Event ID 3, Circular Kernel Context logger stopped

[Guest Pasquale Castelluccio]

This file, "C:\WINDOWS\system32\WDI\LogFiles\ShutdownCKCL.etl", is set by default to Max 20 MB and neither circular or append options are allowed. The file, for some reason, is extremely protected.

 

Now in my case the file grows very fast and fills the event log pretty much, consequently I need to set the file, at least to Max 40 MB or leave it to the original 20 MB and set it to circular.

 

 

There is someone who can solve this mystery.

 

 

 

The maximum file size for session "Circular Kernel Context Logger" has been reached. As a result, events might be lost (not logged) to file "C:\WINDOWS\system32\WDI\LogFiles\ShutdownCKCL.etl". The maximum files size is currently set to 20971520 bytes.

 

 

Source: Kernel-EventTracing. Event ID 4.

 

 

 

Session "Circular Kernel Context Logger" stopped due to the following error: 0xC0000188

 

 

 

Source: Kernel-EventTracing. Event ID 3.

 

 

 

The protection in the registry is also extremely tied the only one with write permission is Trustedinstaller. The owner is set to System but no write permission.

 

More...