Share via


Windows 10 event Id 4: "AutoLogger-Diagtrack-Listener" Max filesize reached

Question

Sunday, February 7, 2016 12:00 AM | 1 vote

Hi, I am getting loads of 'Kernel-Event tracing' errors most of which are related to Logs but all have event ID 2

Typically the errors are :

Session "HomeGroupLog" failed to start with the following error: 0xC0000035

Session "P2PLog" failed to start with the following error: 0xC0000035

Session "IDListenLog" failed to start with the following error: 0xC0000035

Session "NegoLog" failed to start with the following error: 0xC0000035

Session "Pku2uLog" failed to start with the following error: 0xC0000035

And so on and repeating over and over.

I now seem to have a problem with "AutoLogger-Diagtrack-Listener" Uder Event ID 4: Transcript:

The maximum file size for session "AutoLogger-Diagtrack-Listener" has been reached. As a result, events might be lost (not logged) to file "C:\ProgramData\Microsoft\Diagnosis\ETLLogs\AutoLogger\AutoLogger-Diagtrack-Listener.etl". The maximum files size is currently set to 33554432 bytes.

I had a similar error with the "ReadyBoot log" but it seems sa lot of people are and I increased the size in the registry from 20 to 60 and that error has dissapeared but now I have the above. All centering arounf logs of one sort or another. I have tried searching using the keywords "AutoLogger-Diagtrack-Listener" and it would seem I am alone in this one as I keep getting results for "Ready Boot"

I hope someone can help me sort this out?Thanks

Delboy

All replies (4)

Sunday, February 7, 2016 5:49 PM âś…Answered | 5 votes

Disable (Microsoft recording what you do) in Windows 10

After start windows 10 please open cmd.exe

with Shift + F10

use Sc.exe to delete the 2 services
run this:
Code:

sc delete dmwappushsvc
sc delete diagtrack

and deny system accessing the file AutoLogger-Diagtrack-Listener.etl with cacls

go to the dir
Code:

cd c:\ProgramData\Microsoft\Diagnosis\etlogs\autologger
echo "" > AutoLogger-Diagtrack-Listener.etl
cacls  AutoLogger-Diagtrack-Listener.etl  /d SYSTEM

If you have no problem with Microsoft collecting data and you use Win 10 in vmware. Then no need to do it.

Source : http://forums.mydigitallife.info/threads/57339-Guide-Way-to-Disable-Keylogger


Sunday, February 7, 2016 6:46 PM

Hi,

Thank you so much Luciano for your help but for some reason I could not complete the steps. I ran CMD as Administrator and ran:

sc delete dmwappushsvc

But it came back with:

[SC] OpenService FAILED 1060:

The specified service does not exist as an installed service.

I then tried:

sc delete diagtrack****

Which was sucessful

I then tried:

cd c:\ProgramData\Microsoft\Diagnosis\etlogs\autologger

But my folder structure goes no deeper than:

C:\ProgramData\Microsoft\Diagnosis>

Here is the output from Dir:

C:\ProgramData\Microsoft\Diagnosis>dir
* Volume in drive C is System*
* Volume Serial Number is D696-FEB4*

* Directory of C:\ProgramData\Microsoft\Diagnosis*

23/01/2016  11:13        50,331,648 events00.rbs
23/01/2016  11:13        12,750,684 events01.rbs
23/01/2016  11:13         1,006,632 events10.rbs
23/01/2016  11:13         3,019,898 events11.rbs
23/01/2016  11:27               340 parse.dat
*               5 File(s)     67,109,202 bytes*
*               0 Dir(s)  439,359,021,056 bytes free*

This is where I stopped because I figured that even though sc failed on the first log it may be ok to carry on, but having files and folder structure missing I decided I needed your advice?

Regards

Derek



Monday, February 15, 2016 2:53 PM

Hi Derek,

I found this worked for a number of people:

ipconfig /flushdns

ipconfig /release /all

ipconfig /renew

They reported no errors after that.

http://social.technet.microsoft.com/Forums/en/w7itproperf/thread/1ad12734-3cd2-4733-936d-9c4071ecdb63

Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact [email protected].


Friday, January 24, 2020 10:27 AM

Hi, This is a very old post but I am now getting same error - very odd.