Session Windowsupdatetracelog Failed To Start With The Following Error 0xc0000035 May 2026
Document ID: WIN-ERR-0xC0000035-WUTL
Severity: Medium (Logging/Audit Degradation)
Affected Component: Event Tracing for Windows (ETW) / Windows Update Client
The most common causes are:
When this collision happens:
If you want, I can:
The error 0xc0000035 typically translates to a "Status Object Name Collision," which essentially means a system log or process tried to start while another with the same name was already running. In most cases, if your computer is otherwise performing well and receiving updates, this error is benign and can be safely ignored.
If you are experiencing system slowdowns or Windows Update failures, you can address the error using the following methods: 1. Run Standard System Repairs
Corrupted system files are a common culprit for event tracing conflicts. Use the built-in repair tools in an elevated Command Prompt:
SFC Scan: Type sfc /scannow and press Enter to repair core system files.
DISM Tool: Type DISM /Online /Cleanup-Image /RestoreHealth and press Enter to repair the Windows system image. 2. Reset Windows Update Components
If the error persists and updates are failing, clearing the update cache can resolve naming collisions: Open Command Prompt as an administrator.
Stop the update services by entering these commands one by one: net stop wuauserv net stop cryptSvc net stop bits net stop msiserver Rename the cache folders:
ren C:\Windows\SoftwareDistribution SoftwareDistribution.old ren C:\Windows\System32\catroot2 Catroot2.old
Restart the services using the net start command followed by the service names above. 3. Disable the Log (Advanced)
If the error is flooding your Event Viewer and you want to stop it specifically:
Open the Performance Monitor (search for it in the Start menu). Navigate to Data Collector Sets > Event Trace Sessions.
Find the session causing the error (e.g., WindowsUpdateTraceLog or PerfDiag Logger), right-click it, and select Properties.
Under the Stop Condition tab, you can set a Maximum Size (e.g., 100 MB) to prevent it from failing due to overflow, or simply stop the session if it's not needed for active debugging.
Are you currently seeing this error alongside any specific system issues, like failed updates or blue screens?
0xc0000035 (STATUS_OBJECT_NAME_COLLISION) occurs when the system tries to start a logging session, but an object with that same name already exists or is still in use. For WindowsUpdateTraceLog , this usually means
a previous session didn't close properly or a background process is conflicting with it Microsoft Learn
If your computer is otherwise updating and running normally, this error is often harmless and can be safely ignored
. However, if you want to clear it from your Event Viewer or if updates are failing, try the following steps: Microsoft Learn 1. Run Windows Update Troubleshooting
The built-in troubleshooter can reset many components that cause this conflict. Troubleshoot Other troubleshooters Windows Update Microsoft Learn 2. Reset Windows Update Components
Clearing the update cache forces the system to re-initialize its logging and update files. Command Prompt as an administrator. Type these commands one by one, pressing Enter after each:
net stop wuauserv net stop cryptSvc net stop bits net stop msiserver Use code with caution. Copied to clipboard Rename the cache folders:
ren C:\Windows\SoftwareDistribution SoftwareDistribution.old ren C:\Windows\System32\catroot2 catroot2.old Use code with caution. Copied to clipboard Restart the services:
net start wuauserv net start cryptSvc net start bits net start msiserver Use code with caution. Copied to clipboard Microsoft Learn 3. Clear Orphaned Logging Sessions
tool to stop any "ghost" sessions that might be causing the collision. Microsoft Learn In an elevated Command Prompt, type: logman query Look for any session named WindowsUpdateTraceLog or similar. If found, stop it by typing: logman stop "WindowsUpdateTraceLog" -ets 4. Check for Update Health Tool Conflicts Sometimes, a specific tool called Microsoft Update Health Tools causes this specific logging error. Microsoft Learn Installed Apps Search for Microsoft Update Health Tools If it exists, you can try Uninstalling When this collision happens:
it. Windows will reinstall a fresh version if needed during the next update cycle. Microsoft Learn 5. Repair System Files
If the above steps don't work, ensure your core system files aren't corrupted. Microsoft Learn sfc /scannow in an elevated Command Prompt. Follow up with DISM /Online /Cleanup-Image /RestoreHealth Are you currently having trouble installing a specific update , or did you just notice this error while browsing the Event Viewer
Fix “Error Code: 0XC0000035” Kernel event tracing on Windows
0xc0000035 (STATUS_OBJECT_NAME_COLLISION) occurs when the Windows Event Tracing (ETW) system attempts to start a logging session with a name that is already in use. For WindowsUpdateTracelog
, this often means a previous update session didn't shut down correctly, leaving an orphaned entry that blocks new logs from starting.
While typically benign and safe to ignore if updates are still installing correctly, you can resolve it using the following methods: 1. Clear Orphaned Tracing Sessions
If a session is stuck, you can manually stop it to resolve the naming collision. Identify Sessions : Open Command Prompt as Administrator and run logman query to list active ETW sessions. Stop the Conflict : If you see WindowsUpdateTracelog or a similar name, run: logman stop "WindowsUpdateTracelog" -ets 2. Reset Windows Update Components
This clears the update cache and restarts the related services, which often fixes registration errors.
Open an elevated Command Prompt and run these commands sequentially:
net stop wuauserv net stop cryptSvc net stop bits net stop msiserver Use code with caution. Copied to clipboard Rename the cache folders:
ren C:\Windows\SoftwareDistribution SoftwareDistribution.old ren C:\Windows\System32\catroot2 catroot2.old Restart the services: net start wuauserv net start cryptSvc 3. Repair System Image & Files
Corrupted system files can prevent logging services from initializing properly. System File Checker sfc /scannow Run the DISM tool for deeper repairs: DISM /Online /Cleanup-Image /RestoreHealth 4. Adjust Logging Registry (Advanced)
If the error persists every boot, you may need to disable the specific autologger that is failing. Navigate to:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\WindowsUpdateTracelog DWORD and set its value to
: This stops the specific logging but does not impact the actual delivery of updates. Troubleshoot problems updating Windows - Microsoft Support
Run the Windows Update troubleshooter: Select Start > Settings > System > Troubleshoot > Other troubleshooters. Microsoft Support Startup Error in Event Viewer - Microsoft Q&A
Fixing Error 0xC0000035: Session "WindowsUpdateTraceLog" Failed to Start
If you have encountered the error message "Session 'WindowsUpdateTraceLog' failed to start with the following error: 0xC0000035" in your Windows Event Viewer, you are likely seeing a STATUS_OBJECT_NAME_COLLISION.
This error typically occurs when the system attempts to start an Event Tracing for Windows (ETW) session using a name that is already in use or was not properly closed during a previous session. While it often appears alongside update issues, it can also occur during normal background logging operations. Common Causes
Name Collisions: An existing trace session is already using the name WindowsUpdateTraceLog.
System File Corruption: Critical update or logging components are damaged.
Conflict with Update Tools: Software like "Microsoft Update Health Tools" or "RUXIM" can cause overlapping logging requests.
Third-Party Interference: Antivirus software or outdated network drivers may block trace session initiation. Step-by-Step Solutions 1. Terminate Existing Trace Sessions
Since the error code 0xC0000035 indicates a name conflict, manually stopping the stuck session often resolves it. Open Command Prompt as an Administrator.
Type logman query and press Enter to see all active ETW sessions.
If you see "WindowsUpdateTraceLog" in the list, stop it by typing:logman stop "WindowsUpdateTraceLog" -ets.
Restart your computer to let Windows attempt a fresh start of the log. 2. Repair System Files (SFC and DISM) If you want, I can:
Corrupted system files are a frequent culprit for logging failures. Startup Error in Event Viewer - Microsoft Q&A
It was a typical Monday morning for John, a IT specialist at a large corporation. He arrived at his desk, sipped his coffee, and began to tackle the day's tasks. One of his colleagues had reported an issue with the Windows Update service on one of the company's laptops, and John had volunteered to take a look.
As he opened the Event Viewer on the laptop, he noticed a peculiar error message: "session windowsupdatetracelog failed to start with the following error 0xc0000035". John's curiosity was piqued. He had seen some weird errors in his time, but this one was new.
Determined to get to the bottom of the issue, John started digging deeper. He checked the Windows Update settings, ran a few troubleshooting tools, and even attempted to manually update the system. But no matter what he tried, the error persisted.
As the day wore on, John became increasingly frustrated. He had never seen an error like this before, and his usual troubleshooting techniques weren't yielding any results. He decided to take a break and clear his head.
As he walked to the company cafeteria, John stumbled upon a quirky coworker, Alex, who was known for his unorthodox problem-solving skills. Alex was a self-proclaimed "tech whisperer" who often approached problems from unusual angles.
John shared the error message with Alex, who raised an eyebrow. "0xc0000035, eh? That's a nasty one," Alex said, stroking his chin. "I've seen that error before, but only in the most...creative of circumstances."
Alex led John on a wild goose chase through various system logs, device drivers, and even a detour into the Windows registry. Along the way, they discovered that the laptop had been used by a graphics designer, who had installed a custom graphics driver that was interfering with the Windows Update service.
As they dug deeper, Alex regaled John with tales of his own troubleshooting adventures, including a legendary fix for a printer that had been possessed by a mischievous spirit (or so Alex claimed). John's skepticism was tempered by a growing sense of wonder.
Finally, after what seemed like an eternity, Alex declared, "I think I see the problem!" With a flourish, he adjusted a registry setting, and the Windows Update service sprang to life.
The error message "session windowsupdatetracelog failed to start with the following error 0xc0000035" disappeared, replaced by a triumphant "Windows Update: Up to date". John breathed a sigh of relief as he and Alex high-fived.
As they walked back to their desks, John turned to Alex and asked, "How did you do that?" Alex grinned. "It's all about thinking outside the box...or in this case, the Windows Update box."
John smiled, feeling grateful for the unexpected detour. He realized that sometimes, the most seemingly insurmountable errors require a dash of creativity and a pinch of whimsy to solve. And he made a mental note to keep Alex's number handy for the next time he encountered a mysterious error message.
How to Fix "Session 'WindowsUpdateTracelog' failed to start with error 0xC0000035"
If you have encountered the error "Session 'WindowsUpdateTracelog' failed to start with the following error: 0xC0000035" in your Windows Event Viewer, you are not alone. This error code, 0xC0000035, translates to STATUS_OBJECT_NAME_COLLISION.
In plain English, this means a process (usually related to Windows Update or performance monitoring) tried to start a logging session using a name that was already in use by another active session. While it looks intimidating, it is often a benign "noise" entry that can be safely ignored if your system is otherwise running smoothly.
However, if you're experiencing actual issues with updates or performance, here is how to resolve it. 1. Verify if the Logger is Already Running
Since the error indicates a naming collision, it often happens because the session is already active. Open Performance Monitor (search for it in the Start menu). Navigate to Data Collector Sets > Event Trace Sessions.
Look for "WindowsUpdateTracelog" or "Circular Kernel Context Logger."
If the status is "Running," the error was likely just a harmless conflict during startup when the system tried to start a session that had already initialized. 2. Modify the Autologger Registry Keys
This is the most common permanent fix suggested by experts to stop the error from recurring in your logs. Press Win + R, type regedit, and press Enter.
Navigate to the following path:HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-System
Inside this folder, you may see a subkey with a GUID name like b675ec37-bdb6-4648-bc92-f3fdc74d3ca2.
On the right panel, find the Enabled and EnableProperty DWORD values. Double-click each and change the Value data from 1 to 0. Restart your computer. 3. Clear the Windows Update Cache
If the error is accompanied by failed updates, clearing the cache can resolve conflicts with corrupted log files. Open Command Prompt as an Administrator.
Stop the update services by typing these commands one by one: net stop wuauserv net stop bits
Navigate to C:\Windows\SoftwareDistribution and delete all files and folders inside. Restart the services: net start wuauserv net start bits 4. Run System Repair Tools or inaccessible state.
Corruption in system files can sometimes trigger naming collisions in kernel tracing.
Run the System File Checker by typing sfc /scannow in an elevated Command Prompt.
If SFC doesn't fix it, use the DISM tool:DISM /Online /Cleanup-Image /RestoreHealth. 5. Disable IPv6 (If applicable)
In some specific environments, particularly those still using legacy features like Homegroup, the 0xC0000035 error is linked to internal networking conflicts.
Go to Control Panel > Network and Sharing Center > Change adapter settings.
Right-click your connection, select Properties, and uncheck Internet Protocol Version 6 (TCP/IPv6). Summary Table: Error Breakdown
Circular kernal context logger failed to start - Experts Exchange
Again, I get this only when I logoff/logon during s session. I've tried every suggestion mentioned in many forums, including this, Experts Exchange Startup Error in Event Viewer - Microsoft Q&A
An explanation and guide for resolving the "Session 'WindowsUpdateTracelog' failed to start with the following error: 0xC0000035" system event. Understanding the Error
The error 0xC0000035 is a standard Windows NT status code representing STATUS_OBJECT_NAME_COLLISION. In the context of the Event Viewer and the WindowsUpdateTracelog, this occurs when the operating system attempts to start a new event tracing session but discovers a session or object with the same name already exists. Essentially, the "WindowsUpdateTracelog" is trying to occupy a space that is already claimed by a duplicate process. Common Causes
Trace Session Overlap: An existing instance of the Windows Update trace logger did not shut down correctly.
Clogged Data Collector Sets: Stale files in the Performance Monitor prevent new sessions from initiating.
Non-Critical Conflict: In many cases, this error is a benign side effect of how Windows 10 and 11 handle background diagnostics during the update process. How to Resolve the Conflict 1. Clear the Tracelog Files
Manually clearing the existing log files often resolves the "Object Name Collision" by removing the duplicate entries.
Open File Explorer and navigate to: C:\Windows\System32\LogFiles\WMI Locate the folder named RtBackup.
Right-click it, select Properties, and ensure you have administrative permissions to view it.
Delete the files ending in .etl within this folder (specifically those related to Windows Update). Restart your computer. 2. Reset Windows Update Components
If the logger is failing due to a corrupted update state, resetting the service can clear the block. Open Command Prompt as an Administrator. Type the following commands, pressing Enter after each: net stop wuauserv net stop cryptSvc net stop bits net stop msiserver Rename the software distribution folders:
ren C:\Windows\SoftwareDistribution SoftwareDistribution.old ren C:\Windows\System32\catroot2 catroot2.old Restart the services: net start wuauserv (and the others stopped above). 3. Manage via Performance Monitor Type Performance Monitor in the Start search and open it. Expand Data Collector Sets > Event Trace Sessions. Locate WindowsUpdateTracelog in the list.
If it shows as "Running" or "Stopped" with an error, right-click it and select Stop.
Restart your PC to allow Windows to re-initialize the session correctly. Is This Error Serious?
If your computer is otherwise performing well and Windows Updates are installing successfully, this error is typically informational. It indicates a brief conflict during background logging rather than a hardware failure or a critical system crash. You can safely ignore it unless you are experiencing "Blue Screen" errors or a total failure of the Windows Update service. AI responses may include mistakes. Learn more
You are most likely to see this error if:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\AutoLogger\WindowsUpdateTraceLog] "GUID"="C5B6F0A4-8C9E-4A2B-9F7D-1E3A5B7C9D0E" "Start"=dword:00000001 "FileName"="%SystemRoot%\System32\LogFiles\WU\TraceLog.etl" "MaxFileSize"=dword:00000032 "Status"=dword:00000000
If Method 1 didn't work or the key wasn't there, the issue might be actual file corruption on your hard drive regarding the Event Tracing logs. We can use the built-in System File Checker (SFC) and DISM tools to repair this.
The hexadecimal error code 0xc0000035 translates to "STATUS_OBJECT_NAME_COLLISION" — in plain English, this means "a file or registry key with the same name already exists."
When the Windows Update service attempts to start a new trace log session (specifically the "WindowsUpdateTraceLog" Event Tracing for Windows (ETW) session), it tries to create a unique object name. The error occurs when that name already exists in the system’s object namespace but is in a stalled, dead, or inaccessible state.