none
Event ID: 4, Source: Microsoft-Windows-Kernel-EventTracing, maximum file size for session "ReadyBoot" has been reached.

    Question

  • Hello,
    I upgraded my machine to Win7 x64 Pro about 3 weeks ago. My HW is an Asus mobo, Intel Q9450 w/8GB RAM. The boot drives are two Raptors configured as RAID01. All the drivers are the latest available from Intel, Asus and 3rd party vendors. My WEI is 5.9, limited by the disk transfer rates, otherwise 7.1 and 7.2 on the other indexes.
    I've been receiving these errors at boot;

    Log Name:      Microsoft-Windows-Kernel-EventTracing/Admin
    Source:        Microsoft-Windows-Kernel-EventTracing
    Date:          11/10/2009 7:51:03 AM
    Event ID:      4
    Task Category: Logging
    Level:         Warning
    Keywords:      Session
    User:          SYSTEM
    Computer:      herbt-PC
    Description:
    The maximum file size for session "ReadyBoot" has been reached. As a result, events might be lost (not logged) to file "C:\Windows\Prefetch\ReadyBoot\ReadyBoot.etl". The maximum files size is currently set to 20971520 bytes.
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Microsoft-Windows-Kernel-EventTracing" Guid="{B675EC37-BDB6-4648-BC92-F3FDC74D3CA2}" />
        <EventID>4</EventID>
        <Version>0</Version>
        <Level>3</Level>
        <Task>1</Task>
        <Opcode>10</Opcode>
        <Keywords>0x8000000000000010</Keywords>
        <TimeCreated SystemTime="2009-11-10T12:51:03.393985600Z" />
        <EventRecordID>28</EventRecordID>
        <Correlation />
        <Execution ProcessID="4" ThreadID="164" />
        <Channel>Microsoft-Windows-Kernel-EventTracing/Admin</Channel>
        <Computer>herbt-PC</Computer>
        <Security UserID="S-1-5-18" />
      </System>
      <EventData>
        <Data Name="SessionName">ReadyBoot</Data>
        <Data Name="FileName">C:\Windows\Prefetch\ReadyBoot\ReadyBoot.etl</Data>
        <Data Name="ErrorCode">3221225864</Data>
        <Data Name="LoggingMode">0</Data>
        <Data Name="MaxFileSize">20971520</Data>
      </EventData>
    </Event>

    The image for PID 4 is listed as System.

    My searches have turned up similar events listed but no solutions.
    Any help would be appreciated.
    Cheers!
    Tuesday, November 10, 2009 2:05 PM

Answers

  • Hey guys, the solution is simple - just increase the max file size! Go to:

     

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\ReadyBoot

     

    The MaxFileSize key is a DWORD with a default decimal value of 20. Increase this to, say 60, and the problem will go away.

     

    Luck to ya!

    Sunday, May 09, 2010 8:56 PM

All replies

  • Hi,

     

    I would like to know if you are able to boot into the system now and if the ReadyBoost is used.

     

    To troubleshoot this issue, please check if it occurs in Safe mode first.

     

    If it persists, try enabling the Superfetch service:

     

    Start Superfetch service

    ===========================

    1. Click the Start Button, type "services.msc" (without quotes) in Start Search box, and press Enter.

    2. Double click the service "Superfetch".

    3. Click on the "General" tab; make sure the "Startup Type" is "Automatic" or "Manual". Then please click the "Start" button under "Service Status" to start the service.

    4. Click OK.

     


    Vivian Xing - MSFT
    • Marked as answer by Vivian Xing Monday, November 16, 2009 8:37 AM
    • Unmarked as answer by herbtea Thursday, December 17, 2009 9:03 PM
    Wednesday, November 11, 2009 7:27 AM
  • Hi Vivian,
    Thanks for the reply.
    This error is popping up about every other day.

    - I'm not using ReadyBoost, system has 8GB RAM
    - Superfetch is set to "Automatic" and was started when I checked it's state this morning. I did get the ReadyBoot error this morning too.
    - In about half the instances where the error above occurs it is immediately preceded in the events log by the following error that has the same time stamp but I'm assuming as it's listed first that at a higher time resolution it is occurring first.

    Log Name:      Microsoft-Windows-Kernel-EventTracing/Admin
    Source:        Microsoft-Windows-Kernel-EventTracing
    Date:          11/16/2009 8:16:35 AM
    Event ID:      3
    Task Category: Session
    Level:         Error
    Keywords:      Session
    User:          SYSTEM
    Computer:      herbt-PC
    Description:
    Session "ReadyBoot" stopped due to the following error: 0xC0000188
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Microsoft-Windows-Kernel-EventTracing" Guid="{B675EC37-BDB6-4648-BC92-F3FDC74D3CA2}" />
        <EventID>3</EventID>
        <Version>0</Version>
        <Level>2</Level>
        <Task>2</Task>
        <Opcode>14</Opcode>
        <Keywords>0x8000000000000010</Keywords>
        <TimeCreated SystemTime="2009-11-16T13:16:35.547197100Z" />
        <EventRecordID>31</EventRecordID>
        <Correlation />
        <Execution ProcessID="4" ThreadID="164" />
        <Channel>Microsoft-Windows-Kernel-EventTracing/Admin</Channel>
        <Computer>herbt-PC</Computer>
        <Security UserID="S-1-5-18" />
      </System>
      <EventData>
        <Data Name="SessionName">ReadyBoot</Data>
        <Data Name="FileName">C:\Windows\Prefetch\ReadyBoot\ReadyBoot.etl</Data>
        <Data Name="ErrorCode">3221225864</Data>
        <Data Name="LoggingMode">0</Data>
      </EventData>
    </Event>

    As this isn't an every boot occurrance let me know if you would still like me to try booting in safte mode.
    Thanks,
    Herb

    Monday, November 16, 2009 2:12 PM
  • Hi Vivian, any ideas on this?
    Thanks
    Thursday, December 17, 2009 9:12 PM
  • You can ignore this. This only shows, that the log file is too small and the kernel can't save all ETW (Event Tracing for Windows) Events for ReadyBoot (not ReadyBoost). ReadyBoot is the improved Bootprefetcher, you know from XP.

    André
    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    Friday, December 18, 2009 12:19 PM
  • I have the exact same errors.  I don't want to ignore it.   Wouldn't I want the system to log events that need to be logged???    If a log file is too big, shouldn't it rollover automatically?

    I did disable Superfetch a couple of weeks ago when I was trying (unsuccessfully) to address the constant disk activity light.   When I read about superfetch at the time, I concluded it was not necessary for my system needs.  If that's the culprit to this issue, why are these things optional?  But may not be related as the OP has superfetch enabled.

    Also, I use hibernate nearly all the time.   WHen I just came out of hibernation now, an alert on the screen flashed by, but it was too fast to read it.   Something about "last boot...".    That's when I went to the Event Viewer to see what that alert was, but nothing applicable seen, except maybe this.   And I don't exactly know if its applicable to the ReadyBoot error because I couldn't read the screen error.

    It doesn't help that the "More Information" link for event_log_online never comes back with anything.   :-(  Besides,  regular users shouldnt have to be troubleshooting the kernel!!!  I just want to drive the car.  If a light comes on and says I need an oil change, okay, I can handle that.   :-)




    Friday, December 18, 2009 7:07 PM
  • I have exactly the same problem. I am running Windows 7 x64bit with 12 GB of RAM. Superfetch is already in Auto. I assume this is just a Windows 7 quirk.
    Saturday, December 19, 2009 4:19 PM
  • Session "Circular Kernel Context Logger" failed to start with the following error: 0xC0000035

    As suggested above I assume this is a microsoft issue?  It has been discussed here and other forums for quite some time.  I never have seen a fix?  I wish when we received errors of this nature microsoft would tell us what they were.  How is this related to superfetch?  What is superfetch?  Why would superfetch have changed?

     

    BY THE WAY....  Superfetch is on(started) is on automatic and logs on as local system.  So this is not the cause of my issue.  Also what is readyboot?  Does the average computer really know what these programs/services or unique microsoft words/terms are?

    - System
       
    - Provider
          [ Name] Microsoft-Windows-Kernel-EventTracing
          [ Guid] {B675EC37-BDB6-4648-BC92-F3FDC74D3CA2}
       
      EventID 2
       
      Version 0
       
      Level 2
       
      Task 2
       
      Opcode 12
       
      Keywords 0x8000000000000010
       
    - TimeCreated
          [ SystemTime] 2010-04-11T14:35:49.829600000Z
       
      EventRecordID 25
       
      Correlation
       
    - Execution
          [ ProcessID] 4
          [ ThreadID] 48
       
      Channel Microsoft-Windows-Kernel-EventTracing/Admin
       
      Computer Daddy-PC
       
    - Security
          [ UserID] S-1-5-18
    - EventData
        SessionName Circular Kernel Context Logger
        FileName  
        ErrorCode 3221225525
        LoggingMode 268436608
    Windows7, Windows, Win7
    Sunday, April 11, 2010 3:22 PM
  • Same issues here, have searched for months & months for a solution but found none.  Please update if you have any ideas.
    Friday, April 23, 2010 5:02 PM
  • Hey guys, the solution is simple - just increase the max file size! Go to:

     

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\ReadyBoot

     

    The MaxFileSize key is a DWORD with a default decimal value of 20. Increase this to, say 60, and the problem will go away.

     

    Luck to ya!

    Sunday, May 09, 2010 8:56 PM
  • Sorry gang - I will have to report results back as they roll in for changing the MaxFileSize key.  However - this is why EVERYONE I know laughs in my face with vigor for bothering to attempt WIN 7/64 bit in a (small, no IT nerds) business production environment.  It is almost time to can this bleeding edge jive and go back to an OS that works.
    Thursday, November 11, 2010 5:18 AM
  • Change the setting in the registry, please.

    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    Friday, December 17, 2010 12:43 PM
  • Thank you Andre.Ziegler, this fix worked perfectly!
    Sunday, September 18, 2011 9:56 AM
  • I ran into this as well and just wanted to suggest another way to set the MaxFileSize without having to use regedit.exe.

    ----

    * Open the Performance Monitor management console, e.g., "Administrative Tools" -> "Performance Monitor", or, "perfmon.msc /s" from the Command Prompt.

    * Under the management console sub-folder "Data Collector Sets" -> "Startup Event Trace Sessions", Open the "ReadyBoot" Trace Session Property Sheet.

    * Select the "Stop Condition" panel.

    * Increase the "Maximum Size" value as needed.

    * Press OK, and exit.

    ----

    This method is a bit safer than using regedit.exe.

    Hope this is helpful.

    Regards,

    Rob


    • Proposed as answer by Rob Penn Friday, April 27, 2012 8:08 PM
    • Edited by Rob Penn Friday, April 27, 2012 8:10 PM Readability
    Friday, April 27, 2012 8:08 PM
  • Hello all, i have had a similar issue and posted the same question with screenshots and have got the answer similar to what voxmuta is saying. in the link here http://social.technet.microsoft.com/Forums/en-US/w7itprogeneral/thread/bcc0b664-9082-46bb-a3f1-465bd4621f42 you can see the screenshot of what is being talked about here.
    Sunday, July 01, 2012 6:46 PM
  • Thanks, Rob, your non-regedit suggestion was very clearly written. Changed Readyboot to 60, now let's see if pc quiets down.

    Erin

    Sunday, July 01, 2012 10:02 PM
  • I ran into this as well and just wanted to suggest another way to set the MaxFileSize without having to use regedit.exe.

    ----

    * Open the Performance Monitor management console, e.g., "Administrative Tools" -> "Performance Monitor", or, "perfmon.msc /s" from the Command Prompt.

    * Under the management console sub-folder "Data Collector Sets" -> "Startup Event Trace Sessions", Open the "ReadyBoot" Trace Session Property Sheet.

    * Select the "Stop Condition" panel.

    * Increase the "Maximum Size" value as needed.

    * Press OK, and exit.

    ----

    This method is a bit safer than using regedit.exe.

    Hope this is helpful.

    Regards,

    Rob


    Rob,

    Great tip. Thanks.

    Would it not help if I check the checkbox next to "Circular" in the Log Mode on File tab. That would keep the file at 20 MB and eliminate the errors, right?

    Tuesday, July 10, 2012 8:03 PM
  • fwiw;   Somewhere in Microsoft support pages it discusses log file sizes,,, and to eliminate a known problem of non stop growing memory use,   to clear all of the event log files properly,  after properly changing any one of their file sizes.
    Friday, November 16, 2012 11:03 PM
  • Using Parameters as Trouble Shooting Tools

    Thanks for you input, know I have decided what my plan is to deal with this problem in general.  There are more than just one log that has been stopped:

    You can't ignore the logs, which have been stopped. You need to turn the logs back on to decide what to do while maintaining hard drive usage at the expense of more CPU usage.

    • Record all the logs that are in the stopped state before they roll off the admin log you are looking at (I'm using Kernel-Event Tracing, that's where I can see the patterns of non-circular logs).
    • Then make the log you think is the most important a circular log process and try to get the problem fixed.
      • Once the problem is fixed. Set a reasonable limit (I think the 20MB is wise) to give you an alert if you miss it next time.
    • If you've done as much as you can and it's not fixed, refer the problem to someone else to fix, set the file size limit again and create a reminder that the problem is not fixed until you make the control circular and are satisfied it is fixed!

    Tuesday, December 24, 2013 3:45 AM