Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a few regular / re-occurring errors in my event viewer which seem to be linked to logging upon boot and shutdown. I am running Windows 8 x64 professional.

Event ID 4:

The maximum file size for session "Circular Kernel Context Logger" has been reached. As a result, events might be lost (not logged) to file "C:\WINDOWS\system32\WDI\LogFiles\BootCKCL.etl". The maximum files size is currently set to 104857600 bytes.

Event ID 3:

Session "Circular Kernel Context Logger" stopped due to the following error: 0xC0000188

I have tried renaming the BootCKCL.etl file and restarting, but a new one is created which is the same file size. The current file size is 102Mb

I also see this error but I am unsure if it related:

Custom dynamic link libraries are being loaded for every application. The system administrator should review the list of libraries to ensure they are related to trusted applications. Please visit for more information.

The support article didnt really provide much help.

Is this a problem with booting / shutting down, or is it an issue with logging and the file sizes?

Does anyone have any ideas on how to fix this? I opened up the BootCKCL.etl file in Windows Performance Analyzer, and it gave me a warning:

Performance Analyzer noticed that 0 events and 13 buffers were lost in this trace.

This is usually created by insufficient bandwidth for ETW logging. Please try increasing the minimum and maximum number of buffers and / or the buffer size. Doubling these values would be a good first attempt. Please note, though, that this action increases the amount of memory reserved for ETW buffers, increasing memory pressure on your scenario. See "xperf -help start" for the associated command line operations.

Windows Performance analyzer might not be able to provide reliable data in this situation.

Would you like to continue analyzing this trace?

Also, when I try to open Performance monitor I get this error:

Unable to add these counters:

\Memory\Available MBytes

\Memory\% committed bytes in use

\Memory\cache faults/sec

\Physical Disk(*)\% idle time

\Physical Disk(*)\Avg. Disk Queue length

\Network interface(*)\bytes total/sec

Are all these errors with logging linked?

I have a boot trace etl file and performance monitor logs if anyone needs to see them?

Any help would be much appreciated.

share|improve this question

0xC0000188 means log is full:

C:\Users\André>err 0xC0000188
# for hex 0xc0000188 / decimal -1073741432
  STATUS_LOG_FILE_FULL                                           ntstatus.h
# Log file space is insufficient to support this operation.
# 1 matches found for "0xC0000188"

Open regedit, go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\Circular Kernel Context Logger and increase the the value MaxFileSize to 200.

share|improve this answer
hi thank you, I have carried out your suggestion but the error still persists :-( – Jonathan Oct 10 '13 at 19:18
can anyone else please help with these issues, they are driving me insane – Jonathan Oct 10 '13 at 20:44
can you make a normal boot trace? Maybe I can see issues and fixing them also fixes your issue. – magicandre1981 Oct 11 '13 at 4:09
is it just the *.etl file that you require? its 2Gb in size! If you can let me know I will upload it and send you the link. – Jonathan Oct 13 '13 at 14:28
compress the ETL as 7z and upload it to skydrive/dropbox/google drive and post a link here – magicandre1981 Oct 13 '13 at 17:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .