locked
Windows 8 Client "Kernel Event Tracing" Event ID: 2 Session "" failed to start with the following error: 0xC000000D RRS feed

  • Question

  • Hi Folks,

    I posted this in the following Windows 8 community but was directed here. I am doing Hyper-V too but this is more of a Server issue but that Category is missing here. Since Windows 8 can be what I am going to call a "Client Server with Hyper-V" with the appropriate Server Tools package installed, may I suggest adding that category.

    Jessen P replied on September 21, 2013

    Microsoft
    Support Engineer

    In reply to Phantom of the Mobile post on September 18, 2013

    Hi Crysta,



    The issue you have posted would be better suited in the TechNet Forums. I would recommend posting your query in the link below.

    http://social.technet.microsoft.com/Forums/en/category/w8itpro

    Please reply if you have any questions.

    ________________________________________________________________________________________

    Hi Folks,



    I have found the subject line for Windows 7 on TechNet and MSDN but nothing for W 8.x Pro specifically. As I try working through that, I would like to check this out for W 8 specifically, since some areas of W 8 is quite different compared to W 7. Further Details:

    EDIT:  These messages are coming out every few seconds on windows 8.0 Pro. On Windows 8.1 Pro & 8.1 ENT there are 5-10 an hour.

    Error 2013-09-18 14:11:38 Kernel-EventTracing 2 Session



    Windows 8 Client "Kernel Event Tracing" Event ID: 2 Session "" failed to start with the following error: 0xC000000D





    Log Name: Microsoft-Windows-Kernel-EventTracing/Admin
    Source: Microsoft-Windows-Kernel-EventTracing
    Date: 2013-09-18 14:11:38
    Event ID: 2
    Task Category: Session
    Level: Error
    Keywords: Session
    User: SYSTEM
    Computer: TammyLacey
    Description:
    Session "" failed to start with the following error: 0xC000000D
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    <System>
    <Provider Name="Microsoft-Windows-Kernel-EventTracing" Guid="{B675EC37-BDB6-4648-BC92-F3FDC74D3CA2}" />
    <EventID>2</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>2</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000000010</Keywords>
    <TimeCreated SystemTime="2013-09-18T20:11:38.444696700Z" />
    <EventRecordID>52272</EventRecordID>
    <Correlation />
    <Execution ProcessID="3592" ThreadID="4148" />
    <Channel>Microsoft-Windows-Kernel-EventTracing/Admin</Channel>
    <Computer>TammyLacey</Computer>
    <Security UserID="S-1-5-18" />
    </System>
    <EventData>
    <Data Name="SessionName">
    </Data>
    <Data Name="FileName">
    </Data>
    <Data Name="ErrorCode">3221225485</Data>
    <Data Name="LoggingMode">276824069</Data>
    </EventData>
    </Event>

    Further information that I can offer from the other post:

    In reply to Ronnie Vernon post on September 18, 2013

    Hi Ronnie,



    Thank you for your explanation. I am not a developer and I am not exactly sure how the event trace got started. I really want to get it shut off because it is flooding me with Events. I still have to go through the material you sent in detail to see if my answer is there.



    I can give you a bit of background that might be playing into this. I am trying to setup a Lab Server on my tower but I am currently having a problem with getting "File Server Resource Manager" running so I can use it in Server Manager(part of the Tools for W 8.x Pro Client Servers). As you can see I seem to have some problems with WMI and Services, and that might be where I have gotten the "tracing" going. Ultimately, I need to get Clustering going on my single Data Volume so it can share properly between xVHD's and my actual online OS's(I also have MultiBoot).



    Anything more that you can share to help me unravel this, I would appreciate.... :D   



    Thank You for what every you can enlighten us with,



    Best Regards,



    Crysta

    PS. I am realizing this is a very old problem, spanning several OS vintages. I sure hope we can get a solution in Windows 8.1 at least???? As for filters in Events, I use many already. If nothing else could this error be down graded to an "Informative"? :D


    PhotM Phantom of the Mobile




    Sunday, September 22, 2013 3:11 AM

All replies

  • Hi,

    Based on my research, it may be caused by startup items.

    I suggest you try clean boot to check the result:

    How to perform a clean boot to troubleshoot a problem in Windows 8, Windows 7, or Windows Vista

    http://support.microsoft.com/kb/929135

    If it doesn't work, I suggest try system file checker to check if the issue is fixed.

    Run SFC command in elevated command prompt

    SFC /scannow

    If the issue persists, please try system restore to check if we can get rid of this problem.

    How to restore, refresh, or reset your PC:

    http://windows.microsoft.com/en-US/windows-8/restore-refresh-reset-pc

    Regards,


    Kelvin_Hsu

    TechNet Community Support

    Tuesday, September 24, 2013 2:54 PM
  • Hi,

    Based on my research, it may be caused by startup items.

    I suggest you try clean boot to check the result:

    How to perform a clean boot to troubleshoot a problem in Windows 8, Windows 7, or Windows Vista

    http://support.microsoft.com/kb/929135

    If it doesn't work, I suggest try system file checker to check if the issue is fixed.

    Run SFC command in elevated command prompt

    SFC /scannow

    If the issue persists, please try system restore to check if we can get rid of this problem.

    How to restore, refresh, or reset your PC:

    http://windows.microsoft.com/en-US/windows-8/restore-refresh-reset-pc

    Regards,


    Kelvin_Hsu

    TechNet Community Support

    Hi Kelvin,

    I apologize for the delay of getting back to you, but I have been very busy working on the results of your research/above comment. In fact your research is correct, in my case when it comes to Services, One Intel Service in specific is the problem. As for SFC, I do that regularly along with DISM, both are definitely invaluable. The new DISM as well as the better "Patcher" (O.o :D) are the huge reasons I move totally away from Windows 7.

    Now for the details. The problem child is the Intel ProSet Ethernet Monitor Service that monitors my Ethernet Network Adapter. I believe it maybe in conjunction with the Driver BUT the Event Errors that come out every 15 to 30 Seconds Stop, when I Stop that Service. That does not disrupt my actual/virtual connection on the adapter/vSwitch. This is still true after I updated some resent Intel Updates and the remaining "Patch Lady" released Windows 8 Patches. All is up to date and the problem still exists. I guess it is time to go to Intel. 

    On Windows 8.1 Pro Preview or ENT, the results are the same, except I can't update the Drive/ProSet because the Updater doesn't recognize those OS's. 

    Kelvin, if you have anything further to offer as I take this to Intel, I would sure appreciate the input!!!

    Best Regards,

    Crysta


    PhotM Phantom of the Mobile


    Friday, September 27, 2013 11:50 PM