none
Kernel-EventTracing errors Windows 7

    Question

  • Shortly after start-up, the event viewer reports the error under Kernel-Event Tracing:
    Session "" failed to start with the following error: 0xC000000D (Security User ID: S-1-5-18)
    followed by approximately 1 minute later:
    Session "" failed to start with the following error: 0xC0000022 (Security User ID: S-1-5-19)

    If I attempt to generate a system health report or try to start a system Data Collector Sets Diagnostics or Performance, I get an "access denied" error.  I'm running Windows 7 RC1 64bit on a machine with multiple operating systems.  Any help would be appreciated.
    Oldie
    Monday, June 22, 2009 9:42 AM

Answers

  • Are these errors depriving you of any functionality or causing problems? If not, I would suggest ignoring those errors in the event log.

    -Nick
    Thursday, June 25, 2009 11:50 PM

All replies

  • Are these errors depriving you of any functionality or causing problems? If not, I would suggest ignoring those errors in the event log.

    -Nick
    Thursday, June 25, 2009 11:50 PM
  • Thank you for your suggestion.  As I explained in my original message, I cannot Generate a Health report or run system diagnostics, so there is some loss of functionality.

    jebyrne
    Oldie
    Friday, June 26, 2009 12:16 PM
  • Hello;

    today I received the same message, most of the system blocks me out while the IE and MMC are still running on all accounts...

    So I'm not able to open the explorer (neither from Startmenue nor Taskman) it always shuts down with failure notice:

    »starting of server aborted (or failed)*«                                                     *I don't know the exact message text in englisch


    The management Console provides the following message:

    - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    - <System>
      <Provider Name="Microsoft-Windows-Kernel-EventTracing" Guid="{B675EC37-BDB6-4648-BC92-F3FDC74D3CA2}" />
      <EventID>2</EventID>
      <Version>0</Version>
      <Level>2</Level>
      <Task>2</Task>
      <Opcode>12</Opcode>
      <Keywords>0x8000000000000010</Keywords>
      <TimeCreated SystemTime="2009-06-30T11:56:30.702200000Z" />
      <EventRecordID>46</EventRecordID>
      <Correlation />
      <Execution ProcessID="4" ThreadID="48" />
      <Channel>Microsoft-Windows-Kernel-EventTracing/Admin</Channel>
      <Computer>Testrechner_64</Computer>
      <Security UserID="S-1-5-18" />
      </System>
    - <EventData>
      <Data Name="SessionName">Circular Kernel Context Logger</Data>
      <Data Name="FileName" />
      <Data Name="ErrorCode">3221225525</Data>
      <Data Name="LoggingMode">268436608</Data>
      </EventData>
      </Event>

    Does anybody also get similiar experiences?

    Please tell me!

    Thx Hanno
    Please answer
    Tuesday, June 30, 2009 12:40 PM
  • Shortly after start-up, the event viewer reports the error under Kernel-Event Tracing:
    Session "" failed to start with the following error: 0xC000000D (Security User ID: S-1-5-18)
    followed by approximately 1 minute later:
    Session "" failed to start with the following error: 0xC0000022 (Security User ID: S-1-5-19)

    If I attempt to generate a system health report or try to start a system Data Collector Sets Diagnostics or Performance, I get an "access denied" error.  I'm running Windows 7 RC1 64bit on a machine with multiple operating systems.  Any help would be appreciated.
    Oldie

    I have just had the Windows Performance info fail with 'kernel logger is preventing storage subsystem analysis' or similar...
    so some loss of functionality
    looking into it, I have not been using the kernel logger.
    Toby Gaffney
    Saturday, July 04, 2009 10:57 PM
  • Hello;

    today I received the same message, most of the system blocks me out while the IE and MMC are still running on all accounts...

    So I'm not able to open the explorer (neither from Startmenue nor Taskman) it always shuts down with failure notice:

    »starting of server aborted (or failed)*«                                                     *I don't know the exact message text in englisch


    The management Console provides the following message:

    - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    - <System>
      <Provider Name="Microsoft-Windows-Kernel-EventTracing" Guid="{B675EC37-BDB6-4648-BC92-F3FDC74D3CA2}" />
      <EventID>2</EventID>
      <Version>0</Version>
      <Level>2</Level>
      <Task>2</Task>
      <Opcode>12</Opcode>
      <Keywords>0x8000000000000010</Keywords>
      <TimeCreated SystemTime="2009-06-30T11:56:30.702200000Z" />
      <EventRecordID>46</EventRecordID>
      <Correlation />
      <Execution ProcessID="4" ThreadID="48" />
      <Channel>Microsoft-Windows-Kernel-EventTracing/Admin</Channel>
      <Computer>Testrechner_64</Computer>
      <Security UserID="S-1-5-18" />
      </System>
    - <EventData>
      <Data Name="SessionName">Circular Kernel Context Logger</Data>
      <Data Name="FileName" />
      <Data Name="ErrorCode">3221225525</Data>
      <Data Name="LoggingMode">268436608</Data>
      </EventData>
      </Event>

    Does anybody also get similiar experiences?

    Please tell me!

    Thx Hanno
    Please answer

    Yes almost identical, anybody know anything about this other than to just ignore it?
    Thursday, December 10, 2009 1:42 PM
  • So what is it? I dont think ignoring it is an answer......LOL
    Friday, December 11, 2009 2:13 PM
  • The   "circular kernel context logger"   recoge frecuentes tomas  dentro de los 100 MB de RAM (no sobre el disco) que son necesrios para el sistema.
    El problema falla en el arranque, y se encuentra en la siguiente carpeta y archivo: 
      %windir%\panther\septup.etl

    Renombrando el archivo septu.etl por
    septup.old
    Se reinicia
    Y listo....a mí no me ha aparecido más....
    ----------------------------------------------------------------------------------------------------------------------------------------


    The circular kernel context logge.takes frequent snapshots of the system into a 100MB RAM file (not on disk). It is needed.

    To fix the "fail to start" error, find the following file in the %windir%\panther\ folder:

    setup.etl

    and rename it to

    setup.old

    It can stay in the \panther\ folder.

    Reboot and all is done!

    • Proposed as answer by pswissmeyer Friday, January 24, 2014 10:58 AM
    Friday, January 15, 2010 10:15 AM
  • I tried the rename setup.etl to setup.old and reboot and it did not help my situation. Did this fix anyone else's problem?
    Thursday, April 12, 2012 6:38 PM
  • ANSWER:

    1. Run RegEdit and search the registry for the GUID {B675EC37-BDB6-4648-BC92-F3FDC74D3CA2} listed for the error.  It may not be the first result, but the registry key location will give you the name of the Data Collector Set in Performance Monitor that is throwing up the error.  The session name should have been listed between the quotes in the error but for some reason it was not.

    2.  Open Performance Monitor and select the Data Collector set that we found above, on my machine it was Data Collector Sets>Startup Event Trace Sessions>EventLog-System.

    3.  The reason for my error was the EventLog-System was not being written to file, to fix I right click on the EventLog-System Startup Event Trace Session and clicked Properties.  Then I clicked the Trace Session Tab and set the Stream Mode to File and Realtime. Then Clicked Okay!  

    4. On reboot the error is gone.

    Session "" failed to start with the following error: 0xC0000022

    -<EEvent xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

    - <System>
    <Provider Name="Microsoft-Windows-Kernel-EventTracing" Guid="{B675EC37-BDB6-4648-BC92-F3FDC74D3CA2}" />
    <EventID>2</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>2</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000000010</Keywords>
    <TimeCreated SystemTime="2012-05-31T06:29:57.547131600Z" />
    <EventRecordID>1234</EventRecordID>
    <Correlation />
    <Execution ProcessID="1632" ThreadID="1044" />
    <Channel>Microsoft-Windows-Kernel-EventTracing/Admin</Channel>
    <Computer>eVGAx58</Computer>
    <Security UserID="S-1-5-19" />
    </System>
    - <EventData>
    <Data Name="SessionName" />
    <Data Name="FileName" />
    <Data Name="ErrorCode">3221225506</Data>
    <Data Name="LoggingMode">268443650</Data>
    </EventData>
    </Event>



    DaBaZ


    • Edited by BaZL Thursday, May 31, 2012 7:25 AM
    Thursday, May 31, 2012 7:23 AM
  • Delar, it may be a different Trace Session that is causing your error, see my Reply above on how to fix.  

    DaBaZ

    Thursday, May 31, 2012 7:27 AM