__Details: Investigate why 38% (11,007) events were lost during data collection. The settings for Event Tracing for Windows (ETW) maximum buffers and buffer size may not be optimal depending on which data sets are being collected. __

Hi guys,

I am not quite sure if you need this information still because I see this thread is kinda old but anyways. I was generating my system reports and mine said:

Investigate why 25% (5,469) events were lost during data collection. The settings for Event Tracing for Windows (ETW) maximum buffers and buffer size may not be optimal depending on which data sets are being collected.

So, basically, for those who don't know what Event Tracing for Windows is, here is a very basic and simple explanation : This is a feature that enables component level logging, that means, developers or system administrators can choose what they want to log (or trace) in case they want to troubleshoot something.

Here is the simplified article from Microsoft Support:

http://support.microsoft.com/kb/2593157/en-us

In order to fix this, all we have to do is check here:

In Performance Monitor (perfmon), we have the Data Collector Sets then Event Trace Sessions and Startup Event Trace Sessions.

Startup Event Trace Sessions are boot/startup related components. I don't know what each and every one of them means, but they all come Enabled as default. Enabled in this case means that they are being traced by ETW.

Event Trace Sessions are other application level components. Again, all enabled by default.

And finally, we can adjust the Buffer Sizes and Maximum Buffers by double clicking the component we

want to increase and then selecting the tab Trace Buffers:

For some reasons, we won't be able to change the Trace Buffers for all components.

Example, I tried changing the Buffer Size for EventLog-System in Event Trace Sessions and I got this message:

When attempting to commit the changes the following system error occurred:

Access is denied.

So I did a test, I disabled everything I could (with a few exceptions that Windows won't allow me to disable) and then I re-ran the report and this is what I got as a result considering that my computer didn't have any other kind of problems.

I see that many people were struggling with it over the web on the past few years, they might had came up with a solution already, but as I found this not replied in a lot of threads, I thought it was good to share my findings in here.

Hopefully I have helped you guys.

Hi Noel,

what are you doing? A boot trace?

"A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/

I see this too, on my Windows 7 Ultimate x64 system, though with lower numbers than the title on this thread (14% in my case).

My Pagefile is 8 GB in C:, which matches main memory size.

Following Microsoft's links doesn't lead to any "user serviceable parts" that I can find to manipulate the settings.

My system is very stable, never crashing or logging errors (that I see).

-Noel