Kernel eventtracing windows 10 код события 2

Repeated Kernel-EventTracing Event ID 2 errors can be frustrating for any system administrator. Fortunately, with the right knowledge of ETW sessions, you can resolve 0xC0000035 conflicts quickly and restore your Windows environment’s stability.

TOC

Understanding the Kernel-EventTracing Event ID 2 Error

The Kernel-EventTracing Event ID 2 error often appears on Windows systems (including servers) when there’s a conflict in Event Tracing for Windows (ETW) sessions. The specific error code, 0xC0000035 (STATUS_OBJECT_NAME_COLLISION), commonly implies that a session with the same name already exists or was never completely cleaned up. As a result, Windows tries to start a session that collides with an existing one, which triggers repetitive warning or error messages in the Event Viewer.

ETW is a powerful feature used by Microsoft components, third-party applications, and system administrators for real-time event collection. It captures detailed performance data and logs, which are crucial for system audits, troubleshooting, and performance tuning. However, if sessions overlap, or if there’s a leftover session from a previous instance, the operating system flags this conflict with the Event ID 2 message.

What Is Event Tracing for Windows (ETW)?

ETW is a high-speed tracing facility built into Windows that helps developers and administrators diagnose problems by enabling diagnostic data collection. Key points include:

• Low overhead: ETW is designed to minimize performance impact.
• Real-time data capture: You can stream events directly to a logging session or store them in files.
• Dynamic session management: Administrators can start or stop sessions on demand.

While ETW is indispensable for detailed analysis, it can generate errors when multiple processes or services attempt to create sessions with identical names or if old sessions linger without being properly terminated.

Common Causes of STATUS_OBJECT_NAME_COLLISION (0xC0000035)

1. Duplicate Session Names: A session name is already in use by another active or orphaned ETW session.
2. Stuck Session Handles: Occasionally, a session is terminated abruptly, leaving behind handles or references that Windows still regards as active.
3. Driver Conflicts: Sensor drivers or other hardware drivers might start their own ETW sessions. If these drivers are outdated or incorrectly configured, conflicts can occur.
4. Policy or Scheduled Task Configurations: Group Policies or scheduled tasks could be configured to initiate ETW sessions using identical names.

Below is a quick reference table detailing common ETW collision scenarios and possible reasons:

Step-by-Step Troubleshooting

Effectively resolving Kernel-EventTracing Event ID 2 requires a methodical approach. Below are several key steps you should take to eliminate the root cause and restore normal system operation.

Check for Existing ETW Sessions

Since the conflict typically arises when a session name collides with an existing one, your first step is to verify if an identical ETW session is running.

Using logman to Identify and Stop Conflicting Sessions

1. Open a Command Prompt with administrative privileges.
2. Execute the following command to list all active sessions:

   logman query

1. Look for session names that may match or closely resemble the name indicated in the error, such as SensorFramework-{d61722cd-d3ce-0897-1694-d917cab88c2a}.
2. If you find a conflict, stop the session:

   logman stop "SessionName" -ets

1. Verify the session has been terminated by running logman query again.

This simple step often resolves the error immediately, especially if a second process or driver was inadvertently using the same session.

Manual Cleanup Strategies

• If logman fails to stop the session, you can try using Task Manager to kill any related processes.
• Additionally, ensure that the session name in question isn’t automatically restarted by any third-party utilities upon system reboot.

Restart the WMI Service

Windows Management Instrumentation (WMI) sometimes hangs onto session handles even after a process has ended. A simple restart of WMI can clear these ghost references.

1. Open Command Prompt as an administrator.
2. Stop WMI:

   net stop winmgmt

1. Start WMI:

   net start winmgmt

1. Check the Event Viewer again to see if Event ID 2 errors have ceased.

Clean Up Orphaned Sessions

In some cases, the name collision stems from orphaned sessions that persist in the Event Log. You can use wevtutil to clear them:

1. List all logs:

   wevtutil el

1. Identify any event log correlating with your error.
2. Clear the offending log if necessary:

   wevtutil cl "SessionName"

1. Double-check in Event Viewer to ensure the logs (and sessions) are properly removed.

Removing orphaned logs can be delicate if you rely on historical data. Be sure to back up crucial logs before purging them.

Advanced Solutions

If basic cleanup steps do not resolve the issue, consider these advanced methods.

Check and Update Drivers

Since the error message often references a sensor framework, it’s plausible a device driver is at fault:

1. Open Device Manager by typing devmgmt.msc in the Run dialog.
2. Locate any sensor-related or newly installed devices.
3. Right-click and select Update Driver.
4. If no updates are found, check the manufacturer’s website for the latest version.

Sensor drivers, such as those for accelerometers or gyroscopes on laptops and tablets, can initialize ETW sessions automatically. Outdated drivers can linger, holding open sessions that conflict with new instances.

Review Group Policy and Task Scheduler

• Group Policy (gpedit.msc): There may be policies that configure or enforce ETW sessions for audit or security logging. If these configurations use a session name matching a driver or default Windows session, you could have collisions.
• Task Scheduler (taskschd.msc): Some tasks might automatically start specific ETW sessions at boot or periodically. If these tasks share a session name, you’ll see repeated conflicts.

Where possible, rename or disable any tasks creating a session identical to one managed by another service. Be mindful that some tasks and policies might be critical for compliance or auditing; always confirm the implications before modifying or removing them.

Examine Event Viewer Logs

While the main error appears under Windows Logs or Applications and Services Logs > Microsoft > Windows > Kernel-EventTracing, related events can also appear in other logs. Here’s what to look for:

• Security or System logs: Check for any logs referencing session creation or conflict.
• Application logs: Certain software might have created a custom ETW session.
• SensorFramework sub-logs: If the error references SensorFramework-{d61722cd-d3ce-0897-1694-d917cab88c2a}, see if any sensor or IoT component logs additional details about the conflict.

Cross-referencing these logs helps pinpoint the root cause—especially if you see repeated attempts to initialize the same session name.

Extra Tips and Best Practices

Finally, here are several strategies to maintain a clean and conflict-free ETW environment:

1. Regular Log Audits

• Schedule periodic reviews of both standard and custom ETW sessions.
• Use logman query to quickly spot any unexpected sessions.

1. Driver Management and Documentation

• Keep an inventory of installed drivers and the versions currently running.
• Maintain updated documentation for sensor or specialized hardware drivers, noting any ETW sessions they start.

1. Proactive Troubleshooting

• Right after major Windows updates, verify that all ETW sessions are functioning properly. Sometimes system patches reset or modify certain logging configurations.
• If you have any custom scripts or third-party tools for monitoring, incorporate checks for session conflicts.

1. ETW Session Naming Conventions

• If you create custom ETW sessions (for instance, in a development or QA environment), use unique, clearly identifiable session names. Avoid using default or ambiguous names that might collide with OS services.

1. Backup and Recovery

• Always maintain recent system backups before making major changes such as driver updates, group policy modifications, or cleaning event logs. Inadvertently removing crucial logs could hamper investigations or compliance checks later on.

Considerations for Large Infrastructures

• Centralized Logging: In enterprise environments, you might aggregate logs on a SIEM or Syslog server. Verify that your aggregator does not repeatedly try to start or maintain ETW sessions on target systems.
• Automation Tools: If you deploy updates and maintenance via scripts (e.g., PowerShell or third-party automation tools), ensure you incorporate session checks and stops to prevent leftover or orphaned sessions after patch cycles.

Conclusion

Addressing Kernel-EventTracing Event ID 2 errors can be straightforward once you understand how ETW sessions work. Conflicts usually arise from duplicate or improperly terminated sessions, outdated sensor drivers, or conflicting policy and task settings. By stopping existing sessions via logman, restarting WMI, cleaning up orphaned logs, updating drivers, and reviewing group policies and scheduled tasks, you can successfully eliminate this persistent issue. Proactive monitoring of ETW sessions and best practices in driver management will further help maintain a stable, error-free system.

Staying vigilant about these error messages not only keeps your event logs clean but also ensures that more critical alerts or issues receive the attention they deserve. Implement these steps promptly when you encounter 0xC0000035 errors, and you’ll keep your Windows environment running smoothly.

In this article, we cover ways to resolve Session Cloud Files Diagnostic Event Listener failed to start with error 0xc0000022. This Event ID 2 is a Kernel-EventTracing error, which is a tool that Windows users can use to view any errors that might have happened. In most cases, the error happens after restarting a PC, and it’s associated with OneDrive or Office 365. The issues may cause issues like BSOD which can be an annoying experience to some Windows 11/10 users.

Картинка с сайта: www.thewindowsclub.com

In kernel tracing, the details are logged from different events and this optimizes the performance. Users can monitor the activities at the system level which gives them the needed information about threads and processes. There are different ways we can fix this error, and it won’t keep reappearing every time you reboot your Windows computer.

What causes Cloud Files Diagnostic Event Listener to fail to start?

The Cloud Files Diagnostic Event Listener error can be caused by various issues. Some of these causes may include OneDrive issues, corrupted or missing systems files, or lack of permissions and privileges to access the application. Also, if some of the components are not turned on in the system, Cloud Files Diagnostic Event Listener will fail to start with the error 0xc0000022. The error can also be triggered if some features are disabled or not working properly on your Windows PC.

To resolve Event ID 2, Session Cloud Files Diagnostic Event Listener failed to start with error 0xc0000022, try the following solutions.

1. Turn off the Files On-Demand feature on OneDrive
2. Run the SFC scan
3. Reinstall OneDrive
4. Enable essential Windows features
5. Run the program as an administrator

Let us look at these solutions in detail.

1] Turn off the Files On-Demand feature on OneDrive

Картинка с сайта: www.thewindowsclub.com

Disabling Files On-Demand settings on OneDrive can resolve the Cloud Files Diagnostic Event Listener error. To do so, follow the steps below;

• Go to the tray area of the Taskbar and locate the Microsoft OneDrive icon. You might need to click on the arrow facing up to locate it. Right-click on the icon and select Settings.
• Click on the Sync and back up option. Locate Advanced settings and go to the Files On-Demand option and toggle off the button next to it.

This should work and it doesn’t try the next solution.

2] Run the SFC scan

Картинка с сайта: www.thewindowsclub.com

Running the System Files Checker scan will fix any files that might be damaged or corrupted; the scan finds all these files and repairs them. If the damaged files are causing Session Cloud Files Diagnostic Event Listener failed to start with error 0xc0000022, the SFC scan will fix the issue. To run the SFC tool, open Windows Command Prompt as an administrator and type sfc /scannow, and then hit Enter on your PC keyboard.

3] Reinstall OneDrive

Картинка с сайта: www.thewindowsclub.com

If OneDrive is outdated or there was a faulty or incomplete installation, you will get issues like Cloud Files Diagnostic Event Listener error. And the only way to resolve an app with issues is to remove it and download the most recent version. So, to Reinstall Microsoft OneDrive, follow the steps below;

• Open Windows Settings and go to the Apps section. You can press the Windows button + I to open the settings.
• You will see a list of programs on your PC under Apps & features. Locate Microsoft OneDrive and click it. Select Uninstall to remove the app from your computer.
• Now, you need to reinstall OneDrive. Go to the Microsoft Store and search for OneDrive.
• Select the Get button to download and then install Microsoft OneDrive. Follow the on-screen directions to complete the process.

4] Enable essential Windows features

Картинка с сайта: www.thewindowsclub.com

For users who experience the Cloud Files Diagnostic Event Listener error 0xc0000022 while gaming or using other apps, they can enable the DirectPlay feature and see if the issue is fixed.

To enable the DirectPlay feature, open Control Panel and go to Programs and Features. On the left side, you will see Turn Windows features on or off; click it. Locate the Legacy Components option and expand it. Finally, check the box next to DirectPlay, click OK, and restart your PC. Finally, this will eliminate the Cloud Files Diagnostic Event Listener error when gaming or using other apps.

5] Run the program as an administrator

Картинка с сайта: www.thewindowsclub.com

Sometimes, you get Session Cloud Files Diagnostic Event Listener failed to start with error 0xc0000022 because you are accessing a program without the required privileges or permissions. So to ensure you won’t go wrong on this one, you need to open the affected app with administrative privileges.

Locate the app icon on your computer and right-click on it and select Run as administrator. Alternatively, right-click on the icon and go to Compatibility > Run this program as an administrator > Apply > OK.

We hope one of the solutions here works for you.

Fix: OneDrive error code 0x8004def7 on Windows

What is error code 0xc0000022 in Event Viewer?

Error code 0xc0000022 is an issue that happens when the DLL is missing or corrupted on your Windows PC. The best way to fix these files is by scanning your system using tools like SFC, DISM, or other legit third-party system scanners. The error 0xc0000022 can also be caused by accessibility issues, anti-virus software malfunctioning, or program conflicts. It’s not a fatal error and can be fixed by the solutions we mentioned in this article. To avoid this error in your PC, periodically scan your system files, disable any unnecessary third-party anti-virus software, and ensure your drivers and system are up-to-date.

Read: How to fix OneDrive sync issues on Windows

What is kernel EventTracing?

Kernel Event Tracing is an activity that involves analyzing log details about the events on the target. The details contain what is happening on the target at a system level, and this information helps users to remove or prevent any bottlenecks. It also helps in optimizing threads and system processes. The procedure starts when components work together to capture, present and generate the events data. Event Tracing for Windows (ETW) in the operating system helps developers to get reliable, fast, and varying sets of tracing features for events.

Как перейти от Waterfall к Agile

EggHead 06.05.2025

Каскадная модель разработки Waterfall — классический пример того, как благие намерения превращаются в организационный кошмар. Изначально созданная для упорядочивания хаоса и внесения предсказуемости. . .

Оптимизация SQL запросов — Продвинутые техники

Codd 06.05.2025

Интересно наблюдать эволюцию подходов к оптимизации. Двадцать лет назад всё сводилось к нескольким простым правилам: «Избегайте SELECT *», «Используйте индексы», «Не джойните слишком много таблиц». . . .

Создание микросервисов с gRPC и Protobuf в C++

bytestream 06.05.2025

Монолитные приложения, которые ещё недавно считались стандартом индустрии, уступают место микросервисной архитектуре — подходу, при котором система разбивается на небольшие автономные сервисы, каждый. . .

Многопоточность и параллелизм в Python: потоки, процессы и гринлеты

py-thonny 06.05.2025

Параллелизм и конкурентность — две стороны многопоточной медали, которые постоянно путают даже бывалые разработчики.

Конкурентность (concurrency) — это когда ваша программа умеет жонглировать. . .

Распределенное обучение с TensorFlow и Python

AI_Generated 05.05.2025

В машинном обучении размер имеет значение. С ростом сложности моделей и объема данных одиночный процессор или даже мощная видеокарта уже не справляются с задачей обучения за разумное время. Когда. . .

CRUD API на C# и GraphQL

stackOverflow 05.05.2025

В бэкенд-разработке постоянно возникают новые технологии, призванные решить актуальные проблемы и упростить жизнь программистам. Одной из таких технологий стал GraphQL — язык запросов для API,. . .

Распознавание голоса и речи на C#

UnmanagedCoder 05.05.2025

Интеграция голосового управления в приложения на C# стала намного доступнее благодаря развитию специализированных библиотек и API. При этом многие разработчики до сих пор считают голосовое управление. . .

Реализация своих итераторов в C++

NullReferenced 05.05.2025

Итераторы в C++ — это абстракция, которая связывает весь экосистему Стандартной Библиотеки Шаблонов (STL) в единое целое, позволяя алгоритмам работать с разнородными структурами данных без знания их. . .

Разработка собственного фреймворка для тестирования в C#

UnmanagedCoder 04.05.2025

C# довольно богат готовыми решениями – NUnit, xUnit, MSTest уже давно стали своеобразными динозаврами индустрии. Однако, как и любой динозавр, они не всегда могут протиснуться в узкие коридоры. . .

Распределенная трассировка в Java с помощью OpenTelemetry

Javaican 04.05.2025

Микросервисная архитектура стала краеугольным камнем современной разработки, но вместе с ней пришла и головная боль, знакомая многим — отслеживание прохождения запросов через лабиринт взаимосвязанных. . .