Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.


BootCKCL.etl file size & Session “Circular Kernel Context Logger” stopped

  • Please log in to reply
No replies to this topic

#1 jpmad4it


  • Members
  • 1 posts
  • Local time:12:54 PM

Posted 10 October 2013 - 03:42 PM

Hello everyone, this is my first post, and its about ERRORS  :scratchhead:


I have a few regular / re-occurring errors in my event viewer which seem to be linked to logging upon boot and shutdown. I am running Windows 8 x64 professional.


Event ID 4:

The maximum file size for session "Circular Kernel Context Logger" has been reached. As a result, events might be lost (not logged) to file "C:\WINDOWS\system32\WDI\LogFiles\BootCKCL.etl". The maximum files size is currently set to 104857600 bytes.


Event ID 3:

Session "Circular Kernel Context Logger" stopped due to the following error: 0xC0000188



I have tried renaming the BootCKCL.etl file and restarting, but a new one is created which is the same file size. The current file size is 102Mb. I have also edited the following which has made no difference and the error still appears:

"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\Circular Kernel Context Logger increasing the the value MaxFileSize to 200"


I also see this error a lot but I am unsure if it related:


Custom dynamic link libraries are being loaded for every application. The system administrator should review the list of libraries to ensure they are related to trusted applications. Please visithttp://support.microsoft.com/kb/197571 for more information.



The support article didnt really provide much help.


Is this a problem with booting / shutting down, or is it an issue with logging and the file sizes?


Does anyone have any ideas on how to fix this? I opened up the BootCKCL.etl file in Windows Performance Analyzer, and it gave me a warning:


Performance Analyzer noticed that 0 events and 13 buffers were lost in this trace.

This is usually created by insufficient bandwidth for ETW logging. Please try increasing the minimum and maximum number of buffers and / or the buffer size. Doubling these values would be a good first attempt. Please note, though, that this action increases the amount of memory reserved for ETW buffers, increasing memory pressure on your scenario. See "xperf -help start" for the associated command line operations.


Windows Performance analyzer might not be able to provide reliable data in this situation.


Would you like to continue analyzing this trace?



Also, when I try to open Performance monitor I get this error:


Unable to add these counters:

\Memory\Available MBytes

\Memory\% committed bytes in use

\Memory\cache faults/sec

\Physical Disk(*)\% idle time

\Physical Disk(*)\Avg. Disk Queue length

\Network interface(*)\bytes total/sec



Does anyone know how to rebuild performance counters in windows 8?


Are all these errors with logging linked?


I have a boot trace etl file and performance monitor logs if anyone needs to see them?


Any help on fixing any of these issues would be much appreciated.


BC AdBot (Login to Remove)


0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users