Windows 7: Circular Kernel Context Logger trace - calling any trace experts.....

*sigh* I knew screwing around with this thing would break it.

I played with this predefined trace via perfmon.exe.

I ended up successfully getting it to output a dataset (etl) to my D drive. But, when I tried to create a tracerpt from it, I had no access to the etl file. After trying a few times, I believe I changed the SECURITY OWNER within the trace (via the GUI) from something else (not shown??) to Admin. Then the trace created a dataset on my D drive that I could access.

However, even though I have since reverted the predefined CKCL trace entry set to create an etl in C:\Perflogs\Admin, when it runs (it no longer runs on bootup but NO errors in event log), when I manually start it via the GUI or LOGMAN utility, it STILL points to a D drive directory the way I had it before. It's like somewhere in the world it has that directory path permanently etched in its mind. The trace GUI entry clearly shows it's pointing to C:\Perflogs\Admin.

1) it's no longer starting at boot time but with no event error ids. So, it's as if it's not even being started any more. Something to do with the security modification I made (that I can't remember exactly what it was)

2) it's still creating an etl dataset in the wrong place. EDIT: It seems if you do a LOGMAN START TRACE it creates the CKCL.etl dataset in whatever the working directory is. Starting this via the GUI has it on the C drive as defined on the GUI panels. Jeez.