Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Question
Wednesday, August 14, 2019 5:17 AM
I started getting this error message Session "PerfDiag Logger" failed to start with the following error: 0xC0000035 Microsoft-Windows-Kernel-EventTracing ID 2 <Data Name="ErrorCode">3221225525</Data>
<Data Name="LoggingMode">8388736</Data>
This is basically since I tried using Windows Update Blocker 1.3 from the 8th of August.
I reverted all the task schedules back to default including the blocker tool but on Windows restart I get Session "PerfDiag Logger" failed to start with the following error: 0xC0000035. I have absolutely no idea what the hell is this! I did a half an hour Windows System Restore to the date before on 7th of August but this error returned back again despite successful restore.
I then re-updated Windows updates back to all the latest updates and still bloody persists. Happens almost absolutely every single time on PC restart aside from the VSS errors that others have also reported. On some rare occasions this PerfDiag error does not appear on PC restart.
Any clues would be welcome.
All replies (8)
Thursday, August 15, 2019 2:17 AM
Hi,
It indicates an OS component (Perfdiag) is modifying an ETW session that is for private use by the operating system. For various reasons it has to be done with a retry loop because of some async activity; anytime we retry before that async activity has completed we get an error.
It's not an actual, legitimate error and these log entries should be completely benign. We can safely ignore them.
Best regards,
Yilia
Please remember to mark the replies as answers if they help.
If you have feedback for TechNet Subscriber Support, contact [email protected].
Thursday, August 15, 2019 5:25 AM
Hi,
It indicates an OS component (Perfdiag) is modifying an ETW session that is for private use by the operating system. For various reasons it has to be done with a retry loop because of some async activity; anytime we retry before that async activity has completed we get an error.
It's not an actual, legitimate error and these log entries should be completely benign. We can safely ignore them.
Best regards,
Yilia
Please remember to mark the replies as answers if they help.
If you have feedback for TechNet Subscriber Support, contact [email protected].
Many thanks for your answer. But I don't remember having these errors in 1809 update. This is ever since 1903 and also accompanied by VSS errors.
Yesterday, on a period of days, I had no errors and VSS error, I thought it was fixed. Restarted PC 7 times and no errors appeared.
Today like magic the error is back and happens mostly following the restart of the PC. I want to know what this ETW session is and what is the purpose of PerfDiag? Even if it is benign, I would like to know whether my Update Blocker tool caused this problem or whether it really is normal..
I'm not even using Windows Update Blocker tool. However, before I began using it this problem wasn't occurring for over a month. It did happen when I tried disabling a task schedule relating to .NET framework and EDP but when I initially re-enabled them back the errors stopped.
The moment I started using Windows Update Blocker last week this Perf Diag error started. Now I don't know if this is simply a coincidence. But system restore to the day before I started a week ago didn't fix this. 8th of August I used Windows Update Blocker 1.3. I restored the PC on the 7th and am not using it.
Whether it is a coincidence or not, it would be useful to know the trigger of it. No errors are appearing in Windows Error Reporter though and SFC /Scannow is reporting no integrity violation...
Sunday, August 18, 2019 8:21 AM
Ok I have found out the reason for this error trigger to appear sometimes and not on all occasions. Normally this error occurs only on restart of the computer!
On the moment you restart the PC that is when the error gets logged in the Event Viewer. This happens randomly, sometimes it doesn't occur at all. The error gets triggered due to perhaps a timing issue, but I can't be certain what causes it to make it happen.
In order to fix this, you must open Regedit and search for this. Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-System\b675ec37-bdb6-4648-bc92-f3fdc74d3ca2}
Inside Enabled and EnableProperty change the value to a 0 from 1 and now this error will no longer appear in the Event Viewer during PC restarts/shut down.
Here I found out from another users advice. windows 7 - Event Viewer: Event ID 2 'Session "Circular Kernel Context Logger" failed to start with the following error: 0xC0000035' - Super User
To Open Control Panel -> System -> Administrative Tools -> Performance Monitor. Under Data Collector Sets -> Event Trace Sessions, verify that the Context Logger is running. I have no problem with the Context Logger this always runs.
However, the PerfDiag Logger session disappears after a few minutes on PC boot. It does not run at all times, I have no idea whether this behaviour is normal. Maybe others can confirm if this behaviour is normal for it to stop running after a while.
All I know is that this error gets logged in event viewer on PC restart/shut down but it doesn't happen absolutely every single time. Sometimes it doesn't run on PC launch and other times it would run for a few minutes and then disappear.
For now the best thing to do is change the Enabled and EnableProperty to a 0 so this random error will not get logged in the Event Viewer.
Sunday, August 18, 2019 9:00 AM
Hello BLaZiNgSPEED89,
This extract from a Microsoft KB article (https://support.microsoft.com/en-us/help/4022522/dcom-event-id-10016-is-logged-in-windows-10-windows-server) is about a different event but parts of it (which I have highlighted) are potentially relevant in this case:
Cause
These 10016 events are recorded when Microsoft components tries to access DCOM components without the required permissions. In this case, this is expected and by design.
A coding pattern has been implemented where the code first tries to access the DCOM components with one set of parameters. If the first attempt is unsuccessful, it tries again with another set of parameters. The reason why it does not skip the first attempt is because there are scenarios where it can succeed. In those scenarios, that is preferable.
Workaround
These events can be safely ignored because they do not adversely affect functionality and are by design. This is the recommend action for these events.
The "PerfDiag Logger" logs events that can be used for performance analysis/evaluation, including startup and shutdown performance. The error 0xC0000035 is STATUS_OBJECT_NAME_COLLISION and in this context that probably just implies that the logger is already running. I don't know why this happens but it seems harmless - I think that Yilia's advice was good.
The thing that prompted me to reply was your suggested workaround. By disabling {b675ec37-bdb6-4648-bc92-f3fdc74d3ca2} (Microsoft-Windows-Kernel-EventTracing) you are not disabling the "erroneous" behaviour (that is probably still occurring) but you are just disabling the event provider that logs that type of error.
If you are determined to be aware of any possible hint of a problem on your system and respond to it, it might be better to leave Microsoft-Windows-Kernel-EventTracing enabled (to see other, genuine, problems) and just mentally note that "PerfDiag Logger" errors are probably harmless.
Gary
Sunday, August 18, 2019 10:47 AM
Many thanks for your response Gary.
Yes, I'm aware that the 10016 DCOM error from the ten forums, this is safe to ignore and these were changed to warnings in recent 1903 update. At least I know these are harmless.
The PerfDiag Logger failed to start is a new error message for me that only began 1 week after I started using Windows Update Blocker 1.3. Now I don't know if this is simply a coincidence or not. The thing is I never witnessed this particular error happening before for a whole month since my fresh Windows 10 1903 installation.
When I undone the changes via the Windows Update Blocker tool this PerfDiag Logger continued to log these error messages in event viewer during PC restarts and did not stop even after system restore prior to using it. Prior to that I use to do regular restarts of the computer and kept a good eye on the event viewer and this error message did not appear at that time once in the entire month of July, until last week!
Also I don't understand why after a restart of the PC the PerfDiag Logger is only running for a few minutes after PC starts up and then it stops after 5-10 minutes and eventually disappears from the Performance Monitor Events Trace Sessions. I only learnt about this yesterday and I'm not aware if this is normal.
I understand that disabling {b675ec37-bdb6-4648-bc92-f3fdc74d3ca2} (Microsoft-Windows-Kernel-EventTracing) does not disable the erroneous behaviour. But at least this will mean that the Event Viewer won't be flooded with all these error messages from the same event. I don't get any other error messages and SFC /Scannow reports no integrity violation.
I'm not noticing any other negative computer symptoms and if this PerfDiag Logger is simply a benign error then I don't have anything to worry, but I was just curious what triggered this to start only last 1 week and prior to that I never noticed it happen.
Tuesday, August 20, 2019 8:44 AM
Hi,
Performance log: You can use this log to view how Application Gateway instances are performing. This log captures performance information for each instance, including total requests served, throughput in bytes, total requests served, failed request count, and healthy and unhealthy back-end instance count. A performance log is collected every 60 seconds.
Here is a document about ETW Tracing for your referenceļ¼
/en-us/dotnet/framework/wcf/samples/etw-tracing
Please remember to mark the replies as answers if they help.
If you have feedback for TechNet Subscriber Support, contact [email protected].
Sunday, March 22, 2020 2:52 PM
For my Acer Predator G9-593-73N6 Laptop, the Registry change above fixed my issue; Thanks.
Friday, April 17, 2020 10:03 PM | 1 vote
Hi
I have the same problem and I think Microsoft should fix it because it affects performance due to repeated recording of this error in the event viewer