BootCKCL.etl file size & Session "Circular Kernel Context Logger" stopped due to the following error: 0xC0000188

Question

I have a few regular / re-occurring errors in my event viewer which seem to be linked to logging upon boot and shutdown. I am running Windows 8 x64 professional.

Event ID 4:

The maximum file size for session "Circular Kernel Context Logger" has been reached. As a result, events might be lost (not logged) to file "C:\WINDOWS\system32\WDI\LogFiles\BootCKCL.etl". The maximum files size is currently set to 104857600 bytes.

Event ID 3:

Session "Circular Kernel Context Logger" stopped due to the following error: 0xC0000188

I have tried renaming the BootCKCL.etl file and restarting, but a new one is created which is the same file size. The current file size is 102Mb

I also see this error but I am unsure if it related:

Custom dynamic link libraries are being loaded for every application. The system administrator should review the list of libraries to ensure they are related to trusted applications. Please visit http://support.microsoft.com/kb/197571 for more information.

The support article didnt really provide much help.

Is this a problem with booting / shutting down, or is it an issue with logging and the file sizes?

Does anyone have any ideas on how to fix this? I opened up the BootCKCL.etl file in Windows Performance Analyzer, and it gave me a warning:

Performance Analyzer noticed that 0 events and 13 buffers were lost in this trace.

This is usually created by insufficient bandwidth for ETW logging. Please try increasing the minimum and maximum number of buffers and / or the buffer size. Doubling these values would be a good first attempt. Please note, though, that this action increases the amount of memory reserved for ETW buffers, increasing memory pressure on your scenario. See "xperf -help start" for the associated command line operations.

Windows Performance analyzer might not be able to provide reliable data in this situation.

Would you like to continue analyzing this trace?

Also, when I try to open Performance monitor I get this error:

Unable to add these counters:

\Memory\Available MBytes

\Memory\% committed bytes in use

\Memory\cache faults/sec

\Physical Disk(*)\% idle time

\Physical Disk(*)\Avg. Disk Queue length

\Network interface(*)\bytes total/sec

Are all these errors with logging linked?

I have a boot trace etl file and performance monitor logs if anyone needs to see them?

Any help would be much appreciated.

Solution

0xC0000188 means log is full:

C:\Users\André>err 0xC0000188
# for hex 0xc0000188 / decimal -1073741432
  STATUS_LOG_FILE_FULL                                           ntstatus.h
# Log file space is insufficient to support this operation.
# 1 matches found for "0xC0000188"

Open regedit, go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\Circular Kernel Context Logger and increase the the value MaxFileSize to 200.

Comments

[Jonathan]

hi thank you, I have carried out your suggestion but the error still persists :-(

[Jonathan]

can anyone else please help with these issues, they are driving me insane

[magicandre1981]

can you make a normal boot trace? msfn.org/board/index.php?showtopic=158252 Maybe I can see issues and fixing them also fixes your issue.

[Jonathan]

is it just the *.etl file that you require? its 2Gb in size! If you can let me know I will upload it and send you the link.

[magicandre1981]

compress the ETL as 7z and upload it to skydrive/dropbox/google drive and post a link here

[Jonathan]

Here you go docs.google.com/file/d/0ByzUKz7d908nTjM3RW9EUjdQU0E/… - let me know if you have trouble accessing it

[magicandre1981]

your boot is a disaster with a fast SSD like the 840 Pro. Can you post some AS SSD Benchmark (alex-is.de/PHP/fusion/downloads.php?download_id=9) pictures? I see the SSD is so busy and this should not happen.

[Jonathan]

thanks again for your help.......I've used that benchmark before! Off the top of my head, the last time I ran the benchmark the overall score was over 1000. However, I will run it again when I get home from work and post the pictures for you.

[Jonathan]

Hi again magicandre. Here is the link to my SSD benchmarking image: i5.photobucket.com/albums/y164/jpmad4it/ssd.jpg

[magicandre1981]

the sequential write is a bit slow, the rest seams to be ok: servethehome.com/wp-content/uploads/2012/11/… Try to update the Intel AHCI driver or try the Microsoft AHCI driver. Does this improve performance? Have you tried to make a complete backup of the System, set the SSD back to the factory state and restore the image? This restore to factory state (use Samsungs SSD tool) improve performance.

[Jonathan]

if I do this, is it likely to fix the issues that I mentioned in my first post i.e. the errors that I am receiving in the event log and performance monitor?

[magicandre1981]

try it out and look if it improves performance. If Windows now boots faster, you should have a smaller BootCKCL.etl.

[Jonathan]

I have the latest version of Intel Rapid Storage Technology RAID Driver - is this the same as the AHCI driver? Is the BootCKCL.etl file so large due to the amount of start-up items? If so, if I restore the factory state of the SSD and then restore my windows image, will the problem with the BootCKCL.etl file just come back?

[magicandre1981]

try the MS driver. I see you use a Marvell RAID, so you should not need an Intel RAID driver. Make a complete system image before changing anything.

[Jonathan]

I have my operating system on the SSD which is on the Intel controller and then 4x500GB HDD's in a RAID0 on the Marvell controller. Do I still not need the Intel driver?

[magicandre1981]

I don't think you need the Intel driver.