Event ID 1 warning & Event ID 2 error

eddward said:

Well you can try to increase size of the file or disable logging for this.
Click Start - write perfmon - enter - on the left tree click on Data Collector Sets - Startup Event Trace Sessions - find DefenderApiLogger. Right click and properties. On the Stop Condition tab you have Maximum size, so you can increase it.
Or on the Trace Session tab you have checkbox Enabled to disable it.

Thanks! :) @eddward

Found a solution which doesn't require disabling logging.
● Start Perfmon → Data Collector Sets → Startup Event Trace Session → right click Defender API Logger → Properties
● In the Trace Session tab change Stream Mode to File and Real Time
● Select the File tab → under Log Mode tick Circular
Finally click ok.
This solved the issue for me.

PacTr said:

Found a solution which doesn't require disabling logging.
● Start Perfmon → Data Collector Sets → Startup Event Trace Session → right click Defender API Logger → Properties
● In the Trace Session tab change Stream Mode to File and Real Time
● Select the File tab → under Log Mode tick Circular
Finally click ok.
This solved the issue for me.

I'll try your solution :) Thanks!

PacTr said:

Found a solution which doesn't require disabling logging.
● Start Perfmon → Data Collector Sets → Startup Event Trace Session → right click Defender API Logger → Properties
● In the Trace Session tab change Stream Mode to File and Real Time
● Select the File tab → under Log Mode tick Circular
Finally click ok.
This solved the issue for me.

I reverted back to default settings a week ago and haven't gotten any ID 1 warnings.

p83 said:

I reverted back to default settings a week ago and haven't gotten any ID 1 warnings.

How did you reverted to default settings in perfmon? i dont find the option when i look at the properties of defenderapilogger

also did the solution by PacTr work?
thanks!

p83 said:

I'll try your solution :) Thanks!

Well...did it work or not?

This error just started for me, in 20H2. Well, I'm trying PacTr's suggestion five posts above. Shall try to remember to come back here to let you know. (If you don't hear from me, maybe it caused my PC to burn down the house.)