Session "PerfDiag Logger" failed to start error: 0xC0000035 Event ID 2

I started getting this error message Session "PerfDiag Logger" failed to start with the following error: 0xC0000035 Microsoft-Windows-Kernel-EventTracing ID 2 <Data Name="ErrorCode">3221225525</Data>
<Data Name="LoggingMode">8388736</Data>

I first noticed this in the 19th of July and then again yesterday and once again today.

I think this started happening after installing Microsoft Visual C++ with the FIFA 18 Demo on the 18th July and the the following day this error started emerging.

I don't know if this is a coincidence, but over a month ago I had the same problem when I upgraded to 1903 from 1809.

I did a fresh clean install of Windows 10 1903 less than a month ago and I didn't have this error message until now again!

Can someone tell me what is triggering this error message to occur in the Event Log?

I fixed this problem by re-enabling some Task Schedulers that I had previously disabled. That got rid off this error message.

I turned back on enabled EDP Scheduled Tasks using CCleaner and then .NET FRAMEWORK. Apparently one of these scheduled tasks were causing this Perf Diag Logger error.

Now I have no longer seen this error message in the Event Log Viewer pop-up for a week since.

Ok, so this issue is back.

SessionName

PerfDiag Logger

FileName

ErrorCode

3221225525

LoggingMode

8388736

I thought the problem was fixed and it has been. Until I actually tried to use Windows Update Blocker 1.3 from the 8th of August.

I reverted all the task schedules back to default including the blocker tool but on Windows restart I get Session "PerfDiag Logger" failed to start with the following error: 0xC0000035. I have absolutely no idea what the hell is this! I did a half an hour Windows System Restore to the date before on 7th of August but this error returned back again despite successful restore.

I then re-updated Windows updates back to all the latest updates and still bloody persists. Happens almost absolutely every single time on PC restart aside from the VSS errors that others have also reported. On some rare occasions this PerfDiag error does not appear on PC restart.

I have yet to identify what it is and nobody once again is able to tell me on these forums about this. I don't believe nobody gets this error in their event viewer, impossible to believe.

Any clues would be welcome.

You're not alone. I too have searched for an answer to this error, including increasing the size of the log. I am following this thread to see if others have found a solution.

Not Alone same issue, then followed by
event id 3 Session "PerfDiag Logger" stopped due to the following error: 0xC0000188
and
event id 4 The maximum file size for session "PerfDiag Logger" has been reached. As a result, events might be lost (not logged) to file "C:\WINDOWS\system32\WDI\LogFiles\ShutdownPerfDiagLogger.etl". The maximum files size is currently set to 26214400 bytes.
I was able to increase the bytes. But still get event id 2, 3, 4, I guess they are all related

Needless to say DISM tool clean bill of health and sfc scannow no errors

Holding my breath for solution DisGruntled user

I received a response on the MS Technet forums. https://social.technet.microsoft.com...10itprogeneral

Hi,It indicates an OS component (Perfdiag) is modifying an ETW session that is for private use by the operating system. For various reasons it has to be done with a retry loop because of some async activity; anytime we retry before that async activity has completed we get an error.
It's not an actual, legitimate error and these log entries should be completely benign. We can safely ignore them.
Best regards,
Yilia

I don't remember having these errors in 1809 update. This is ever since 1903 and also accompanied by VSS errors. Take a look at my screenshot.
Yesterday, on a period of days, I had no errors and VSS error, I thought it was fixed. Restarted PC 7 times and no errors appeared.

Today like magic the error is back and happens mostly following the restart of the PC. The response is very vague as it doesn't answer any clues on what this is, even if it is benign.

I'm not even using Windows Update Blocker tool. However, before I began using it this problem wasn't occurring. It did happen when I tried disabling a task schedule relating to .NET framework and EDP but when I initially re-enabled them back the errors stopped.

The moment I started using Windows Update Blocker this Perf Diag error started. Now I don't know if this is simply a coincidence. But system restore to the day before I started a week ago didn't fix this. 8th of August I used Windows Update Blocker 1.3. I restored the PC on the 7th and am not using it.

Whether it is a coincidence or not, it would be useful to know the trigger of it. No errors are appearing in Windows Error Reporter though and SFC /Scannow is reporting no integrity violation...

Ok I have found out the reason for this error trigger to appear sometimes and not on all occasions. Normally this error occurs only on restart of the computer!

On the moment you restart the PC that is when the error gets logged in the Event Viewer. This happens randomly, sometimes it doesn't occur at all. The error gets triggered due to perhaps a timing issue, but I can't be certain what causes it to make it happen.

In order to fix this, you must open Regedit and search for this. Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-System\{b675ec37-bdb6-4648-bc92-f3fdc74d3ca2}

Inside Enabled and EnableProperty change the value to a 0 from 1 and now this error will no longer appear in the Event Viewer during PC restarts/shut down.
Here I found out from another users advice. windows 7 - Event Viewer: Event ID 2 &#39;Session "Circular Kernel Context Logger" failed to start with the following error: 0xC0000035&#39; - Super User
To Open Control Panel -> System -> Administrative Tools -> Performance Monitor. Under Data Collector Sets -> Event Trace Sessions, verify that the Context Logger is running. I have no problem with the Context Logger this always runs.

However, the PerfDiag Logger session disappears after a few minutes on PC boot. It does not run at all times, I have no idea whether this behaviour is normal. Maybe others can confirm if this behaviour is normal for it to stop running after a while.

All I know is that this error gets logged in event viewer on PC restart/shut down but it doesn't happen absolutely every single time. Sometimes it doesn't run on PC launch and other times it would run for a few minutes and then disappear.

For now the best thing to do is change the Enabled and EnableProperty to a 0 so this random error will not get logged in the Event Viewer.

I've discovered how to stop this bad behavior on my computer.

After you have booted the system, hit the Windows key and type "Performance Monitor".
Click "Open" to start the Performance Monitor app.
On the right hand side of the Performance Monitor, click the "Data Collector Sets" folder and double click on the "Event Trace Sessions" folder.
Look in this list for "Perfdiag Logger" and if it isn't listed for whatever some reason close the Performance Monitor, REBOOT the computer and repeat the previous steps. Hopefully it will show in the list.

Once it shows in the list check to see if it's status is "Stopped" or "Running".

If it's running right click it and choose stop. Once it's stopped right click and choose "Properties".

Click the "Stop Condition" tab.
In the "Limits" section tick the checkbox for "Maximum Size" and enter at least 64 but no more than 200 MB. If you can spare the disk space choose 200. If it's greyed out go to the next step.

Now navigate to the directory where your logfile is. You can see this by clicking the "Directory" tab, but it's probably "C:\WINDOWS\system32\WDI\LogFiles"

Find "ShutdownPerfDiagLogger.etl" and rename it to "ShutdownPerfDiagLogger.old"

Reboot. Now go back to the directory and name it back to ShutdownPerfDiagLogger.etl.

Done. The error should not appear on the next boot or thereafter. The log should now write correctly.

I think this is maybe caused by a file permissions issue or corrupt file, or perhaps something to do with the file naming convention.

I don't think there is a cure to this problem!!! I have tried this method.

It is only coincidental that you aren't seeing the error. You haven't given yourself enough days to test this. Just one day won't help you verify.

Like I said the error is completely random. Several restarts may not show the error at all and it might give you the impression that the problem went away. But the error will eventually show up again!

So for example when I try to stop the condition and then rename it to 64 MB or 200 MB limit. The PerfDiag logger will not save the Maximum Size to 64 or 200 MB, the option will remain greyed out!

Also renaming ShutdownPerfDiagLogger.old and then restarting the computer recreates ShutdownPerfDiagLogger.etl If you then try to rename the ShutdownPerfDiagLogger.old back to etl Windows will save that ShutdownPerfDiagLogger.etl already exists and would try and store a second copy with a number (2) in brackets.

You have to then delete the old one. I have tried both methods and it doesn't solve the issue. This is completely random error. Not to mention if you restart the computer and you notice C:\Windows\System32\WDI\LogFiles that the ShutdownPerfDiagLogger.etl file is not modified then it means the error will show up. But if in some random restarts it has been modified to the current time of the restart then the error won't show up.

The problem is that this is one of those timing errors that will randomly come and won't come. For now my best method is really to open regedit and go to this Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-System\{b675ec37-bdb6-4648-bc92-f3fdc74d3ca2} rename Enabled and EnableProperty change the value to a 0 from 1 this is the only way to make sure the error doesn't reflect.

I know it doesn't get rid of the erroneous behaviour. But it is better for this damn error to at least not flood the event log viewer.

Also after 10 minutes or so The PerfDiag logger will completely disappear from the Performance Monitor "Event Trace Sessions" folder list. Now I don't know if this behaviour is normal. I have no other Windows 10 machine to test this. Maybe you guys can tell if this is meant to disappear after some minutes.

Maybe you're right, and maybe not. I'll keep an eye on the two computers I've tested this out on. So far.. so good.

I know this logger is fussy. Sometimes it shows up in the Performance Monitor and other times it's absent. The options are also greyed out sometimes and not others. You just have to keep trying.

If it's greyed out in the window you can modify the registry to change the Maximum File Size.

Run 'Regedit'
Navigate to:
Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Diagnostics\Performance\ShutdownCKCLSet tings

In the DWORD Key "MaxFileSize" set it to decimal "128" or some value around that.

Save and reboot.