How to Increase Log Size for Event ID 4: Kernel-EventTracing in Windows 11 Have you ever encountered an Event ID 4 error? In this video, we’ll show you how to increase the log size for Kernel Event Tracing ID 4 using two methods to help prevent this error from occurring. Before we begin, be sure to subscribe to NinjaOne's IT Video Hub and our YouTube channel for more tech content like this. Understanding Kernel Event Tracing and Event ID 4 Kernel event tracing records system-level activity for diagnostics and performance analysis. Event ID 4 occurs when an ETW session reaches its maximum file size limit. Once this limit is reached, the session stops logging. If you frequently monitor or troubleshoot systems, increasing the limit helps prevent log truncation and supports extended diagnostics, continuous monitoring, and advanced testing workflows. Increasing Event ID 4 Log Size Using Performance Monitor Prerequisites: To start, you’ll need Windows 11, admin privileges, and the name of the ETW session Performance Monitor Process To start, press Win + R, type perfmon, and press Enter to open Performance Monitor. Next, expand Data Collector Sets > Event Trace Sessions. Look for the triggering session in the Event ID 4 log. Usually, this is named Circular Kernel Context Logger. Right-click on this session and select Properties. Go to the Stop Condition tab and increase the maximum log size. The size will be in MB. Increase the Maximum Size (MB) from the default value, typically 64 MB, to a larger value such as 256 MB or more. Click Apply, then OK. Then, right-click the session again and choose Restart. If the Restart option isn’t available, reboot your PC to apply the new configuration. Increasing Event ID 4 Log Size Using PowerShell The PowerShell method is ideal for enterprise environments managed systems, or automation workflows. Start by opening PowerShell as an administrator. You can verify access with logman by running this command: logman query If the command lists sessions, that means you have sufficient access. Otherwise, it may return an error due to system policy restrictions. Now, assign the target session name to a variable with the command... Use the following command to increase the buffer to 256 MB. You can change the number after -max to your desired value as needed. To apply the changes, stop and restart the session using the command. Verifying the Changes After making the changes, it’s important to confirm that the new log size is active. You can verify this in Performance Monitor by checking the Stop Condition tab for the updated Maximum Size value. For complete step-by-step verification instructions, refer to our blog post for detailed guidance. For more information on Event ID 4 and verifying the changes you made, check out our official blog post on How to Increase Log Size for Event ID 4: Kernel-EventTracing in Windows 11 linked in the description below.