How to Fix EVENT_TRACING_FATAL_ERROR (0x0000011D) Blue Screen Error in Windows

Quick Answer

EVENT_TRACING_FATAL_ERROR (0x0000011D) is a Windows Blue Screen of Death (BSOD) error indicating that the Event Tracing subsystem has encountered an unexpected fatal error. Event Tracing for Windows (ETW) is a built-in Windows mechanism used to record system and application events for diagnostics, performance monitoring and troubleshooting.

This bug check can occur when ETW encounters problems such as security initialization failures, processor initialization failures, corrupted kernel-mode registrations, invalid handles, event data overruns or trace buffer corruption.

The error does not identify one universal faulty component. Its underlying cause must be investigated using the bug check parameters, crash dump files and Windows debugging tools. Updating Windows and relevant drivers, checking recently installed system software and analyzing crash dumps are reasonable troubleshooting steps.

What Is EVENT_TRACING_FATAL_ERROR (0x0000011D)?

EVENT_TRACING_FATAL_ERROR is a Windows kernel bug check, also known as a stop error or Blue Screen error. Windows generates this error when the Event Tracing subsystem encounters a condition serious enough that it cannot safely continue operating.

The error is identified by the following values:

• Bug Check Name: EVENT_TRACING_FATAL_ERROR
• Bug Check Code: 0x0000011D
• Hexadecimal Value: 0x0000011D
• Error Category: Windows Kernel / Event Tracing
• Common Display: Your device ran into a problem and needs to restart.
• Related Technology: Event Tracing for Windows (ETW)

Microsoft documents this bug check as an unexpected fatal error in the Event Tracing subsystem. Its technical documentation is primarily intended for Windows driver developers and kernel debugging specialists.

What Is Event Tracing for Windows (ETW)?

Event Tracing for Windows (ETW) is a built-in Windows tracing framework that records detailed information about operating system activities, application behavior and system performance.

ETW helps Windows components, applications and software developers collect diagnostic information without requiring every component to implement its own logging system.

How ETW Works

ETW generally involves three important components:

1. Event Providers: Software components that generate diagnostic events. These may include Windows components, device drivers and applications.
2. Event Controllers: Components or tools that configure tracing sessions, enable providers and control which events are collected.
3. Event Consumers: Applications or diagnostic tools that receive and analyze collected event data.

ETW uses trace sessions and buffers to manage event collection. If a critical operation within this subsystem encounters a fatal condition, Windows may stop the system to prevent continued operation in an unstable state.

For more information, refer to Microsoft's Event Tracing for Windows documentation.

Documented Causes and Error Subtypes

Microsoft identifies several subtypes of the EVENT_TRACING_FATAL_ERROR bug check. These subtypes are represented by the first bug check parameter (Parameter 1).

The following table describes the documented values:

Parameter 1	Documented Error Condition	Explanation
0x01	Unable to initialize security	The Event Tracing subsystem encountered a failure while initializing security.
0x02	Unable to initialize processor	The subsystem encountered a failure while initializing processor-related functionality.
0x03	Kernel mode registration corruption	Corruption was detected in kernel-mode event registration.
0x04	Invalid handle in unregistration	An invalid handle was encountered during an event unregistration operation.
0x05	Data overrun in EventWrite call	An event-writing operation encountered a data overrun condition.
0x06	Event has been lost	The Event Tracing subsystem encountered an event-loss condition.
0x07	Trace buffer corruption	Corruption was detected in a trace buffer.
0x08	Unable to allocate cache-aware rundown protection for ETW LoggerContext	The subsystem could not allocate the required rundown protection. Parameter 2 contains the Logger ID.
0x09	Illegal reference count of ETW GuidEntry	The reference count of an ETW GUID entry is invalid for the current object state. Parameter 2 contains a pointer to the ETW_GUID_ENTRY structure.

Important: These are documented internal error conditions, not a list of confirmed causes for every affected computer. The actual failure must be determined from the crash dump and debugging information.

Common Symptoms of 0x0000011D

When this bug check occurs, Windows may display a Blue Screen of Death and restart the computer. Depending on the circumstances, users may experience the following symptoms:

• The computer suddenly displays a blue screen with the stop code EVENT_TRACING_FATAL_ERROR.
• Windows restarts unexpectedly during normal operation.
• The system crashes repeatedly, sometimes during startup.
• The computer becomes unstable after installing or updating drivers or system software.
• Crash dump files are generated in the Windows directory.
• The error may occur repeatedly under particular workloads or system conditions.

These symptoms are not exclusive to this bug check. They should be considered alongside the actual stop code and crash dump information.

How to Troubleshoot EVENT_TRACING_FATAL_ERROR

There is no single confirmed repair for every 0x0000011D crash. The following steps provide a systematic approach, starting with basic troubleshooting and progressing to advanced diagnostics.

1. Restart the Computer and Check Whether the Error Repeats

If Windows restarts successfully after the blue screen, observe whether the error occurs again.

1. Allow Windows to complete the automatic restart.
2. Sign in normally.
3. Check whether the computer operates without further crashes.
4. Note what you were doing immediately before the error occurred.

A single crash does not necessarily indicate a persistent hardware or software problem. However, repeated occurrences should be investigated.

2. Install Available Windows Updates

Microsoft regularly releases Windows updates that include reliability improvements, security fixes and compatibility updates.

1. Open Settings.
2. Navigate to Windows Update.
3. Select Check for updates.
4. Install applicable updates.
5. Restart the computer if required.

On Windows 10, Windows Update is available under Settings > Update & Security > Windows Update.

For update information, visit Microsoft Windows Support.

3. Check Recently Installed or Updated Drivers

Device drivers operate with Windows at a low system level. A defective, incompatible or corrupted driver can contribute to system instability.

If the error started after a driver update or new device installation, investigate that change first.

1. Right-click the Start button and open Device Manager.
2. Expand the relevant hardware category.
3. Identify recently updated or newly installed devices.
4. Open the device properties and select the Driver tab.
5. If available and appropriate, use Roll Back Driver to restore the previous driver version.

Alternatively, obtain the correct driver from the computer manufacturer's official support website.

Note: Do not randomly uninstall system drivers or install third-party driver packages. Incorrect driver changes can create additional problems.

4. Remove Recently Installed Software or System Utilities

Some applications install kernel-mode drivers or system-level components. Examples include security software, monitoring utilities, hardware management applications and third-party system tools.

If the crashes began after installing new software, investigate whether that software is involved.

1. Open Settings.
2. Navigate to Apps > Installed apps.
3. Review recently installed applications.
4. Check the software manufacturer's documentation for known compatibility issues.
5. If appropriate, uninstall the recently installed application using its normal uninstallation procedure.
6. Restart Windows and observe whether the problem continues.

On managed business computers, consult the system administrator before removing security agents, monitoring tools or enterprise management software.

5. Run Windows System File Checker

System File Checker (SFC) checks protected Windows system files and attempts to repair corrupted files using available Windows repair resources.

To run SFC:

1. Open Start.
2. Search for Command Prompt.
3. Select Run as administrator.
4. Execute the following command:

sfc /scannow

1. Wait for the verification process to complete.
2. Review the result displayed in Command Prompt.
3. Restart Windows if repairs were performed.

If SFC reports that it could not repair some files, use the DISM servicing tool before running SFC again.

6. Repair the Windows Component Store Using DISM

Deployment Image Servicing and Management (DISM) can repair the Windows component store, which provides the files required for certain system repair operations.

Open an elevated Command Prompt or Terminal and execute:

DISM /Online /Cleanup-Image /RestoreHealth

Allow the operation to finish. It may take several minutes and may require access to Windows Update or another valid repair source.

After DISM completes, run:

sfc /scannow

Restart the computer and check whether the blue screen error returns.

Important: SFC and DISM repair Windows components. They do not directly repair every possible ETW registration, driver or hardware problem.

7. Check Windows Memory and Hardware Stability

Although the 0x0000011D bug check specifically identifies an Event Tracing failure, hardware instability should not be assumed or ruled out without evidence.

If crashes continue, consider checking:

• RAM: Run Windows Memory Diagnostic or an appropriate manufacturer-provided memory test.
• Storage: Check the health of the SSD or hard drive using the manufacturer's diagnostic utility.
• Firmware: Check whether a relevant BIOS or UEFI update is available from the computer manufacturer.
• Hardware changes: Review recently installed memory, expansion cards and connected devices.
• Overclocking: If CPU, memory or GPU settings have been manually overclocked, restore supported default settings for testing.

Hardware tests should be performed according to the manufacturer's instructions. Before making firmware or BIOS changes, ensure that important data is backed up and any applicable device encryption recovery information is available.

8. Use Safe Mode to Investigate Software and Driver Problems

Safe Mode starts Windows with a limited set of drivers and services. It can help determine whether a problem is associated with software or drivers that are not loaded during normal startup.

To access Safe Mode:

1. Open Settings and navigate to System > Recovery.
2. Under Advanced startup, select Restart now.
3. After Windows restarts, select Troubleshoot.
4. Choose Advanced options > Startup Settings.
5. Select Restart.
6. Press the appropriate number key for Safe Mode or Safe Mode with Networking.

On Windows 10, the recovery options are available under Settings > Update & Security > Recovery.

If the computer operates normally in Safe Mode, investigate third-party drivers, services and startup applications. This observation can help narrow down the problem, but it does not prove that a particular driver is responsible.

For additional guidance, see Microsoft Windows Support.

Advanced Troubleshooting: Analyze the Crash Dump

For repeated EVENT_TRACING_FATAL_ERROR crashes, analyzing the memory dump is generally more useful than trying random repair procedures.

A crash dump contains diagnostic information captured when Windows encountered the fatal error. It can help technical specialists examine the bug check parameters, system state, loaded modules and relevant call stacks.

1. Locate the Crash Dump File

Windows can save crash information in different locations depending on the configured dump type.

Dump Type	Typical Location
Small memory dump	C:\Windows\Minidump
Kernel memory dump	C:\Windows\MEMORY.DMP
Automatic memory dump	C:\Windows\MEMORY.DMP
Complete memory dump	C:\Windows\MEMORY.DMP

The actual location depends on Windows configuration. Some systems may not generate a dump if the required settings or storage conditions are not met.

2. Configure Windows to Generate a Memory Dump

If Windows is not creating crash dump files, check the Startup and Recovery settings.

1. Search for View advanced system settings from Start.
2. Open the Advanced tab.
3. Under Startup and Recovery, select Settings.
4. Locate the Write debugging information option.
5. Select an appropriate dump type, such as Automatic memory dump.
6. Confirm the configuration and restart Windows if required.

Make sure the Windows system drive has sufficient free space and that the page file is configured appropriately for the selected dump type.

For more information, refer to Microsoft's Kernel-Mode Dump Files documentation.

3. Analyze the Dump Using WinDbg

WinDbg is Microsoft's debugging tool for examining Windows crash dumps and investigating kernel-mode errors.

Basic analysis procedure:

1. Install WinDbg using the official Microsoft Windows Debugging Tools documentation.
2. Open WinDbg.
3. Select File > Open dump file.
4. Locate and open the relevant .dmp file.
5. Wait for the debugger to load the required symbols and analyze the dump.
6. Enter the following command in the debugger command window:

!analyze -v

This command performs a detailed analysis of the bug check and displays diagnostic information.

For additional inspection, use:

.bugcheck

This command displays the bug check code and its parameters.

Microsoft specifically recommends !analyze -v as an initial analysis command for the EVENT_TRACING_FATAL_ERROR bug check.

4. Examine Parameter 1

Parameter 1 is particularly important because it identifies the documented subtype of the 0x0000011D bug check.

For example:

• 0x01 indicates an inability to initialize security.
• 0x03 indicates kernel-mode registration corruption.
• 0x07 indicates trace buffer corruption.
• 0x08 indicates an allocation failure involving ETW LoggerContext rundown protection.

The remaining parameters provide additional information for certain subtypes. Their interpretation depends on the specific bug check condition.

For example, Parameter 2 contains the Logger ID for subtype 0x08, while subtype 0x09 uses Parameter 2 to provide a pointer to an ETW_GUID_ENTRY structure.

These values are intended for technical analysis. A particular subtype should not be interpreted as proof of a specific defective hardware component or third-party application.

5. Examine the Stack Trace and Loaded Modules

Technical specialists can inspect the debugger output for information about the execution path associated with the crash.

Useful information may include:

• Bug check parameters.
• Module and image names.
• Relevant stack frames.
• Loaded kernel modules.
• Symbol information.
• Related driver or ETW subsystem activity.

A module appearing in a crash stack is not automatically the cause of the failure. It may simply be part of the execution path when the system encountered the error.

For detailed procedures, refer to Microsoft's Analyzing a Kernel-Mode Dump File by Using WinDbg.

When Should You Contact Technical Support?

Consider contacting the computer manufacturer, software vendor or a qualified Windows debugging specialist if:

• The 0x0000011D error continues after basic troubleshooting.
• Windows crashes repeatedly during startup.
• The crash dump indicates a kernel-mode registration or ETW subsystem failure.
• The computer is part of a business-critical environment.
• The issue started after a firmware, driver or enterprise software deployment.
• Multiple computers experience the same error after a common software or configuration change.

When requesting technical assistance, provide the following information where available:

• Windows version, edition and build number.
• Computer manufacturer and model.
• Exact bug check code and parameters.
• Date and time of the crash.
• Recent driver, software or hardware changes.
• Relevant memory dump files and WinDbg analysis output.

Memory dumps can contain sensitive information, including fragments of data from the affected system. Review organizational privacy and security requirements before sharing them externally.

How to Prevent EVENT_TRACING_FATAL_ERROR

Although not every occurrence can be prevented, the following practices can help maintain Windows system stability:

• Keep Windows updated with applicable security and reliability updates.
• Install drivers from the computer manufacturer or authorized hardware vendors.
• Use compatible and properly maintained system-level software.
• Avoid unnecessary kernel-level monitoring and system modification utilities.
• Test significant driver and firmware updates before deploying them widely in business environments.
• Maintain reliable backups of important data.
• Monitor recurring system crashes and preserve relevant dump files.
• Avoid unsupported registry modifications and manual changes to Windows tracing components.
• Use appropriate hardware diagnostic tools when system instability suggests a possible hardware issue.

Frequently Asked Questions

1. What does EVENT_TRACING_FATAL_ERROR (0x0000011D) mean?

It means Windows encountered an unexpected fatal error in its Event Tracing subsystem. The bug check can indicate problems involving ETW initialization, security, event registration, handles, event writing or trace buffers.

2. Is EVENT_TRACING_FATAL_ERROR a hardware or software problem?

The bug check identifies an error in the Windows Event Tracing subsystem, not a specific hardware or software component. The underlying reason must be investigated using crash dump information and system diagnostics.

3. Can a faulty driver cause error 0x0000011D?

A driver-related problem is a reasonable area to investigate because Windows drivers can interact with kernel-mode tracing facilities. However, Microsoft does not identify one particular driver as the universal cause of this bug check. Crash dump analysis is needed to investigate a specific occurrence.

4. What is Parameter 1 in the 0x0000011D bug check?

Parameter 1 identifies the bug check subtype. Microsoft documents values from 0x01 through 0x09, representing different fatal conditions in the Event Tracing subsystem.

5. How can I identify the cause of EVENT_TRACING_FATAL_ERROR?

Start by examining the bug check parameters and the Windows memory dump. Use WinDbg and the !analyze -v command to obtain detailed diagnostic information. The Parameter 1 subtype and relevant stack information can help technical specialists investigate the failure.

6. Does SFC fix the 0x0000011D error?

System File Checker can repair certain corrupted protected Windows system files. However, it is not a dedicated repair utility for ETW failures, and it cannot guarantee a fix for this bug check.

7. Is it safe to delete Windows Event Tracing logs to fix this error?

Deleting tracing logs is not an established universal solution for EVENT_TRACING_FATAL_ERROR. Do not delete Windows diagnostic logs, trace files or ETW configuration data without a specific diagnostic reason and an appropriate recovery plan.

8. Does this error mean Windows needs to be reinstalled?

No. A Windows reinstallation is not automatically required. Investigate the crash parameters, recent system changes, drivers and memory dump first. Consider major recovery operations only when supported by the diagnostic findings and after protecting important data.

Conclusion

EVENT_TRACING_FATAL_ERROR (0x0000011D) is a Windows kernel bug check associated with an unexpected fatal condition in Event Tracing for Windows (ETW).

Because Microsoft documents multiple subtypes for this error, troubleshooting should begin by identifying the actual bug check parameters rather than applying random fixes. Basic Windows and driver checks can help address common system instability, while WinDbg crash dump analysis provides a more precise way to investigate the underlying failure.

For recurring crashes, preserving the memory dump and obtaining qualified technical assistance is preferable to making unsupported changes to Windows tracing components or system configuration.

Official References

• Microsoft Learn – Bug Check 0x11D: EVENT_TRACING_FATAL_ERROR
• Microsoft Learn – Analyze a Kernel-Mode Dump File by Using WinDbg
• Microsoft Learn – !analyze (WinDbg)
• Microsoft Learn – Kernel-Mode Dump Files
• Microsoft Support – Troubleshooting Windows Unexpected Restarts and Stop Code Errors