ProcExp and XPerf tracing
I was trying to run some XPerf traces to prepare for a training, when it all of a sudden stopped working. The error I got was this:
xperf: error: NT Kernel Logger: Cannot create a file when that file already exists. (0xb7).
Weird because I ran the same command successfully multiple times before. Trying to stop a potentially conflicting session by using:
Xperf –d blah.etl
Failed with this error:
xperf: error: Merge ETL: The specified path is invalid. (0xa1).
And the event log contained this:
Session "NT Kernel Logger" failed to start with the following error: 0xC0000035
What has changed was that I had started ProcMon.exe. That uses the NT Kernel Logger. Exiting that process cleared the way for my first command.