Since Sunday, 02.06.2022, SenseNdrPktmon maximum size warning occurs on all virtual machines

Question

Hello,

Ever since Sunday, the 6th of February, all of our Azure virtual machines have been reporting the following warning:

The message is:

The backing-file for the real-time session "SenseNdrPktmon" has reached its maximum size. As a result, new events will not be logged to this session until space becomes available. This error is often caused by starting a trace session in real-time mode without having any real-time consumers.

From what we can tell, it is an issue with Windows Defender performance monitors. However, we cannot figure out how to fix the issue. We have patched and rebooted several virtual machines, but the event is still logged.

There are also some additional "Sense" events logged:

Session "SenseEventLog" failed to start with the following error: 0xC0000035

Session "SenseIRDebugLogger" failed to start with the following error: 0xC0000035

Any assistance with figuring out how to stop these events from occurring is greatly appreciated.

Thank you,

Mathew

Answer 1

Okay for the purpose of us trying to sort out this shambles, here's today's update from MS Premier Support (we're about a year into trying to figure this out...)

As for the information received by the product group, the root cause for this scenario is the fact that the 3rd-party service is backing up this file, in conjunction with frequent file changes due to captured network traffic going through this file. To mitigate this, they suggest adding a File Filter on this file path in Acronis Cyber Protect backup service. Here's the official documentation [https://www.acronis.com/en-us/support/documentation/AcronisCyberProtect_15/#file-filters.html The file is located at: "C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTSenseNdrPktmon.etl"

So what they're saying is that EtwRTSenseNdrPktmon.etl is capturing packets and therefore changing continuously. Acronis is backing it up to an external server; therefore creating packets. So there's a cyclical generation of traffic going on.

You'd assume that the big boys would all play nicely together and we could get some actual work done...

I've added that filter now on 2 VM's and will monitor over the next few days.

Answer 2

Have you heard anything back from Premier Support. This is also causing us issue with Azure ASR. I tried to see if we could try and divert the logging of the file to a different location eg the temp disk. But can't see how I can change it.

Answer 3

We got a message from premier support this morning saying they have updated something..
I have not been able to locate any vms with the problem today. How is it looking for you people?

Answer 4

Is anyone still having this issue? We are experiencing high writes on our storage, especially on our rras vm's with 2 NICs and high network throughput. 'Pktmon.exe unload', instantly drops the 5MB writes to near nothing for around 20mins, when I'm guessing the defender policy refreshes.