Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 2 Source: Microsoft-Windows-Kernel-EventTracing

Session "WbadminUIInBuiltTracing" failed to start with the following error: 0xC0000035
Session "BizTalkDefaultTrace", Error code 0xC0000022: From a support forum: I found a solution: When starting a BizTalk host instance, BizTalk Server wants to start up a ETW trace session called "BizTalkDefaultTrace". For this to work, the user account associated with the host instance must be member of the local group "Performance Log Users".

After I added all user accounts of all my host instances to the "Performance Log Users" group, the ETW trace session starts up successfully. This can be checked by opening Administrative Tools -> Performance Monitor -> Data Collector Sets -> Event Trace Sessions. Here, the session "BizTalkDefaultTrace" should be listed as Running.

I checked this with my local notebook installation and with a clean new BizTalk Server 2010 installation on a virtual machine running Windows Server 2008 R2.

During startup of the trace session, another error might be logged:

Session "BizTalkDefaultTrace" failed to start with the following error: 0xC0000035

It seems that this is due to delays and repeated tries to start the trace session. So this can be safely ignored as long as Performance Monitor will show the trace session as Running.
According to TG491249 (Release Documentation for Windows Small Business Server 2011 Standard) the error can be safely ignored.
From EV100113, a discussion about this type of problem (with Error code 0xC0000035): "Some people mention this might have something to do with network card device driver. To troubleshoot the issue, test your machine in safe mode, if it works fine in the safe mode, please test in Clean Boot, you can refer to M929135."
Various error codes and sessions can be reported with this message:

- Session WbadminUIInBuiltTracing, Error code 0xC0000035 - From a support forum "This error event is HARMLESS and can be safely ignored. This seems to be an issue with the way inbox tracing (used to collect backup/restore traces) is enabled in Windows backup. It occurs if an inbox tracing session is already enabled and backup tries to start it again."

- Session {4498f992-a958-48ff-8218-eaf88df21469}, Error code 0xC0000188

- Session Circular Kernel Context Logger, Error code 0xC0000035 - See EV100113.

- Session "", Error code 0xC000000D - See EV100114.

- Session ReadyBoot, Error code 0xC0000188 - Apparently one shouldn't worry about this one, see ME2001347.

- Session Homegroup Log, Error code 0xC0000035: See EV100115.
Session Homegroup Log, Error code 0xC0000035. From a support forum:
This fixed it for me
1. Found this article ME293497
2. Then did the following (from a command line):
- ipconfig /Flushdns
- ipconfig /release /all

Make sure DCHP is enabled (well I had to), then you may have to reboot  (on restart, it re-registered with DNS).

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.