Text Document"

    Change the name as usual ... right-click on the document icon (not the name) and select "Rename."

    You may need an administrative password.

    Saturday, June 21, 2014 10:25 PM