Monday, January 20, 2014

Windows 7: Error event 2: Session "Circular Kernel Context Logger" stopped due to the following error: 0xC0000188

Problem

The following error appears in the System event log:

Log Name: Microsoft-Windows-Kernel-EventTracing/Admin Source: Microsoft-Windows-Kernel-EventTracing Date: [date/time] Event ID: 3 Task Category: Session Level: Error Keywords: Session User: SYSTEM Computer: Main Description: Session "Circular Kernel Context Logger" stopped due to the following error: 0xC0000188 Event Xml: <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">   <System>     <Provider Name="Microsoft-Windows-Kernel-EventTracing" Guid="{B675EC37-BDB6-4648-BC92-F3FDC74D3CA2}" />     <EventID>3</EventID>     <Version>0</Version>     <Level>2</Level>     <Task>2</Task>     <Opcode>14</Opcode>     <Keywords>0x8000000000000010</Keywords>     <TimeCreated SystemTime="date" />     <EventRecordID>1778</EventRecordID>     <Correlation />     <Execution ProcessID="4" ThreadID="176" />     <Channel>Microsoft-Windows-Kernel-EventTracing/Admin</Channel>     <Computer>Main</Computer>     <Security UserID="S-1-5-18" />   </System>   <EventData>     <Data Name="SessionName">Circular Kernel Context Logger</Data>     <Data Name="FileName">C:\Windows\system32\WDI\LogFiles\BootCKCL.etl</Data>     <Data Name="ErrorCode">3221225864</Data>     <Data Name="LoggingMode">128</Data>   </EventData> </Event>
Troubleshooting
  1. Ran Err.exe to view the error code text.
  2. Launched Computer Management and navigated to: Performance > Data Collector Sets > Startup Event Trace Sessions.
  3. Right-clicked Circular Kernel Context Logger.
  4.   Checked File tab to change file options, but found options disabled:
  5. Searched Registry to find appropriate key that controls log file size, as suggested by this reference, but found not one but several keys (through search for "Circular Kernel Context Logger") having this property:  
    HKLM\SYSTEM\ControlSet001\Control\WMI\Autologger\Circular Kernel Context Logger
    HKLM\SYSTEM\ControlSet002\Control\WMI\Autologger\Circular Kernel Context Logger
    HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\Circular Kernel Context Logger

    so, uncertain which to adjust.
My Solution
 
Disable Circular Kernel Context Logger.  Given that this workstation was not critical, disabling this logging seemed the most practical approach.

NOTE: see comment from Anonymous below regarding control sets.

References

4 comments:

Anonymous said...

Never make changes to ControlSet002 or 001; change only CurrentControlSet. That's the one that's being used. The others are only backups. See http://support.microsoft.com/kb/100010

Al said...

Excellent comment. Thank you for the reference.

GustavoVitoAlonzoYo said...

So Al, what have you done exactly to address this in the end ?
Just curious as i'm on that right now.
Thanks

Al said...

I haven't resolved it to date.