Error of “NT Kernel Logger: Cannot create a file when that file already exists. (0xb7).”

Today I saw some high kernel mode CPU usage and decided to take a quick look at it using xperf:

xperf -on diageasy

And it dumped an error message immediately:

xperf: error: NT Kernel Logger: Cannot create a file when that file already exists. (0xb7).

And a quick Google search brought me to this page, which turns out the error message was caused by Process Explorer which utilizes ETW to collect network I/O statistics. The error message went away after I closed Process Explorer. Of course this might just be one of the possible causes for the error message, but probably it is the easiest one to get around.

Advertisements

Posted on October 25, 2011, in Uncategorized. Bookmark the permalink. 4 Comments.

  1. You just saved my ass. I never would have made this subtle connection… I wasn’t running Process Explorer either, rather the open source Process Hacker 2 from SourceForge. Soon as I closed it, xperf ran perfectly. Thanks for taking the time to let us Google searchers know the answer!

  2. C:\Program Files\Microsoft Windows Performance Toolkit>xperf.exe -on DiagEasy
    xperf: error: NT Kernel Logger: Cannot create a file when that file already exis
    ts. (0xb7).

    The problem is you cannot stop the NT Kernel Logger trace when the Trace Session->Stream mode is set to Real Time in the NT Kernel Logger Event Trace Sessions’ properties. Switch it to File and then you will be able to stop it. You can then utilize xperf to run kernel traces. Be sure to switch it back to the way it was when you are done!

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: