The computer quits when you enable an Event Tracing for Windows trace session in Windows Server 2003, in Windows XP, or in Windows 2000 (897125)


The information in this article applies to:

  • Microsoft Windows 2000 Advanced Server
  • Microsoft Windows 2000 Datacenter Server
  • Microsoft Windows 2000 Server
  • Microsoft Windows 2000 Professional
  • Microsoft Windows XP Home Edition
  • Microsoft Windows XP Professional
  • Microsoft Windows XP Media Center Edition
  • Microsoft Windows XP Tablet PC Edition
  • Microsoft Windows XP Professional x64 Edition
  • Microsoft Windows Server 2003, Web Edition
  • Microsoft Windows Server 2003, Standard Edition
  • Microsoft Windows Server 2003, Enterprise Edition
  • Microsoft Windows Server 2003, Datacenter Edition
  • Microsoft Windows Server 2003, Standard x64 Edition
  • Microsoft Windows Server 2003, Enterprise x64 Edition
  • Microsoft Windows Server 2003, Datacenter x64 Edition

SYMPTOMS

In Microsoft Windows Server 2003, in Microsoft Windows XP, or in Microsoft Windows 2000, the computer quits (crashes) when you enable an Event Tracing for Windows (ETW) trace session. This issue occurs when you configure the trace session to use a buffer that is more than 4 kilobytes (KB).

CAUSE

The kernel debugger has a buffer limit of 4 KB. This issue occurs if you use a buffer that is more than 4 KB and you have the KD filter mode enabled when you start the ETW trace session. The computer quits because the kernel debugger (KD) tries to write beyond the kernel debugger's allocated memory.

WORKAROUND

To work around this issue, you can change the buffer size. Use a buffer that is less than 4KB when you start the ETW trace session.
Modification Type:MajorLast Reviewed:7/20/2005
Keywords:kbtshoot kbprb KB897125 kbAudDeveloper
©2004 Microsoft Corporation. All rights reserved.