NT Kernal Logger errors in Event Log

I'm getting the following error events when I boot my PC.

I'm using a Windows 10.0.10586, it was a fresh install on a new SSD on a Factory built PC that originally had Windows 7 on it. The fresh install is about 5 months old.

Session "NT Kernel Logger" stopped due to the following error: 0xC0000188

and

The maximum file size for session "NT Kernel Logger" has been reached. As a result, events might be lost (not logged) to file "C:\ProgramData\Intel\SUR\WILLAMETTE\IntelData\temp\2016_07_17__16_24_06_boot.etl". The maximum files size is currently set to 104857600 bytes.

Any ideas?

I've tweaked some of the logging on request of other people on this forum due to another issue that I'm having and may simply have set something incorrectly. As these messages only started appearing recently.

I continue to get error messages like this on my Win 7 Pro 64-bit. Any ideas?

glnz said:

I continue to get error messages like this on my Win 7 Pro 64-bit. Any ideas?

I posted the exact same error on multiple forums, and spent about 6 months trying to fix it.

In the end the problem was that one of my RAM sticks was faulty.

Absolutely NONE of the software diagnostics packages that I ran found the fault, not a single one of them. They all said that my RAM was perfectly good. It was only when I finally gave in and replaced both sticks that I found the error was indeed a problems with my RAM.

My advice to you is that you should take all of your RAM out, and then put a single stick back. If the problem happens again, swap the stick for another stick, and keep going until you've tried every single stick.

My problem only happened when I had both sticks of RAM in the machine. On their own either stick was perfect, together they caused this error. Which made it even harder to find that the cause of the problem was RAM.

I spent ages thinking that it was driver related or memory management related, but it was the hardware in the end.

Perfect - thanks, but that really is amazing!! RAM ??

Tell me, do you still have a folder and file like your
"C:\ProgramData\Intel\SUR\WILLAMETTE\IntelData\temp\2016_07_17__16_24_06_boot.etl" ?

Following an Intel thread about this Kernel issue, before posting here yesterday, I uninstalled my Intel Driver Update Utility and manually deleted the "SUR" folder, but the "SUR" folder recreated itself on the next boot, with only the sub-folder QUEENCREEK, not WILLAMETTE, but then continuing down to that one boot.etl file.

Your RAM solution is unexpected, and I don't understand how it helps. Did you replace your sticks?

glnz said:

Perfect - thanks, but that really is amazing!! RAM ??

Tell me, do you still have a folder and file like your
"C:\ProgramData\Intel\SUR\WILLAMETTE\IntelData\temp\2016_07_17__16_24_06_boot.etl" ?

Following an Intel thread about this Kernel issue, before posting here yesterday, I uninstalled my Intel Driver Update Utility and manually deleted the "SUR" folder, but the "SUR" folder recreated itself on the next boot, with only the sub-folder QUEENCREEK, not WILLAMETTE, but then continuing down to that one boot.etl file.

Your RAM solution is unexpected, and I don't understand how it helps. Did you replace your sticks?

I still have the folder, but it hasn't been changed or updated for a long time.

My problem got worse and I started getting a BSOD on clean boot (Always clean, never dirty) with the name MEMORY_MANAGEMENT, or IRQL_NOT_LESS_THAN_OR_EQUAL, and a couple of others.

In then end I got fed up and replaced both of my RAM sticks. This solved the problem.

If you have two RAM sticks and you remove one and the problems goes away, then it's likely the same problem that I had. If the problem remains then you probably have a different problem and I don't have a solution for that.

This is the original thread that I opened Memory_Management BSOD on Clean boot, VERY specific circumstances - - Windows 10 Forums

It got off topic and became far too long to manage so I was forced to abandon it as I was just getting the same responses over and over again.

Perfect -- Do you see in your services.msc anything running that relates to this Intel Energy Saver Service?
It might appear in your services list as ESRV_SVC_QUEENCREEK [or in your case WILLAMETTE]
Thanks, and thanks also for the other topic.