Since Sunday, 02.06.2022, SenseNdrPktmon maximum size warning occurs on all virtual machines

Mathew Jung 126 Reputation points
2022-02-11T15:19:39.167+00:00

Hello,

Ever since Sunday, the 6th of February, all of our Azure virtual machines have been reporting the following warning:

173634-image.png

The message is:

The backing-file for the real-time session "SenseNdrPktmon" has reached its maximum size. As a result, new events will not be logged to this session until space becomes available. This error is often caused by starting a trace session in real-time mode without having any real-time consumers.

From what we can tell, it is an issue with Windows Defender performance monitors. However, we cannot figure out how to fix the issue. We have patched and rebooted several virtual machines, but the event is still logged.

There are also some additional "Sense" events logged:

173644-image.png

Session "SenseEventLog" failed to start with the following error: 0xC0000035

173645-image.png

Session "SenseIRDebugLogger" failed to start with the following error: 0xC0000035

Any assistance with figuring out how to stop these events from occurring is greatly appreciated.

Thank you,

Mathew

Windows Server
Windows Server
A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.
12,111 questions

29 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. TBlake 6 Reputation points
    2022-03-11T15:15:05.25+00:00

    HI
    I also agree it is an issue with Windows Defender. I was asked by my Azure case manager to disable windows defender, and verify if the issue still existed. SO I went to event manager (that I have not looked at since yesterday morning) and Hmmm the SenseNDR logging error messages have stopped as of 117 PM Eastern Time Yesterday. I go to the task manager and the Sense NDR process that has been in the top 5 of cpu usage for over a month no longer exists anywhere is Task manager. I cannot even find it as a service in Services. I am the only one at this company that has access to this server so I am confident that no one here has changed anything. Any chance you could look at yours for possible the same items? I am thinking an update may have been pushed. I looked at update history and the most recent update was on the 9th and the error stopped on the 10th in the afternoon. I am confident some updates occur without being visible to us. Please let me know what you find. BTW I have NOT disabled Defender......
    Thank you
    Tim

    1 person found this answer helpful.
  2. Paul 6 Reputation points
    2022-10-03T18:35:01.437+00:00

    I have this issue on several of my Azure VM's.

    It is causing high disk churn which is in turn causing my Azure Site Replication for disaster recovery to stop generating recovery points.

    We use Sophos Intercept X for our antivirus solution. My VM's are onboarded to Microsoft Defender for Endpoint as well, which is in forced passive mode via registry key setting. I have disabled device discovery, but event viewer is still getting flooded with event ID 1 for:

    "The backing-file for the real-time session "SenseNdrPktmon" has reached its maximum size. As a result, new events will not be logged to this session until space becomes available. This error is often caused by starting a trace session in real-time mode without having any real-time consumers."

    1 person found this answer helpful.
  3. Steffan Røstvig 16 Reputation points
    2022-11-16T10:57:54.597+00:00

    Problem is back again today after windows updates..

    Constant writes to EtwRTSenseNdrPktmon.etl 6-10MB/s.

    260941-screenshot-2022-11-16-115540.png

    260884-screenshot-2022-11-16-115716.png

    1 person found this answer helpful.
  4. Steffan Røstvig 16 Reputation points
    2023-01-25T14:35:05.7933333+00:00

    Quick update from our end.

    Finally got a premier support ticket opened last week. That being said it has been harder and harder to identify servers with the issue. 👀 Premier support has acknowledged that this is a "known problem" with "several customers" ..

    I finally found a server with the issue. 10MB/S constant writes to the ndrpktmon.evt. Was instructed to download the MDE Client Analyzer tool and upload logs to defender support team. Waiting for feedback 🙏

    1 person found this answer helpful.
  5. Limitless Technology 39,351 Reputation points
    2022-02-14T08:22:26.35+00:00

    Hi there,

    If this is after any recent update try uninstalling them.SenseNdrPktmon is the Data/Session name and there are a lot of reasons that can cause the error SenseNdrPktmon failed to start with the following error 0xC0000035.

    This could be due to a corrupted WiFi Driver or Adapter or an issue with the NAT address. Outdated Printer drivers can also cause this error.

    Some users have stated that restarting IPv4 and IPv6 services have sorted the issue.

    -Open Control Panel and click Network & Sharing Center > Change adapter settings.
    -Now, right-click on the connected network and select Properties.
    -Untick both Internet Protocol Version 4 and Internet Protocol Version 6.
    -Restart and reenable these services.

    --If the reply is helpful, please Upvote and Accept it as an answer--