en[EVENT4] Kernel-EventTracing Warning: P2PLog

SC2 2018-03-01

2021-08-15

このサイトを検索 | Search this site

,Japan

This post is about event viewer message, event ID4.

As a result of investigation, it was found that the warning was caused by the Windows service DiagTrack.

This is a warning, so don't worry about it, but note the reason for the error and how to fix it.

The messages recorded in the event log are as follows.

Event viewer message
message	The maximum file size for session "P2PLog" has been reached. As a result, events may not be written to the file C:\WINDOWS\Logs\Homegroup\p2p.etl. The maximum file size is currently set to 5242880 bytes.
The name of the log	Microsoft-Windows-Kernel-EventTracing /Admin
Source	Kernel-EventTracing
Event ID	Four
level	warning
user	SYSTEM

Cause of the error

I found that the warning was caused by the following service.

dmwappushservice
DiagTrack

Details of each service are as follows.

dmwappushservice
Service name	dmwappushservice
Display name	dmwappushsvc
Description	WAP push message routing service

DiagTrack
Service name	DiagTrack
Display name	Connected User Experiences and Telemetry
Description	The Connected User Experiences and Telemetry service enables features that support in-app experiences and connected user experiences. The service also manages the collection and transmission of diagnostic and usage information in an event-driven manner when the privacy options setting for diagnostics and usage is enabled in Feedback and Diagnostics. Is used to improve the experience and quality of the Windows platform).

Windows service status

The results of examining the startup type and service status of dmwappushservice and DiagTrack Windows services are as follows.

Windows service
Service name	Startup type	Service status
dmwappushservice	manual	Stop
DiagTrack	Automatic	Running

Since dmwappushservice was stopped, it is not the cause of the P2PLog warning.

DiagTrack was running, causing a P2PLog warning.

Repair procedure

Is repair necessary?

The level of the event viewer is “Warning” so there is no problem even if left unattended, but I think you can rest assured if you understand the cause.

If you have enough power, how about trying a restoration?

Repair method

Stop DiagTrack and set the startup type to “Manual” or “Disable”.
This time it was manual.

This is the end of the repair method.

Remove from Windows service

When I check it, it seems that there is no problem even if it deletes it from the service because there are multiple hits with “dmwappushservice, DiagTrack deleted”.

I am cautious, so I decided to leave the startup "manual" and watch for a while.

Programs registered in the Windows service are deleted from the list when the data registered in the registry is deleted.

How to remove from Windows service

> Sc delete service name

The procedure for deleting services registered in the registry database is as follows.

Start Windows PowerShell or command prompt in administrator mode
Execute sc delete "service name"
Finish

"Service name" in step 2 is the character string displayed to the right of "Service name" displayed in the service properties.

Do not confuse it with the display name.

>sc delete dmwappushservice
>sc delete DiagTrack


c:\_	Administrator: Command prompt	ー □ ×
C:\>sc delete dmwappushservice C:\>sc delete DiagTrack

[W10] Starting Command Prompt in Administrator Mode: Scrap 2nd.

Afterword

I found an explanation of P2PLog on the NEC support page.

In our environment, it seems that a warning is recorded because the maximum file size of P2PLog exceeds 100MB. ('ω')

This event log indicates that the OS has recorded information such as power settings in a log file and has reached the maximum size of the log file.

The maximum log file size is 100MB. The file capacity depends on the number of CPU threads. If the number of threads is 50 or more, a 100MB log is generated and a warning log is registered.

The next time information such as power settings is recorded in the log file, the log file is overwritten and the latest information is always recorded.
NEC Support Portal

Verification: Windows 10 Pro Fall Creators Update, v1709

：SC2