locked
Microsoft explanation of Event 2 - Session "Circular Kernel Context Logger" failed to start with the following error: 0xC0000035 RRS feed

  • Question

  • Many people have posted about Event 2 - Session "Circular Kernel Context Logger" failed to start with the following error: 0xC0000035.  I have not seen any posts where someone from Microsoft explained why this event occurs, why it occurs in groups of 20 in about 10 seconds, how to prevent it, or whether it is something to be lived with.

    Can anyone, especially someone from the NTdebugging team, a/k/a Global Escalation Services (GES), address this?

    Thanks.

    • Edited by sejong Wednesday, September 22, 2010 4:51 PM
    Tuesday, September 21, 2010 1:13 PM

All replies

  • Hi,

     

    Thanks for posting in Microsoft TechNet forums.

     

    When you use Event Viewer to troubleshoot a problem, you need to locate events related to the problem, regardless of which event log they appear in.

     

    Can you specify which issue did you encounter? As I have a bunch of the same errors in my system too. This event error may occur when there is conflict with certain executable task from certain software. If you would like to figure out which software, you can refer to http://social.answers.microsoft.com/Forums/en-US/w7performance/thread/7e348a2a-49e1-4dd5-9c1c-229c1c9a5a99 for detailed steps.

     

    Best Regards

    Magon Liu

    TechNet Subscriber Support in forum. If you have any feedback on our support, please contact tngfb@microsoft.com

     


    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread. ”
    Wednesday, September 22, 2010 6:18 AM
  • Thanks for replying, and for the reference about eliminating possibly-conflicting third-party software.  In this case (as well as in other cases in other peoples' posts on this same topic), third-party software is not the problem because it occurs on a fresh install of Windows 7 (Enterprise x64, in this case) with no third-party software installed or running.  Additionally, this event is not a startup item; its occurrence is more closely associated with user logon.

    As I said in my initial post, many people have posted about this event, but to date there are no definitive answers from Microsoft.  That is what I am requesting.

    Wednesday, September 22, 2010 2:11 PM
  • Hi,

    Thank you for your feedback.

    I noticed this error persists in Safe Mode.

    This error occurs when the system repeatedly tries to start the logger session until it succeeds. A temporary failure to start mostly (but not always) happens during a system state transition from standby to running.

    Here we can have a better understanding of the the events of the Circular Kernel Context Logger:

    "Specifies the name of the file where the system state will be saved. The system state is a set of kernel events generated by taking a snapshot of the Circular Kernel Context Logger. The events of the Circular Kernel Context Logger include process events, thread events, disk operations, and other kernel information that provide an indication of what action the operating system was performing when the event was raised. Events for the Circular Kernel Context Logger remain in the operating system memory and are only written to file when a snapshot is taken of the Circular Kernel Context Logger. This property indicates the name of the file to which the contents of the Circular Kernel Context Logger will be written; the file will reside on the local system. The file name needs to be a file name only and cannot include the path to the file. "

    Hope it helps.


    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread. ”
    Tuesday, September 28, 2010 6:38 AM
  • Thanks for your reply, and for verifying that this error persists in Safe Mode.  Here are some follow-up comments.

    1.  You mentioned that the system repeatedly tries to start the logger session until it succeeds.  The error code in this event (0xC0000035) resolves to STATUS_OBJECT_NAME_COLLISION.  That may suggest that the failures to start the logger session are because another session is still running, and the new session can't be started until the other session stops.  In any event, why would it be necessary to start a session of the Circular Kernel Context Logger when it is configured to start when the computer starts?  Shouldn't it just run as long as the computer is running?  Since its purpose is to log system state events, why would it ever be designed to stop?

    2.  For those who want to eliminate occurrence of this event, one method that seems to work is to disable the Circular Kernel Context Logger in Computer Management > Perfomance > Data Collector Sets > Startup Event Trace Sessions.  Right-click Circular Kernel Context Logger, click Properties, and on the Trace Session tab, uncheck the "Enabled" box.  I think this means a kernel dump won't have the events that the Circular Kernel Context Logger collects, but maybe that is an acceptable tradeoff.

    3.  As an experiment, after disabling the Circular Kernel Context Logger as described above, I manually started an instance of it using the following command.  Running this way, I have not encountered the error.  However, this instance logs to a file instead of a buffer, and doesn't run at startup.  At this point, I am over my head, and someone who knows more may be able to say if this experiment proves anything.

    logman start "Circular Kernel Context Logger" -p "Circular Kernel Session Provider" (process,img,hf) -max 20 -mode circular -ets -o C:\PerfLogs\Admin\CKCL.etl

    4.  I noticed that on a couple of Server 2008 R2 systems I checked, the Circular Kernel Context Logger is disabled in Startup Event Trace Sessions.

    • Proposed as answer by maxblack Sunday, August 14, 2011 3:02 PM
    Tuesday, September 28, 2010 3:07 PM
  • Update - I have had a Windows 7 computer running for over a month with the Circular Kernel Context Logger disabled, with no ill effects, and - as expected - no instances of Event 2.
    Wednesday, November 10, 2010 6:00 PM
  • Yes an old thread, but after extensive surfing and a lot of "noise" wrt this issue, I've found this to be the most valuable information on the subject.

    I have noted the subject error, always 20 of them, and always immediately upon logging-off from one user on this PC and then logging-on to another (both admins).

    I have simply unticked Enabled as you had sejong, and will report-back here if I experience any further anomalies that may result from this, but so far so good!

    Sunday, August 14, 2011 3:02 PM
  • @maxblack- Thanks for the update.
    Monday, August 15, 2011 6:24 PM
  • Hurrah. Another MS error thread successfully answered by users, with nothing useful coming from MS.
    Thursday, February 11, 2016 1:17 AM