detection.wiki

Microsoft-Windows-Kernel-EventTracing

44 events across 3 channels

Event IDTitleChannel
0Session "SessionName" failed to write to log file "FileName" with the following …Admin
1The backing-file for the real-time session "SessionName" has reached its maximum …Admin
2Session "SessionName" failed to start with the following error: ErrorCode.Admin
3Session "SessionName" stopped due to the following error: ErrorCode.Admin
4The maximum file size for session "SessionName" has been reached.Admin
5An error was encountered while tracing session "FileName" was switching to the …Admin
8Provider ProviderName was registered with Event Tracing for Windows.Analytic
9Provider ProviderName was unregistered from Event Tracing for Windows.Analytic
10Session "SessionName" was started.Analytic
11Session "SessionName" was stopped.Analytic
12The configuration of session "SessionName" has been modified.Analytic
13The events from session "SessionName" have been flushed.Analytic
14Provider ProviderName has been enabled to session "SessionName".Analytic
15Provider ProviderName is no longer enabled to session "SessionName".Analytic
17The security descriptor for session "SessionName" has been updated.Analytic
18Stack correlation event.Operational
19Operational
20Operational
21Operational
22Operational
23Error saving soft restart persisted log "FileName" Error: Status.Admin
24Operational
25Operational
26Operational
27Operational
28Error setting traits on Provider ProviderGuid.Admin
29A registration for Provider ProviderGuid has joined Provider Group …Analytic
30Provider ProviderGuid from process ProcessId does not have permission to write …Analytic
31Operational
32Failed to read debug info for WPP provider ProviderGuid from process ProcessId …Admin
33Operational
34Operational
35Analytic
40The enable state for Provider ProviderName is about to change on session …Analytic
41Provider ProviderName is about to be disabled from session "SessionName".Analytic
42Capture state requested for provider GUID on session "LoggerId".Analytic
43Session "SessionName" could not be started because LOGGER_FLAG_LARGE_MDL_PAGES …Analytic
44Session "SessionName" could not be started because because the maximum …Analytic
45Session "SessionName" could not be started because because the maximum …Analytic
46Session "SessionName" could not be started because the process failed its access …Analytic
47Session "SessionName" could not be started because the Memory Partition Handle …Analytic
48Session "SessionName" failed to create file FileName with error ErrorCode.Analytic
49Session "SessionName" could not be started because the process lacks the …Analytic
50Group Mask could not be updated for Session "SessionName", because the requested …Analytic

Event ID 0 — Session "SessionName" failed to write to log file "FileName" with the following error: ErrorCode.

Provider
Microsoft-Windows-Kernel-EventTracing
Channel
Admin
Task
Logging
Opcode
WriteBuffer

Description

Session "SessionName" failed to write to log file "FileName" with the following error: ErrorCode.

Message #

Session "%1" failed to write to log file "%2" with the following error: %3

Fields #

NameDescription
SessionName UnicodeString—
FileName UnicodeString—
ErrorCode UInt32—
LoggingMode UInt32—

Event ID 1 — The backing-file for the real-time session "SessionName" has reached its maximum size.

#
Provider
Microsoft-Windows-Kernel-EventTracing
Channel
Admin
Level
Warning
Task
Logging
Opcode
WriteBuffer

Message #

The backing-file for the real-time session "%1" has reached its maximum size. As a result, new events will not be logged to this session until space becomes available. This error is often caused by starting a trace session in real-time mode without having any real-time consumers.

Fields #

NameDescription
SessionName UnicodeString—
ErrorCode UInt32—
LoggingMode UInt32—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-EventTracing",
    "guid": "B675EC37-BDB6-4648-BC92-F3FDC74D3CA2",
    "event_source_name": "",
    "event_id": 1,
    "version": 0,
    "level": 3,
    "task": 1,
    "opcode": 10,
    "keywords": 9223372036854775824,
    "time_created": "2023-11-06T00:46:15.355055+00:00",
    "event_record_id": 16,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 5348
    },
    "channel": "Microsoft-Windows-Kernel-EventTracing/Admin",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "SessionName": "EventLog-Microsoft-Windows-Sysmon-Operational",
    "ErrorCode": 3221225864,
    "LoggingMode": 427819392
  },
  "message": ""
}

References #

Event ID 2 — Session "SessionName" failed to start with the following error: ErrorCode.

#
Provider
Microsoft-Windows-Kernel-EventTracing
Channel
Admin
Level
Error
Task
Session
Opcode
Start

Description

Session "SessionName" failed to start with the following error: ErrorCode.

Message #

Session "%1" failed to start with the following error: %3

Fields #

NameDescription
SessionName UnicodeString—
FileName UnicodeString—
ErrorCode UInt321" failed to start with the following error.
LoggingMode UInt32—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-EventTracing",
    "guid": "B675EC37-BDB6-4648-BC92-F3FDC74D3CA2",
    "event_source_name": "",
    "event_id": 2,
    "version": 0,
    "level": 2,
    "task": 2,
    "opcode": 12,
    "keywords": 9223372036854775824,
    "time_created": "2023-11-06T06:23:40.046454+00:00",
    "event_record_id": 4,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 236
    },
    "channel": "Microsoft-Windows-Kernel-EventTracing/Admin",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "SessionName": "PerfDiag Logger",
    "FileName": "",
    "ErrorCode": 3221225525,
    "LoggingMode": 8388736
  },
  "message": ""
}

References #

Event ID 3 — Session "SessionName" stopped due to the following error: ErrorCode.

Provider
Microsoft-Windows-Kernel-EventTracing
Channel
Admin
Level
Error
Task
Session
Opcode
Stop

Description

Session "SessionName" stopped due to the following error: ErrorCode.

Message #

Session "%1" stopped due to the following error: %3

Fields #

NameDescription
SessionName UnicodeString—
FileName UnicodeString—
ErrorCode UInt32—
LoggingMode UInt32—
FailureReason UInt32—
Known values
%%2304
An Error occured during Logon.
%%2305
The specified user account has expired.
%%2306
The NetLogon component is not active.
%%2307
Account locked out.
%%2308
The user has not been granted the requested logon type at this machine.
%%2309
The specified account's password has expired.
%%2310
Account currently disabled.
%%2311
Account logon time restriction violation.
%%2312
User not allowed to logon at this computer.
%%2313
Unknown user name or bad password.
%%2314
Domain sid inconsistent.
%%2315
Smartcard logon is required and was not used.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-EventTracing",
    "guid": "B675EC37-BDB6-4648-BC92-F3FDC74D3CA2",
    "event_source_name": "",
    "event_id": 3,
    "version": 1,
    "level": 2,
    "task": 2,
    "opcode": 14,
    "keywords": 9223372036854775824,
    "time_created": "2026-02-10T00:59:54.686730+00:00",
    "event_record_id": 4,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 280
    },
    "channel": "Microsoft-Windows-Kernel-EventTracing/Admin",
    "computer": "WIN11-22H2-X64",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "SessionName": "ReadyBoot",
    "FileName": "C:\\Windows\\Prefetch\\ReadyBoot\\ReadyBoot.etl",
    "ErrorCode": 3221225864,
    "LoggingMode": 276824064,
    "FailureReason": 0
  },
  "message": ""
}

Event ID 4 — The maximum file size for session "SessionName" has been reached.

Provider
Microsoft-Windows-Kernel-EventTracing
Channel
Admin
Level
Warning
Task
Logging
Opcode
WriteBuffer

Description

The maximum file size for session "SessionName" has been reached. As a result, events might be lost (not logged) to file "FileName". The maximum files size is currently set to MaxFileSize bytes.

Message #

The maximum file size for session "%1" has been reached. As a result, events might be lost (not logged) to file "%2". The maximum files size is currently set to %5 bytes.

Fields #

NameDescription
SessionName UnicodeString—
FileName UnicodeString—
ErrorCode UInt32—
LoggingMode UInt32—
MaxFileSize UInt64—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-EventTracing",
    "guid": "B675EC37-BDB6-4648-BC92-F3FDC74D3CA2",
    "event_source_name": "",
    "event_id": 4,
    "version": 0,
    "level": 3,
    "task": 1,
    "opcode": 10,
    "keywords": 9223372036854775824,
    "time_created": "2026-02-10T00:59:54.686726+00:00",
    "event_record_id": 3,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 280
    },
    "channel": "Microsoft-Windows-Kernel-EventTracing/Admin",
    "computer": "WIN11-22H2-X64",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "SessionName": "ReadyBoot",
    "FileName": "C:\\Windows\\Prefetch\\ReadyBoot\\ReadyBoot.etl",
    "ErrorCode": 3221225864,
    "LoggingMode": 276824064,
    "MaxFileSize": 20971520
  },
  "message": ""
}

Event ID 5 — An error was encountered while tracing session "FileName" was switching to the "SessionName" event log file.

Provider
Microsoft-Windows-Kernel-EventTracing
Channel
Admin
Task
Logging
Opcode
FileSwitch

Description

An error was encountered while tracing session "FileName" was switching to the "SessionName" event log file. Error: ErrorCode.

Message #

An error was encountered while tracing session "%2" was switching to the "%1" event log file. Error: %3

Fields #

NameDescription
SessionName UnicodeString—
FileName UnicodeString—
ErrorCode UInt32—
LoggingMode UInt32—

Event ID 8 — Provider ProviderName was registered with Event Tracing for Windows.

Provider
Microsoft-Windows-Kernel-EventTracing
Channel
Analytic
Task
Provider
Opcode
Register

Description

Provider ProviderName was registered with Event Tracing for Windows.

Message #

Provider %1 was registered with Event Tracing for Windows.

Fields #

NameDescription
ProviderName GUID—

Event ID 9 — Provider ProviderName was unregistered from Event Tracing for Windows.

Provider
Microsoft-Windows-Kernel-EventTracing
Channel
Analytic
Task
Provider
Opcode
Unregister

Description

Provider ProviderName was unregistered from Event Tracing for Windows.

Message #

Provider %1 was unregistered from Event Tracing for Windows.

Fields #

NameDescription
ProviderName GUID—

Event ID 10 — Session "SessionName" was started.

Provider
Microsoft-Windows-Kernel-EventTracing
Channel
Analytic
Task
Session
Opcode
Start

Description

Session "SessionName" was started.

Message #

Session "%3" was started.

Fields #

NameDescription
SessionGuid GUID—
LoggerMode UInt32—
SessionName UnicodeString—
LogFileName UnicodeString—
MinimumBuffers UInt32—
MaximumBuffers UInt32—
BufferSize UInt32—
PeakBuffersCount UInt32—
CurrentBuffersCount UInt32—
FlushThreshold UInt32—

Event ID 11 — Session "SessionName" was stopped.

Provider
Microsoft-Windows-Kernel-EventTracing
Channel
Analytic
Task
Session
Opcode
Stop

Description

Session "SessionName" was stopped.

Message #

Session "%3" was stopped.

Fields #

NameDescription
SessionGuid GUID—
LoggerMode UInt32—
SessionName UnicodeString—
LogFileName UnicodeString—
MinimumBuffers UInt32—
MaximumBuffers UInt32—
BufferSize UInt32—
PeakBuffersCount UInt32—
CurrentBuffersCount UInt32—
FlushThreshold UInt32—
EventsLost UInt32—
BuffersLost UInt32—
RealTimeBuffersLost UInt32—
LoggerId UInt32—

Event ID 12 — The configuration of session "SessionName" has been modified.

Provider
Microsoft-Windows-Kernel-EventTracing
Channel
Analytic
Task
Session
Opcode
Configure

Description

The configuration of session "SessionName" has been modified.

Message #

The configuration of session "%3" has been modified.

Fields #

NameDescription
SessionGuid GUID—
LoggerMode UInt32—
SessionName UnicodeString—
LogFileName UnicodeString—

Event ID 13 — The events from session "SessionName" have been flushed.

Provider
Microsoft-Windows-Kernel-EventTracing
Channel
Analytic
Task
Session
Opcode
Flush

Description

The events from session "SessionName" have been flushed.

Message #

The events from session "%3" have been flushed.

Fields #

NameDescription
SessionGuid GUID—
LoggerMode UInt32—
SessionName UnicodeString—
LogFileName UnicodeString—

Event ID 14 — Provider ProviderName has been enabled to session "SessionName".

Provider
Microsoft-Windows-Kernel-EventTracing
Channel
Analytic
Task
Provider
Opcode
Enable

Description

Provider ProviderName has been enabled to session "SessionName".

Message #

Provider %1 has been enabled to session "%2".

Fields #

NameDescription
ProviderName GUID—
SessionName UnicodeString—
MatchAnyKeyword UInt64—
MatchAllKeyword UInt64—
EnableProperty UInt32—
Level UInt8—

Event ID 15 — Provider ProviderName is no longer enabled to session "SessionName".

Provider
Microsoft-Windows-Kernel-EventTracing
Channel
Analytic
Task
Provider
Opcode
Disable

Description

Provider ProviderName is no longer enabled to session "SessionName".

Message #

Provider %1 is no longer enabled to session "%2".

Fields #

NameDescription
ProviderName GUID—
SessionName UnicodeString—

Event ID 17 — The security descriptor for session "SessionName" has been updated.

Provider
Microsoft-Windows-Kernel-EventTracing
Channel
Analytic
Task
Session
Opcode
Configure

Description

The security descriptor for session "SessionName" has been updated.

Message #

The security descriptor for session "%3" has been updated.

Fields #

NameDescription
SessionGuid GUID—
LoggerMode UInt32—
SessionName UnicodeString—
LogFileName UnicodeString—

Event ID 18 — Stack correlation event.

Provider
Microsoft-Windows-Kernel-EventTracing
Channel
Operational
Task
StackTrace
Opcode
UserModeStackTrace

Description

Stack correlation event. This event contains a call stack which is associated with a prior event which is correlated by the MatchId.

Message #

Stack correlation event. This event contains a call stack which is associated with a prior event which is correlated by the MatchId.

Event ID 19 —

Provider
Microsoft-Windows-Kernel-EventTracing
Channel
Operational
Task
LostEvent

Fields #

NameDescription
ProviderId GUID—
StatusCode UInt32—
EventId UInt16—
SessionName UnicodeString—

Event ID 20 —

Provider
Microsoft-Windows-Kernel-EventTracing
Channel
Operational
Task
Session

Fields #

NameDescription
SessionGuid GUID—
LoggerMode UInt32—
SessionName UnicodeString—
LogFileName UnicodeString—
MinimumBuffers UInt32—
MaximumBuffers UInt32—
BufferSize UInt32—
PeakBuffersCount UInt32—
CurrentBuffersCount UInt32—
FlushThreshold UInt32—
EventsLost UInt32—
BuffersLost UInt32—
RealTimeBuffersLost UInt32—
LoggerId UInt32—

Event ID 21 —

Provider
Microsoft-Windows-Kernel-EventTracing
Channel
Operational
Task
SavePersistedLogger
Opcode
Start_8_1

Event ID 22 —

Provider
Microsoft-Windows-Kernel-EventTracing
Channel
Operational
Task
SavePersistedLogger
Opcode
Stop_8_2

Fields #

NameDescription
FileName UnicodeString—
BufferSize UInt32—
BuffersPersisted UInt32—
BuffersWritten UInt32—
Status UInt32— NTSTATUS reference
BuffersLost UInt32—

Event ID 23 — Error saving soft restart persisted log "FileName" Error: Status.

Provider
Microsoft-Windows-Kernel-EventTracing
Channel
Admin
Task
SavePersistedLogger

Description

Error saving soft restart persisted log "FileName" Error: Status.

Message #

Error saving soft restart persisted log "%1" Error: %5

Fields #

NameDescription
FileName UnicodeString—
BufferSize UInt32—
BuffersPersisted UInt32—
BuffersWritten UInt32—
Status UInt32— NTSTATUS reference
BuffersLost UInt32—

Event ID 24 —

Provider
Microsoft-Windows-Kernel-EventTracing
Channel
Operational
Task
GUIDEntry

Fields #

NameDescription
GUID GUID—
FilterFlags UInt32—
LastEnableLoggerId UInt16—

Event ID 25 —

Provider
Microsoft-Windows-Kernel-EventTracing
Channel
Operational
Task
ProviderGroupEntry

Fields #

NameDescription
GUID GUID—
FilterFlags UInt32—
LastEnableLoggerId UInt16—

Event ID 26 —

Provider
Microsoft-Windows-Kernel-EventTracing
Channel
Operational
Task
EnableInfo

Fields #

NameDescription
GUID GUID—
Index UInt8—
LoggerId UInt16—
MatchAnyKeyword UInt64—
MatchAllKeyword UInt64—
Level UInt8—
EnableProperty UInt32—

Event ID 27 —

Provider
Microsoft-Windows-Kernel-EventTracing
Channel
Operational
Task
Provider

Fields #

NameDescription
ProviderGUID GUID—
GroupGUID GUID—
Flags UInt16—
EnableMask UInt8—
GroupEnableMask UInt8—
ProcessId UInt32—

Event ID 28 — Error setting traits on Provider ProviderGuid.

Provider
Microsoft-Windows-Kernel-EventTracing
Channel
Admin
Level
Error
Task
Provider
Opcode
SetProviderTraits

Description

Error setting traits on Provider ProviderGuid. Error: ErrorCode.

Message #

Error setting traits on Provider %1. Error: %2

Fields #

NameDescription
ProviderGuid GUID—
ErrorCode UInt32—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-EventTracing",
    "guid": "B675EC37-BDB6-4648-BC92-F3FDC74D3CA2",
    "event_source_name": "",
    "event_id": 28,
    "version": 0,
    "level": 2,
    "task": 3,
    "opcode": 25,
    "keywords": 9223372036854778400,
    "time_created": "2026-03-11T06:27:22.550118+00:00",
    "event_record_id": 54,
    "correlation": {},
    "execution": {
      "process_id": 740,
      "thread_id": 808
    },
    "channel": "Microsoft-Windows-Kernel-EventTracing/Admin",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "ProviderGuid": "77811378-E885-4AC2-A580-BC86E4F1BC93",
    "ErrorCode": 3221225477
  },
  "message": ""
}

Event ID 29 — A registration for Provider ProviderGuid has joined Provider Group ProviderGroupGuid.

Provider
Microsoft-Windows-Kernel-EventTracing
Channel
Analytic
Task
Provider
Opcode
JoinProviderGroup

Description

A registration for Provider ProviderGuid has joined Provider Group ProviderGroupGuid.

Message #

A registration for Provider %1 has joined Provider Group %2

Fields #

NameDescription
ProviderGuid GUID—
ProviderGroupGuid GUID—

Event ID 30 — Provider ProviderGuid from process ProcessId does not have permission to write events to session "SessionName".

Provider
Microsoft-Windows-Kernel-EventTracing
Channel
Analytic
Task
Provider

Description

Provider ProviderGuid from process ProcessId does not have permission to write events to session "SessionName". Error: Status.

Message #

Provider %1 from process %3 does not have permission to write events to session "%2". Error: %4

Fields #

NameDescription
ProviderGuid GUID—
SessionName UnicodeString—
ProcessId UInt32—
Status UInt32— NTSTATUS reference

Event ID 31 —

Provider
Microsoft-Windows-Kernel-EventTracing
Channel
Operational
Task
LostTraceLoggingEvent

Fields #

NameDescription
ProviderId GUID—
StatusCode UInt32—
EventName AnsiString—
SessionName UnicodeString—

Event ID 32 — Failed to read debug info for WPP provider ProviderGuid from process ProcessId for session "SessionName".

Provider
Microsoft-Windows-Kernel-EventTracing
Channel
Admin
Task
Provider

Message #

Failed to read debug info for WPP provider %1 from process %3 for session "%2". Error: %4. The image registering the provider may be malformed or may be an unsupported format (e.g. managed C++). ETW traces for this session will not include the image's debug information.

Fields #

NameDescription
ProviderGuid GUID—
SessionName UnicodeString—
ProcessId UInt32—
Status UInt32— NTSTATUS reference

Event ID 33 —

Provider
Microsoft-Windows-Kernel-EventTracing
Channel
Operational
Task
LostWPPEvent

Fields #

NameDescription
MessageGuid GUID—
MessageNumber UInt16—
StatusCode UInt32—
SessionName UnicodeString—

Event ID 34 —

Provider
Microsoft-Windows-Kernel-EventTracing
Channel
Operational
Task
LostSystemEvent

Fields #

NameDescription
HookId UInt16—
StatusCode UInt32—
SessionName UnicodeString—

Event ID 35 —

Provider
Microsoft-Windows-Kernel-EventTracing
Channel
Analytic
Task
Session

Fields #

NameDescription
LoggerSlotsUsed UInt64—

Event ID 40 — The enable state for Provider ProviderName is about to change on session "SessionName".

Provider
Microsoft-Windows-Kernel-EventTracing
Channel
Analytic
Task
Provider
Opcode
Enable

Description

The enable state for Provider ProviderName is about to change on session "SessionName".

Message #

The enable state for Provider %1 is about to change on session "%2".

Fields #

NameDescription
ProviderName GUID—
SessionName UnicodeString—
MatchAnyKeyword UInt64—
MatchAllKeyword UInt64—
EnableProperty UInt32—
Level UInt8—

Event ID 41 — Provider ProviderName is about to be disabled from session "SessionName".

Provider
Microsoft-Windows-Kernel-EventTracing
Channel
Analytic
Task
Provider
Opcode
Disable

Description

Provider ProviderName is about to be disabled from session "SessionName".

Message #

Provider %1 is about to be disabled from session "%2".

Fields #

NameDescription
ProviderName GUID—
SessionName UnicodeString—

Event ID 42 — Capture state requested for provider GUID on session "LoggerId".

Provider
Microsoft-Windows-Kernel-EventTracing
Channel
Analytic
Task
Provider
Opcode
CaptureState

Description

Capture state requested for provider GUID on session "LoggerId".

Message #

Capture state requested for provider %1 on session "%2".

Fields #

NameDescription
GUID GUID—
LoggerId UInt16—
MatchAnyKeyword UInt64—
MatchAllKeyword UInt64—
Level UInt8—
EnableProperty UInt32—

Event ID 43 — Session "SessionName" could not be started because LOGGER_FLAG_LARGE_MDL_PAGES is not supported.

Provider
Microsoft-Windows-Kernel-EventTracing
Channel
Analytic
Task
Session
Opcode
Start

Description

Session "SessionName" could not be started because LOGGER_FLAG_LARGE_MDL_PAGES is not supported.

Message #

Session "%3" could not be started because LOGGER_FLAG_LARGE_MDL_PAGES is not supported.

Fields #

NameDescription
SessionGuid GUID—
LoggerMode UInt32—
SessionName UnicodeString—
LogFileName UnicodeString—

Event ID 44 — Session "SessionName" could not be started because because the maximum MaximumAllowed logging sessions are already active on the system.

Provider
Microsoft-Windows-Kernel-EventTracing
Channel
Analytic
Task
Session
Opcode
Start

Description

Session "SessionName" could not be started because because the maximum MaximumAllowed logging sessions are already active on the system.

Message #

Session "%1" could not be started because because the maximum %2 logging sessions are already active on the system.

Fields #

NameDescription
SessionName UnicodeString—
MaximumAllowed UInt32—

Event ID 45 — Session "SessionName" could not be started because because the maximum MaximumAllowed EVENT_TRACE_SYSTEM_LOGGER_MODE logging sessions are already active on the system.

Provider
Microsoft-Windows-Kernel-EventTracing
Channel
Analytic
Task
Session
Opcode
Start

Description

Session "SessionName" could not be started because because the maximum MaximumAllowed EVENT_TRACE_SYSTEM_LOGGER_MODE logging sessions are already active on the system.

Message #

Session "%1" could not be started because because the maximum %2 EVENT_TRACE_SYSTEM_LOGGER_MODE logging sessions are already active on the system.

Fields #

NameDescription
SessionName UnicodeString—
MaximumAllowed UInt32—

Event ID 46 — Session "SessionName" could not be started because the process failed its access check to the SessionGuid.

Provider
Microsoft-Windows-Kernel-EventTracing
Channel
Analytic
Task
Session
Opcode
Start

Description

Session "SessionName" could not be started because the process failed its access check to the SessionGuid.

Message #

Session "%1" could not be started because the process failed its access check to the SessionGuid.

Fields #

NameDescription
SessionName UnicodeString—
SessionGuid GUID—
DesiredAccess UInt32— Process access rights reference

Event ID 47 — Session "SessionName" could not be started because the Memory Partition Handle MemoryPartitionHandle is invalid.

Provider
Microsoft-Windows-Kernel-EventTracing
Channel
Analytic
Task
Session
Opcode
Start

Description

Session "SessionName" could not be started because the Memory Partition Handle MemoryPartitionHandle is invalid.

Message #

Session "%1" could not be started because the Memory Partition Handle %2 is invalid.

Fields #

NameDescription
SessionName UnicodeString—
MemoryPartitionHandle Pointer—

Event ID 48 — Session "SessionName" failed to create file FileName with error ErrorCode.

Provider
Microsoft-Windows-Kernel-EventTracing
Channel
Analytic
Task
Session

Description

Session "SessionName" failed to create file FileName with error ErrorCode.

Message #

Session "%1" failed to create file %2 with error %3.

Fields #

NameDescription
SessionName UnicodeString—
FileName UnicodeString—
ErrorCode UInt32—
LoggingMode UInt32—

Event ID 49 — Session "SessionName" could not be started because the process lacks the profiling privilege.

Provider
Microsoft-Windows-Kernel-EventTracing
Channel
Analytic
Task
Session
Opcode
Start

Description

Session "SessionName" could not be started because the process lacks the profiling privilege.

Message #

Session "%1" could not be started because the process lacks the profiling privilege.

Fields #

NameDescription
SessionName UnicodeString—
FileName UnicodeString—
ErrorCode UInt32—
LoggingMode UInt32—

Event ID 50 — Group Mask could not be updated for Session "SessionName", because the requested Group Mask is not supported.

Provider
Microsoft-Windows-Kernel-EventTracing
Channel
Analytic
Task
Session
Opcode
Enable

Description

Group Mask could not be updated for Session "SessionName", because the requested Group Mask is not supported.

Message #

Group Mask could not be updated for Session "%1", because the requested Group Mask is not supported.

Fields #

NameDescription
SessionName UnicodeString—
RequestedGroupMask UInt32—
PermittedGroupMask UInt32—