Microsoft KB Archive/897125

= The computer quits when you enable an Event Tracing for Windows trace session in Windows Server 2003, in Windows XP, or in Windows 2000 =

Article ID: 897125

Article Last Modified on 10/11/2007

-

APPLIES TO


 * Microsoft Windows 2000 Advanced Server
 * Microsoft Windows 2000 Datacenter Server
 * Microsoft Windows 2000 Server
 * Microsoft Windows 2000 Professional Edition
 * Microsoft Windows XP Home Edition
 * Microsoft Windows XP Professional
 * Microsoft Windows XP Media Center Edition 2002
 * Microsoft Windows XP Tablet PC Edition
 * Microsoft Windows XP Professional x64 Edition
 * Microsoft Windows Server 2003, Web Edition
 * Microsoft Windows Server 2003, Standard Edition (32-bit x86)
 * Microsoft Windows Server 2003, Enterprise Edition
 * Microsoft Windows Server 2003, Datacenter Edition (32-bit x86)
 * Microsoft Windows Server 2003, Standard x64 Edition
 * Microsoft Windows Server 2003, Enterprise x64 Edition
 * Microsoft Windows Server 2003, Datacenter x64 Edition

-





SYMPTOMS
In Microsoft Windows Server 2003, in Microsoft Windows XP, or in Microsoft Windows 2000, the computer quits (crashes) when you enable an Event Tracing for Windows (ETW) trace session. This issue occurs when you configure the trace session to use a buffer that is more than 4 kilobytes (KB).



CAUSE
The kernel debugger has a buffer limit of 4 KB. This issue occurs if you use a buffer that is more than 4 KB and you have the KD filter mode enabled when you start the ETW trace session. The computer quits because the kernel debugger (KD) tries to write beyond the kernel debugger's allocated memory.



WORKAROUND
To work around this issue, you can change the buffer size. Use a buffer that is less than 4KB when you start the ETW trace session.

Additional query words: logger folk DDK

Keywords: kbtshoot kbprb KB897125

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.