Missing Events in Event Log - workstation not server
Hi, Thanks for posting in Microsoft TechNet Forum. You could adjust the buffer size to reduce the risk of losing events; from my research, you could use Visual Studio 2010 Concurrency Visualizer to prevent lost kernel and/or user mode events: Visual Studio 2010 Concurrency Visualizer Prevent lost kernel and/or user mode events by adjusting Event Tracing for Windows (ETW) buffer Hope it helps. Alex Zhao TechNet Subscriber Support in forum If you have any feedback on our support, please contact tnmff@microsoft.com. Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
September 7th, 2011 5:56am

I just ran the detailed system report in Windows 7 Ultimate 64 and received several bogus warnings and informational messages. The most alarming of which was a warning that my Event Tracing for Windows maximum buffers and buffer size may not be optimal; 66% (40,633) events were lost during data collection. One user suggested that he thought this was indicative of a virus and has been trying to resolve the issue for a couple of days...not his job, by the way. I clicked on every link possible and even searched Technet and all I could find was a bunch of gibberish for C developers. If this is a C-Debugging issue only, it doesn't really pertain to me and I don't understand why it is showing up in my diagnostic results. Furthermore, if there is some setting I should change, from the simple user perspective, provide a link to a page that says: "TO RESOLVE THIS ISSUE: do this" rather than ask me to read hundreds of pages about C Debugging and still not find what I am looking for. I bring this up only because it makes the advance system report trecherous to use in a support environment if warnings like this appear. Some of my users pride themselves on the maintenance of their PCs and will spend hours trying to resolve this issue even if I tell them it's not a problem. I am not sure if this is the forum for my suggestion, but I would suggest re-evaluating the necessity of this part of the advanced system report, re-evaluating the methodology behind providing resources to resolve the issues that show up on the report, or downgrade developer specific comments to a context that doesn't make it sound like your computer is being hacked. I am going to ignore the warning and hope that there will be some resolution before I suggest to my users that they should run the report and send it to me for our records. I don't want to cause any undue concern for my users and "warnings" like this generate unrest. Thanks in advance for your support, Jase
Free Windows Admin Tool Kit Click here and download it now
September 8th, 2011 1:08pm

Hi, Thanks for posting in Microsoft TechNet Forum. You could adjust the buffer size to reduce the risk of losing events, from my research; you could use Visual Studio 2010 Concurrency Visualizer to prevent lost kernel and/or user mode events: Visual Studio 2010 Concurrency Visualizer Prevent lost kernel and/or user mode events by adjusting Event Tracing for Windows (ETW) buffer Hope it helps. Alex Zhao TechNet Subscriber Support in forum If you have any feedback on our support, please contact tnmff@microsoft.com.Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
September 8th, 2011 10:42pm

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics