Kernel error in admin events

[VXER]

Log Name: Microsoft-Windows-Kernel-EventTracing/Admin
Source: Microsoft-Windows-Kernel-EventTracing
Date: 5/27/2018 2:32:16 AM
Event ID: 3
Task Category: Session
Level: Error
Keywords: Session
User: SYSTEM
Computer: Aurora
Description:
Session "Circular Kernel Context Logger" stopped due to the following error: 0xC0000188
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Kernel-EventTracing" Guid="{B675EC37-BDB6-4648-BC92-F3FDC74D3CA2}" />
<EventID>3</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>2</Task>
<Opcode>14</Opcode>
<Keywords>0x8000000000000010</Keywords>
<TimeCreated SystemTime="2018-05-27T10:32:16.878903100Z" />
<EventRecordID>2</EventRecordID>
<Correlation />
<Execution ProcessID="4" ThreadID="268" />
<Channel>Microsoft-Windows-Kernel-EventTracing/Admin</Channel>
<Computer>Aurora</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="SessionName">Circular Kernel Context Logger</Data>
<Data Name="FileName">C:\Windows\system32\WDI\LogFiles\BootCKCL.etl</Data>
<Data Name="ErrorCode">3221225864</Data>
<Data Name="LoggingMode">128</Data>
</EventData>
</Event>

also a warning Event ID 4

Log Name: Microsoft-Windows-Kernel-EventTracing/Admin
Source: Microsoft-Windows-Kernel-EventTracing
Date: 5/27/2018 5:41:08 PM
Event ID: 4
Task Category: Logging
Level: Warning
Keywords: Session
User: SYSTEM
Computer: Aurora
Description:
The maximum file size for session "ReadyBoot" has been reached. As a result, events might be lost (not logged) to file "C:\Windows\Prefetch\ReadyBoot\ReadyBoot.etl". The maximum files size is currently set to 100663296 bytes.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Kernel-EventTracing" Guid="{B675EC37-BDB6-4648-BC92-F3FDC74D3CA2}" />
<EventID>4</EventID>
<Version>0</Version>
<Level>3</Level>
<Task>1</Task>
<Opcode>10</Opcode>
<Keywords>0x8000000000000010</Keywords>
<TimeCreated SystemTime="2018-05-28T01:41:08.334463300Z" />
<EventRecordID>7</EventRecordID>
<Correlation />
<Execution ProcessID="4" ThreadID="244" />
<Channel>Microsoft-Windows-Kernel-EventTracing/Admin</Channel>
<Computer>Aurora</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="SessionName">ReadyBoot</Data>
<Data Name="FileName">C:\Windows\Prefetch\ReadyBoot\ReadyBoot.etl</Data>
<Data Name="ErrorCode">3221225864</Data>
<Data Name="LoggingMode">0</Data>
<Data Name="MaxFileSize">100663296</Data>
</EventData>
</Event>

 

[Paul Black]

Hi VXER,

On a quick Google search I found the below links (there are more) that might be helpful!

Disk Thrashing - Disable ReadyBoot

Readyboot and Superfetch

I hope this helps!