What does HRESULT 0x87C5100D (UTC_E_TRACE_NOT_RUNNING) mean?

UTC_E_TRACE_NOT_RUNNING

Map the code to the scenario graph: trace-session lookup

UTC_E_TRACE_NOT_RUNNING (0x87C5100D) is a Universal Telemetry Client result from the ETW trace-session control layer for this HRESULT. A reliable investigation preserves the producing action before any cleanup runs for this HRESULT. Here the relevant owner is trace-session lookup: a stop, update, flush or collection action could not find the expected running trace for this HRESULT. This is narrower than a generic failure of Connected User Experiences and Telemetry for this HRESULT.

The Universal Telemetry Client controls ETW sessions on behalf of diagnostic scenarios for this HRESULT. ETW sessions have controller-owned names, in-memory buffers, providers, logging modes and lifetimes; a status at this layer should be correlated with the actual session list rather than inferred from the presence of an ETL file for this HRESULT. Record the configuration package or scenario generation together with the Windows build; otherwise a repaired file can be tested against a stale in-memory graph and appear to fail for the same reason for this HRESULT.

Data needed for triage

The AllStat message names the immediate condition as “The trace is not running” for this HRESULT. In practice, the useful extension is to ask whether the request was rejected before any side effect, after partial setup, or during cleanup for this HRESULT. Verify the existence and ownership of the expected output—session, directory, process, result object or emitted event—rather than assuming the message describes the final system state for this HRESULT.

Reproduce without collateral changes

1. Export the relevant Microsoft-Windows-UniversalTelemetryClient/Operational events and preserve their ActivityId or request correlation alongside this result.
2. Capture expected session name/GUID, ETW session enumeration, controller lifetime, prior stop result and service restart history for this HRESULT. Do this before restarting the service or deleting any working directory for this HRESULT.
3. Perform this one-variable comparison: start the named profile, verify it in the session list, and repeat the exact operation for this HRESULT.
4. After the comparison, record the next HRESULT and whether the requested session, action, trigger or output object was actually created for this HRESULT.

The most informative neighbor is UTC_E_AOT_NOT_RUNNING. The distinction is concrete: UTC_E_AOT_NOT_RUNNING is specific to the always-on trace for this HRESULT. Keeping both symbolic names in logs prevents a broad “DiagTrack error” bucket from hiding whether the failure occurred during parsing, authorization, resource acquisition, execution or teardown for this HRESULT.

Trace-session note

Use an ETW controller view to list session name, GUID, mode, buffers and enabled providers while this result is active. The presence of an ETL file from an earlier run is not proof that the required in-memory session currently exists or is owned by UTC for this HRESULT.

Fix the contract

Fix session ownership and ordering; never treat an unrelated ETW session as the missing trace for this HRESULT. Apply that change only to the owning boundary for this HRESULT. A successful repair must make the controlled case cross this boundary while retaining the intended policy, trace providers, destination and security context for this HRESULT.

Restarting Windows, clearing every ETL file or disabling diagnostic policy is not a justified first response to this result. Those actions destroy evidence and can change several independent UTC gates at once for this HRESULT.

• the same request now produces its documented success or nonfatal status without a second hidden retry
• the operational log shows one coherent request lifetime and no orphaned action, timer, process or trace session
• teardown followed by a second run does not reuse stale state or recreate trace-session lookup
• the nearby condition remains distinguishable: UTC_E_AOT_NOT_RUNNING is specific to the always-on trace

Technical references

• Microsoft Open Specifications: Windows error-code registry — reference for ETW trace-session control while interpreting this result.
• Microsoft: Universal Telemetry Client configuration diagnosis — reference for ETW trace-session control while interpreting it.
• Microsoft: Event Tracing for Windows
• Microsoft: WPR and ETW sessions

Looking for a different code? Search another status or error code.