unable to start collect

[bian6]

Started with command line: "F:\bian\perfView\PerfView.exe" 
PerfView Version: 3.1.15  BuildDate: Mon, 26 Aug 2024 23:20:01 GMT
PerfView Start Time 8/27/2024 3:27:42 PM
Started: View
Warning: PdbScope not found at F:\bian\perfView\PerfViewExtensions\PdbScope.exe
Disabling the Image Size Menu Item.
Warning: ILSize not found at F:\bian\perfView\PerfViewExtensions\ILSize.dll
Disabling the IL Size Menu Item.
Completed: View   (Elapsed Time: 0.282 sec)
Collection Dialog open.
Started: Collecting data F:\bian\perfView\PerfViewData.etl
[Kernel Log: F:\bian\perfView\PerfViewData.kernel.etl]
Kernel keywords enabled: Default
Aborting tracing for sessions 'NT Kernel Logger' and 'PerfViewSession'.
Ensuring .NET Allocation profiler not installed.
Detected 64 bit system, removing 32 bit keys.
Completed: Collecting data F:\bian\perfView\PerfViewData.etl   (Elapsed Time: 5.625 sec)
Exception Occurred: System.Runtime.InteropServices.COMException (0x800700B7): Cannot create a file when that file already exists. (Exception from HRESULT: 0x800700B7)
   at System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode, IntPtr errorInfo)
   at Microsoft.Diagnostics.Tracing.Session.TraceEventSession.EnableKernelProvider(Keywords flags, Keywords stackCapture)
   at PerfView.CommandProcessor.Start(CommandLineArgs parsedArgs) in D:\a\_work\1\s\src\PerfView\CommandProcessor.cs:line 507
   at PerfView.CommandProcessor.Collect(CommandLineArgs parsedArgs) in D:\a\_work\1\s\src\PerfView\CommandProcessor.cs:line 213
   at PerfView.MainWindow.<>c__DisplayClass27_0.<ExecuteCommand>b__0() in D:\a\_work\1\s\src\PerfView\MainWindow.xaml.cs:line 1393
   at PerfView.StatusBar.<>c__DisplayClass22_0.<StartWork>b__0() in D:\a\_work\1\s\src\PerfView\GuiUtilities\StatusBar\StatusBar.xaml.cs:line 254
An exceptional condition occurred, see log for details.
Started: Aborting any active Data collection
Completed: Aborting any active Data collection   (Elapsed Time: 0.000 sec)
Collection Dialog open.
Started: Collecting data F:\bian\perfView\PerfViewData.etl
[Kernel Log: F:\bian\perfView\PerfViewData.kernel.etl]
Kernel keywords enabled: Default
Completed: Collecting data F:\bian\perfView\PerfViewData.etl   (Elapsed Time: 0.890 sec)
Exception Occurred: System.Runtime.InteropServices.COMException (0x800700B7): Cannot create a file when that file already exists. (Exception from HRESULT: 0x800700B7)
   at System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode, IntPtr errorInfo)
   at Microsoft.Diagnostics.Tracing.Session.TraceEventSession.EnableKernelProvider(Keywords flags, Keywords stackCapture)
   at PerfView.CommandProcessor.Start(CommandLineArgs parsedArgs) in D:\a\_work\1\s\src\PerfView\CommandProcessor.cs:line 507
   at PerfView.CommandProcessor.Collect(CommandLineArgs parsedArgs) in D:\a\_work\1\s\src\PerfView\CommandProcessor.cs:line 213
   at PerfView.MainWindow.<>c__DisplayClass27_0.<ExecuteCommand>b__0() in D:\a\_work\1\s\src\PerfView\MainWindow.xaml.cs:line 1393
   at PerfView.StatusBar.<>c__DisplayClass22_0.<StartWork>b__0() in D:\a\_work\1\s\src\PerfView\GuiUtilities\StatusBar\StatusBar.xaml.cs:line 254
An exceptional condition occurred, see log for details.

I have tried excute perfView---abort, and restart the computer, and used in different computer, the above error will occurs alse, the version is [PerfView and TraceEvent 3.1.15]. and the computer version is win10 ,

[cincuranet]

@bian6 The links above look like a malware. I would recommend not doing anything with the content. ❗

From the log you posted I see Cannot create a file when that file already exists. (that HRESULT is ERROR_ALREADY_EXISTS). Can you verify that you don't have previous trace file(s) in F:\bian\perfView?

Also can you share how are you starting the collect?

[cincuranet]

Yeah, I was not expecting existing file to be the case. PerfView would overwrite PerfViewData.etl anyway.

@brianrob Anything rings the bell from the log ?

[brianrob]

I have not seen this before. Can you please try with an older version of PerfView just to rule out any recent changes? https://github.com/microsoft/perfview/releases/tag/v3.1.13. My suspicion is that this won't matter based on the stack, but want to be sure. Also, is it possible that there is a permissions issue with the target location? I've seen things like that before result in similar errors. Perhaps try to save the trace to the OS drive in your user profile directory?

[MagicAndre1981]

This happended a lot in Windows 7, because here only 1 NT Kernel Logger was allowed and other tools like Process Explorer were running and also use ETW.

#635 also shows this

[MagicAndre1981]

I have not seen this before

The NT Kernel Logger is still the issue, also you still use this name.

@brianrob If you don't support Windows 7 any longer in Trace Event/Perfview you can define your own name like TraceEventKernelTraceSession to avoid this issue. This custom name support for kernel loggers was added in Windows 8.

The SystemTraceProvider is a kernel provider with a predefined sets of kernel events supported on Windows 7, Windows Server 2008 R2, and later. On Windows 7 and Windows Server 2008 R2, the SystemTraceProvider could only be used for the NT Kernel Logger session.

On Windows 8, Windows Server 2012, and later, the SystemTraceProvider can be multiplexed for up to 8 logger sessions. The first two slots for logger sessions are reserved for the NT Kernel Logger and the Circular Kernel Context Logger .

@brian6 make sure you don't run any software that use ETW like ProcessExplorer, ResMon, ProcMon