System.Runtime.InteropServices.COMException (0x800700EA): More data is available. (Exception from HRESULT: 0x800700EA)

[jiahuizheng1114]

System.Runtime.InteropServices.COMException (0x800700EA): More data is available. (Exception from HRESULT: 0x800700EA)
at System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode, IntPtr errorInfo)
at Microsoft.Diagnostics.Tracing.Session.TraceEventSession.GetActiveSessionNames()
at Microsoft.Practices.EnterpriseLibrary.SemanticLogging.Etw.Utility.TraceEventUtil.CreateSession(String sessionName)
at Microsoft.Practices.EnterpriseLibrary.SemanticLogging.Etw.TraceEventServiceWorker.Initialize()
at Microsoft.Practices.EnterpriseLibrary.SemanticLogging.Etw.TraceEventService.<>c__DisplayClass21_1.b__0()
at Microsoft.Practices.EnterpriseLibrary.SemanticLogging.Etw.TraceEventService.HandleException(String callerName, Action body)

[brianrob]

Can you please put together a set of steps/repro code that causes this?

[ryandle]

Hey @brianrob, hope you are well. I just hit this during some local testing. Repro information:

• Windows 11 build 22621.1555
• I have 65 ETW sessions active on the machine

What seems to happen is:

1. TraceEventSession.GetActiveSessionNames() gets MAX_SESSIONS from GetETWMaxLoggers() introduced in Read Max ETW Loggers from Registry Key #1408
2. GetETWMaxLoggers is checking SYSTEM\\CurrentControlSet\\Control\\WMI EtwMaxLoggers key, but that doesn't seem to exist in my registry, so it defaults to 64
3. GetActiveSessionNames calls QueryAllTraces and gets ERROR_MORE_DATA
4. It then throws on the next line with the call to ThrowExceptionForHR

So, a few ideas on how to fix:

1. The code seems to assume that EtwMaxLoggers is set in the registry if the system supports more than 64 loggers, but that doesn't seem to be the case on my windows 11 machine. Perhaps there is another way to check for current supported max loggers?
2. An alternative would be to check for the ERROR_MORE_DATA return code and call QueryAllTraces again with the new max session count value it has set in the ref sessionCount parameter.

Any other ideas?

Happy to submit a PR if you think one of these is viable. I lean towards option 2 as I couldn't find a lot of good documentation on the EtwMaxLoggers registry setting.

[brianrob]

@ryandle, thanks for the analysis. I agree that the second fix sounds right to me. Would be happy to accept a PR on this.

64 is the default value, though Windows 10+ does allow for larger values - https://learn.microsoft.com/en-us/windows/win32/api/evntrace/nf-evntrace-queryalltracesa#parameters.

[jazzdelightsme]

I just hit this same error. My scenario is that my system has hit its limit of active trace sessions. Rather than manually run logman -ets and manually copy/paste stuff to kill, I wanted to write a script to do it for me (we have a build system that tends to leave sessions around, so I want a one-button "clean it up" solution), so I'm just calling [Microsoft.Diagnostics.Tracing.Session.TraceEventSession]::GetActiveSessionNames() directly, but it fails right off the bat. :'(

(v3.1.20)

[cincuranet]

@jazzdelightsme Can you share full exception message/stack trace?