Windows 10: Event ID 3, Circular Kernel Context logger stopped

Hi all!

Just a quicky. Today out of the blue I got this error (see screenshot below). It means that the Circular Kernel Context logger stopped. Looking up the info, 0xC0000188 means the log file reached it max size (probably). After rebooting, the error wasn't there anymore. I am not an expert, but doesn't 'circular' mean it starts at the beginning again when the file is maxed out? Probably it did, but then it shouldn't stop in the first place. If anyone knows how such a circular process works, please tell me. Just curious For the rest I assume I can ignore such errors since they have no other influence then just being there...?





:)

 

Whea_Uncorrectable_Error Since recent update.

Ive been checking the event viewer since however it only displays that

"The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly." as critical as well as

"The computer has rebooted from a bugcheck. The bugcheck was: 0x00000124 (0x0000000000000000, 0xffffbf89e9b58028, 0x00000000be000000, 0x0000000000800400). A dump was saved in: C:\WINDOWS\MEMORY.DMP. Report Id: 428a7de5-48a9-47ee-83f2-f62d45e2f27b."

This is also in warning but I think it may be unrelated, posting in case

"The maximum file size for session "Circular Kernel Context Logger" has been reached. As a result, events might be lost (not logged) to file "C:\WINDOWS\system32\WDI\LogFiles\SecondaryLogonCKCL.etl". The maximum files size is currently set to 104857600 bytes."

 

Failed to uninstall miracast

Ahhh yes, hehe like I said I am not getting any younger and you are most probably correct about the nortons uninstaller..Thank you !! one mystery solved for me. I have also removed MBAM. It did seem to be conflicting with Defender even though I had pro and
latest version. So now it is all windows apps running and mostly all Microsoft drivers on my Dell laptop.

The clean install was done on my Acer laptop not the one I have been talking about here. That is another story though.. It is running well now (The Acer).

The error went away about miracast. Actually I had some stuff disabled in settings and decided to reenable (Bluetooth, wifi a few other things. etc}} and the error went away. So Miracast has been straightened out but I do still get an error about Defehder
APILogger. I tried increasing the file size through performance monitor but once it hit the file size I allotted the error started again. I also got the same error for the circular context autologger not running so I went in and increased the file size for
this too. Then I read somewhere on these forums or another that I should be increasing the buffer size instead of the log size .I am not having any problems with running of my laptop. It always boots into windows and also wakes from sleep perfectly but I hate
nagging problems in event viewer. Anyway if you have any ideas about performance monitor and the loggers that are throwing errors
please share. . I do believe I am going to wipe this laptop {Dell} out too and do a clean install on it also. It gets out of warrenty soon..

Interestingly this error started today after I uninstalled MBam

Here is error for Circular Kernel Context Logger

Log Name: Microsoft-Windows-Kernel-EventTracing/Admin

Source: Microsoft-Windows-Kernel-EventTracing

Date: 10/24/2017 8:25:39 PM

Event ID: 3

Task Category: Session

Level: Error

Keywords: Session

User: SYSTEM

Computer:

Description:

Session "Circular Kernel Context Logger" stopped due to the following error: 0xC0000188

Event Xml:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

<System>

<Provider Name="Microsoft-Windows-Kernel-EventTracing" Guid="{B675EC37-BDB6-4648-BC92-F3FDC74D3CA2}" />

<EventID>3</EventID>

<Version>1</Version>

<Level>2</Level>

<Task>2</Task>

<Opcode>14</Opcode>

<Keywords>0x8000000000000010</Keywords>

<TimeCreated SystemTime="2017-10-25T03:25:39.124335000Z" />

<EventRecordID>19</EventRecordID>

<Correlation />

<Execution ProcessID="4" ThreadID="5492" />

<Channel>Microsoft-Windows-Kernel-EventTracing/Admin</Channel>

<Computer>Hummy</Computer>

<Security UserID="S-1-5-18" />

</System>

<EventData>

<Data Name="SessionName">Circular Kernel Context Logger</Data>

<Data Name="FileName">C:\WINDOWS\system32\WDI\LogFiles\ShutdownCKCL.etl</Data>

<Data Name="ErrorCode">3221225864</Data>

<Data Name="LoggingMode">41943168</Data>

<Data Name="FailureReason">0</Data>

</EventData>

</Event>

Log Name: Microsoft-Windows-Kernel-EventTracing/Admin

Source: Microsoft-Windows-Kernel-EventTracing

Date: 10/24/2017 8:25:39 PM

Event ID: 4

Task Category: Logging

Level: Warning

Keywords: Session

User: SYSTEM

Computer: Hummy

Description:

The maximum file size for session "Circular Kernel Context Logger" has been reached. As a result, events might be lost (not logged) to file "C:\WINDOWS\system32\WDI\LogFiles\ShutdownCKCL.etl". The maximum files size is currently set to 20971520 bytes.

Event Xml:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

<System>

<Provider Name="Microsoft-Windows-Kernel-EventTracing" Guid="{B675EC37-BDB6-4648-BC92-F3FDC74D3CA2}" />

<EventID>4</EventID>

<Version>0</Version>

<Level>3</Level>

<Task>1</Task>

<Opcode>10</Opcode>

<Keywords>0x8000000000000010</Keywords>

<TimeCreated SystemTime="2017-10-25T03:25:39.124333600Z" />

<EventRecordID>18</EventRecordID>

<Correlation />

<Execution ProcessID="4" ThreadID="5492" />

<Channel>Microsoft-Windows-Kernel-EventTracing/Admin</Channel>

<Computer></Computer>

<Security UserID="S-1-5-18" />

</System>

<EventData>

<Data Name="SessionName">Circular Kernel Context Logger</Data>

<Data Name="FileName">C:\WINDOWS\system32\WDI\LogFiles\ShutdownCKCL.etl</Data>

<Data Name="ErrorCode">3221225864</Data>

<Data Name="LoggingMode">41943168</Data>

<Data Name="MaxFileSize">20971520</Data>

</EventData>

</Event>

And this one has been logging since windows fall creators update.

Log Name: Microsoft-Windows-Kernel-EventTracing/Admin

Source: Microsoft-Windows-Kernel-EventTracing

Date: 10/24/2017 1:08:59 PM

Event ID: 1

Task Category: Logging

Level: Warning

Keywords: Session

User: SYSTEM

Computer:

Description:

The backing-file for the real-time session "DefenderApiLogger" has reached its maximum size. As a result, new events will not be logged to this session until space becomes available. This error is often caused by starting a trace session in real-time mode without
having any real-time consumers.

Event Xml:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

<System>

<Provider Name="Microsoft-Windows-Kernel-EventTracing" Guid="{B675EC37-BDB6-4648-BC92-F3FDC74D3CA2}" />

<EventID>1</EventID>

<Version>0</Version>

<Level>3</Level>

<Task>1</Task>

<Opcode>10</Opcode>

<Keywords>0x8000000000000010</Keywords>

<TimeCreated SystemTime="2017-10-24T20:08:59.661063200Z" />

<EventRecordID>15</EventRecordID>

<Correlation />

<Execution ProcessID="4" ThreadID="112" />

<Channel>Microsoft-Windows-Kernel-EventTracing/Admin</Channel>

<Computer> </Computer>

<Security UserID="S-1-5-18" />

</System>

<EventData>

<Data Name="SessionName">DefenderApiLogger</Data>

<Data Name="ErrorCode">3221225864</Data>

<Data Name="LoggingMode">411042176</Data>

</EventData>

</Event>

 

Hello, go to administrative tools/computer management/performance/data collection sets/ event trace session, then mouse over "circular kernel context logger"and right click and select properties, under "trace session" then uncheck enabled







That will stop the error, not sure at this point what is causing it

As long as you are not getting blue screens you can ignore it