Windows – BootCKCL.etl file size & Session “Circular Kernel Context Logger” stopped due to the following error: 0xC0000188

analysisbootloggingperformancewindows 8

I have a few regular / re-occurring errors in my event viewer which seem to be linked to logging upon boot and shutdown. I am running Windows 8 x64 professional.

Event ID 4:

The maximum file size for session "Circular Kernel Context Logger" has been reached. As a result, events might be lost (not logged) to file "C:\WINDOWS\system32\WDI\LogFiles\BootCKCL.etl". The maximum files size is currently set to 104857600 bytes.

Event ID 3:

Session "Circular Kernel Context Logger" stopped due to the following error: 0xC0000188

I have tried renaming the BootCKCL.etl file and restarting, but a new one is created which is the same file size. The current file size is 102Mb

I also see this error but I am unsure if it related:

Custom dynamic link libraries are being loaded for every application. The system administrator should review the list of libraries to ensure they are related to trusted applications. Please visit http://support.microsoft.com/kb/197571 for more information.

The support article didnt really provide much help.

Is this a problem with booting / shutting down, or is it an issue with logging and the file sizes?

Does anyone have any ideas on how to fix this? I opened up the BootCKCL.etl file in Windows Performance Analyzer, and it gave me a warning:

Performance Analyzer noticed that 0 events and 13 buffers were lost in this trace.

This is usually created by insufficient bandwidth for ETW logging. Please try increasing the minimum and maximum number of buffers and / or the buffer size. Doubling these values would be a good first attempt. Please note, though, that this action increases the amount of memory reserved for ETW buffers, increasing memory pressure on your scenario. See "xperf -help start" for the associated command line operations.

Windows Performance analyzer might not be able to provide reliable data in this situation.

Would you like to continue analyzing this trace?

Also, when I try to open Performance monitor I get this error:

Unable to add these counters:

\Memory\Available MBytes

\Memory\% committed bytes in use

\Memory\cache faults/sec

\Physical Disk(*)\% idle time

\Physical Disk(*)\Avg. Disk Queue length

\Network interface(*)\bytes total/sec

Are all these errors with logging linked?

I have a boot trace etl file and performance monitor logs if anyone needs to see them?

Any help would be much appreciated.

Best Answer

0xC0000188 means log is full:

C:\Users\André>err 0xC0000188
# for hex 0xc0000188 / decimal -1073741432
  STATUS_LOG_FILE_FULL                                           ntstatus.h
# Log file space is insufficient to support this operation.
# 1 matches found for "0xC0000188"

Open regedit, go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\Circular Kernel Context Logger and increase the the value MaxFileSize to 200.

Related Question