Hi, I have received an event that my C:\Windows\Prefetch\ReadyBoot\ReadyBoot.etl log is full. I've opened it and discovered that it is full of two different kind of messages: Log Name: Source: Microsoft-Windows-ReadyBoostDriver Date: 31.1.2011 18:51:29 Event ID: 12 Task Category: (11) Level: Information Keywords: (32) User: N/A Description: The description for Event ID 12 from source Microsoft-Windows-ReadyBoostDriver cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer. If the event originated on another computer, the display information had to be saved with the event. The following information was included with the event: 30766064 3392172032 0 8192 66 The message id for the desired message could not be found Event Xml: <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> <System> <Provider Name="Microsoft-Windows-ReadyBoostDriver" Guid="{2a274310-42d5-4019-b816-e4b8c7abe95c}" /> <EventID>12</EventID> <Version>1</Version> <Level>4</Level> <Task>11</Task> <Opcode>0</Opcode> <Keywords>0x8000000000000020</Keywords> <TimeCreated SystemTime="2011-01-31T17:51:29.101957800Z" /> <EventRecordID>765</EventRecordID> <Correlation /> <Execution ProcessID="0" ThreadID="0" ProcessorID="3" KernelTime="519" UserTime="0" /> <Channel> </Channel> <Computer>[SomeComputer]</Computer> <Security /> </System> <EventData> <Data Name="StartTime">30766064</Data> <Data Name="ByteOffset">3392172032</Data> <Data Name="FileKey">0x0</Data> <Data Name="ByteLength">8192</Data> <Data Name="Flags">66</Data> </EventData> </Event> Log Name: Source: Microsoft-Windows-ReadyBoostDriver Date: 31.1.2011 18:51:29 Event ID: 28 Task Category: (26) Level: Information Keywords: (32) User: N/A Description: The description for Event ID 28 from source Microsoft-Windows-ReadyBoostDriver cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer. If the event originated on another computer, the display information had to be saved with the event. The following information was included with the event: 20 The message id for the desired message could not be found Event Xml: <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> <System> <Provider Name="Microsoft-Windows-ReadyBoostDriver" Guid="{2a274310-42d5-4019-b816-e4b8c7abe95c}" /> <EventID>28</EventID> <Version>1</Version> <Level>4</Level> <Task>26</Task> <Opcode>0</Opcode> <Keywords>0x8000000000000020</Keywords> <TimeCreated SystemTime="2011-01-31T17:51:29.185773900Z" /> <EventRecordID>786</EventRecordID> <Correlation /> <Execution ProcessID="4" ThreadID="224" ProcessorID="2" KernelTime="0" UserTime="0" /> <Channel> </Channel> <Computer>[SomeComputer]</Computer> <Security /> </System> <EventData> <Data Name="Size">20</Data> <Data Name="Data">0B0000000A0000000A000000E60E000000000000</Data> </EventData> </Event> There are plenty of these events (tens or about a hundred per one single second). The OS is Windows 7 x64. 1) What does ReadyBoostDriver Event Id 12 and Event Id 28 means? 2) What might cause them and how to debug and fix them (if appropriate)? Thanks, Martin

Hi, Thanks for posting in Microsoft TechNet forums. We can change the max file size from registry to resolve the issue HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\ReadyBoot The MaxFileSize key is a DWORD with a default decimal value of 20. Change it to larger number 40, 60… Best Regards Magon Liu TechNet Subscriber Support in forum. If you have any feedback on our support, please contact tngfb@microsoft.com Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Hi Magon, thanks for your reply. Unfortunatelly, I have already a increased MaxFileSize deployed (100). The events were placed so often (severals per just once single second) so it would overfill every meaningful size limit. Currently, the ReadyBoot.etl file is missing due to a recent reboot. However, this is clearly not the first time I have spotted this issue, so I am interested what was OS complaining about (ie. what might trigger the sampled events). There is a description text missing and they are not described on the net, so I have no clue what they are about. Would you get me a description / possible triggers for these events? Thank you. Best wishes, Martin PS: Please notify the forum team that clicking on Reply button under a message and while the reply form is still opened, clicking on the Unmark As Answer on the same messages results in an inconsistent state - the form disappers (not expected) but the forum engine still thinks it is opened (inconsistent state). Thank you.

Hi, First, thank you for your feedback of the forum funcion. We will report it to our feedback team. I think the event ID12 might not indicate a serious issue of the system. Please refer to a similar case there. You can unplug unnecessary external devices or boot into Safe Mode and check the result. Regarding to the missing ReadyBoot.etl file from your description, run the System File Checker (SFC) to repair Windows Vista system files. 1. Click Start, type "cmd" (without the quote) in the Start Search bar, right-click cmd.exe and click run as administrator. 2. Input the following commands and press Enter after each line. sfc /scannow Note: There is a SPACE between "SFC" and "/Scannow". This command will take several minutes to complete. If the corrupted files are detected but cannot be fixed, we need Windows Vista Installation Disk to repair Windows. Regards, Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Hi Magon, just a quick report for now. Sfc returned "Windows Resource Protection did not find any integrity violations." Martin

Hi, To get sfc to run, try the following: Open the Accessories category in the Start Menu Right-click on Command Prompt Select Run as Administrator Verify that the title of your command prompt window says, "Administrator: Command Prompt" Run sfc /scannow Regards,Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Any update? Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Hi, I have successfully completed the sfc command and shared its result in my post from February 4 - the sfc commands did not report any violations nor corrections made. Martin

Hi, As mentioned from the KB artical, the logging of this error does not affect the operation of your computer. Event error report is not a detailed reference to diagonose the operation system. If you would like to dig into how system operates, It is suggested to download Process Monitor. Regards,Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.