"Circular Kernel Context Logger" stopped due to the following error

Hi.
Ever since the last Windows 10 major update, I get this error. It refers to the BootCKCL.etl file.

Code:

Event 3, Kernel Event-Tracing - Session "Circular Kernel Context Logger" stopped due to the following error: 0xC0000188

I have done Inplace Upgrade and also fresh install and sfc /scannow.
Nothing solved this issue. It keeps reappearing.
In Performance Monitor > Startup Event Trace Sessions> I couldn't find what is controlling the BookCKCL.ETL file, therefore, I couldn't set a file size limit and make sure it's circular.
When I delete this file, it gets created after every reboot and then gets to 100MB in size and then Event Viewer will complain about Event 3.

Note: Some may recommend changing something with ReadyBoot.
ReadyBoot is disabled. I'm using SSD and with all Win10 installations, I've yet to see ReadyBoot enabled at all.

Either way, ReadyBoot doesn't seem to control the BootCKCL.etl file. It controls ReadyBoot.etl file, so I fail to see how increasing the file size limit will work in this case.

Also, this doesn't seem to really be a solution, since this is CIRCULAR logging, meaning once the file limit has been reached, the re-write/re-create the file from the beginning.

It seems that the root cause of this issue is something else. So file size limit won't work here and is not the real solution. The question is "Why doesn't it circulate the log?" even if it was 2MB, it should circulate.

Moreover, ReadyBoot, which is DISABLED by default, is set to 40MB and the log mode is Circular, yet as I have stated previously, my BootCKCL.etl file is reaching 100MB, which clearly means that something else controls the file size and NOT ReadyBoot.


I wonder if someone else experiences this issue and if anyone has an idea if this is solvable or not and what could control the file size.


Is this a known bug of Windows 10 latest update?
What is controlling this file and it's size?

dalchina said:

Perhaps:
Fix: Session Stopped Due to the Following Error 0xc0000188 - Appuals.com

may help.

Hi,
I've gone through this before. It doesn't fix anything.
The article refers to the exact things which I stated to be inaccurate.
Example: Increase ReadyBoot file limit. This doesn't make any sense since ReadyBoot is disabled on Win10 for people with SSD.
Additionally, Circular is a keyword, meaning that the file shouldn't reach a limit and just stop, it should write from the start, which seems to be the issue.

gil said:

Hi.
Ever since the last Windows 10 major update, I get this error. It refers to the BootCKCL.etl file.

Code:

Event 3, Kernel Event-Tracing - Session "Circular Kernel Context Logger" stopped due to the following error: 0xC0000188

Late to the party but maybe someone will find this useful

@gil
You can see which exact log file causes issue in warning corresponding to the error (ie, warning from same timestamp in event log). I assume it is same one that i had problem with recently - shutdownCKCL.etl. If yes, then it is located in Data Collector Sets > Performance Monitor > Event Trace Sessions under the name Circular Kernel Context Logger (yes, same name as the one in Startup Event Trace Sessions, figures). The difference is this one doesn't seem to by circular by default and on my system it was set to max at 20MB. You will need to stop the log to change the value.

Hope this helps

I am unable to change any settings in the Circular Kernel Context Logger, even though I stopped the session.

gil said:

Hi.
Ever since the last Windows 10 major update, I get this error. It refers to the BootCKCL.etl file.

Code:

Event 3, Kernel Event-Tracing - Session "Circular Kernel Context Logger" stopped due to the following error: 0xC0000188

I have done Inplace Upgrade and also fresh install and sfc /scannow.
Nothing solved this issue. It keeps reappearing.
In Performance Monitor > Startup Event Trace Sessions> I couldn't find what is controlling the BookCKCL.ETL file, therefore, I couldn't set a file size limit and make sure it's circular.
When I delete this file, it gets created after every reboot and then gets to 100MB in size and then Event Viewer will complain about Event 3.

Note: Some may recommend changing something with ReadyBoot.
ReadyBoot is disabled. I'm using SSD and with all Win10 installations, I've yet to see ReadyBoot enabled at all.

Either way, ReadyBoot doesn't seem to control the BootCKCL.etl file. It controls ReadyBoot.etl file, so I fail to see how increasing the file size limit will work in this case.

Also, this doesn't seem to really be a solution, since this is CIRCULAR logging, meaning once the file limit has been reached, the re-write/re-create the file from the beginning.

It seems that the root cause of this issue is something else. So file size limit won't work here and is not the real solution. The question is "Why doesn't it circulate the log?" even if it was 2MB, it should circulate.

Moreover, ReadyBoot, which is DISABLED by default, is set to 40MB and the log mode is Circular, yet as I have stated previously, my BootCKCL.etl file is reaching 100MB, which clearly means that something else controls the file size and NOT ReadyBoot.


I wonder if someone else experiences this issue and if anyone has an idea if this is solvable or not and what could control the file size.


Is this a known bug of Windows 10 latest update?
What is controlling this file and it's size?

I have tried for days to figure out how to increase the size of the BootCKCL.etl from 100MB to anything higher without success. In fact I was having problems even figuring out how to turn off the damn Kernel-EvenTracing log through the 'Performance' section of Computer Management. I failed at that, too. Finally, I found a way, through the registry to stop the damn thing so I don't get these errors anymore:

Go to this key:
Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Kernel-EventTracing/Admin

And set enabled to 0, obviously.

No more error. I would have preferred to simply increase the size of the BootCKCL.etl file but Microsoft has seemingly made it impossible to do. I hope this helps some poor soul out there.