Event Log. Kernel-EventTracing Event ID 2

Question

Hello

I am working on this event log, Session "SensorFramework-{d61722cd-d3ce-0897-1694-d917cab88c2a}" failed to start with the following error: 0xC0000035.

Currently, all of my servers reporting this error.

Please let me know if you have any solution.

Thank You!!

Answer 1

Hello walii,

Hope you have a lovely day!

The error you're encountering, Kernel-EventTracing Event ID 2 with the message "Session 'SensorFramework-{d61722cd-d3ce-0897-1694-d917cab88c2a}' failed to start with the following error: 0xC0000035," is typically related to issues with ETW (Event Tracing for Windows) sessions. The specific error code, 0xC0000035, translates to STATUS_OBJECT_NAME_COLLISION, which indicates that there is a name conflict, likely due to an ETW session with the same name already existing or not being properly cleaned up.

Here are steps you can take to address this issue:

1. Check for Existing ETW Sessions

Ensure that there are no existing ETW sessions with the same name that might be causing the conflict. You can use the logman command to list and stop any existing sessions:

1. Open a Command Prompt with administrative privileges.
2. Run the following command to list all ETW sessions: logman query

3. Look for any sessions with a similar name or ID as mentioned in the error message.
4. If you find any, you can stop them using: logman stop "SessionName" -ets

2. Restart the WMI Service

Sometimes restarting the Windows Management Instrumentation (WMI) service can resolve issues related to ETW sessions.

1. Open a Command Prompt with administrative privileges.
2. Run the following commands:

cmd

net stop winmgmt

net start winmgmt

3. Clean Up Orphaned Sessions

Orphaned ETW sessions can cause conflicts. You can clean them up by using the wevtutil command:

1. Open a Command Prompt with administrative privileges.
2. Run the following command:

cmd

wevtutil el

3. Look through the list for the offending session.
4. Use the following command to clear the session: cmd wevtutil cl "SessionName"

4. Check and Update Drivers

Ensure that all drivers, particularly sensor and framework drivers, are up to date. Outdated or incompatible drivers can sometimes cause issues with ETW sessions.

1. Open Device Manager.
2. Look for any devices related to sensors or frameworks.
3. Right-click on each device and select "Update driver."

****

5. Review Group Policy and Task Scheduler

Check if there are any Group Policy settings or scheduled tasks that might be configuring ETW sessions improperly.

1. Open Group Policy Editor (gpedit.msc) and review any policies related to ETW or event tracing.
2. Open Task Scheduler and look for tasks that might be starting ETW sessions.

6. Event Viewer Logs

Check the Event Viewer logs for more details that might provide additional context or clues about what is causing the error.

1. Open Event Viewer (eventvwr.msc).
2. Navigate to Applications and Services Logs > Microsoft > Windows > Kernel-EventTracing.
3. Look for any additional errors or warnings that occur around the same time as Event ID 2.

Please let me know if you need more detailed instructions or if there are any specific aspects of your environment that need to be considered.

Best regards

Rosy

Answer 2

Hello Rosy Yuan

Thank you so much, I will give it a try.

Answer 3

You're welcome! If you have any questions, feel free to contact us at any time. If the answer was helpful, please mark it as the solution.