| Previous | Next |
| UTC_E_ALTERNATIVE_TRACE_CANNOT_PREEMPT | UTC_E_SCRIPT_TYPE_INVALID |
UTC_E_AOT_NOT_RUNNING
Identify the owning component: always-on trace controller
The code UTC_E_AOT_NOT_RUNNING (0x87C51003) belongs to ETW trace-session control, inside the Universal Telemetry Client/DiagTrack workflow for it. This result becomes useful only after it is tied to one request generation for it. It identifies always-on trace controller and reports that an operation assumed that the configured always-on trace had an active ETW session, but no such session was running; it does not by itself prove that all Windows diagnostic data collection is unavailable for it.
The Universal Telemetry Client controls ETW sessions on behalf of diagnostic scenarios for it. ETW sessions have controller-owned names, in-memory buffers, providers, logging modes and lifetimes; a status at this layer should be correlated with the actual session list rather than inferred from the presence of an ETL file for it. Record the configuration package or scenario generation together with the Windows build; otherwise a repaired file can be tested against a stale in-memory graph and appear to fail for the same reason for it.
What to capture before retrying
| UTC diagnostic field | Value |
|---|---|
| Producing layer | ETW trace-session control |
| Owning state or object | always-on trace controller |
| Decisive evidence | AutoLogger configuration, service state, ETW session list, boot sequence and first UTC operational events |
| Narrow comparison | restart only the responsible service or boot-time trace configuration and verify whether the expected session appears |
| Do not confuse with | UTC_E_TRACERS_DONT_EXIST means tracer objects were never initialized, not merely that the always-on session stopped |
The AllStat message names the immediate condition as “The always-on-trace is not running” for it. In practice, the useful extension is to ask whether the request was rejected before any side effect, after partial setup, or during cleanup for it. Verify the existence and ownership of the expected output—session, directory, process, result object or emitted event—rather than assuming the message describes the final system state for it.
Prove the boundary
- Associate this result with one request, one scenario version and one service process ID for it.
- Save AutoLogger configuration, service state, ETW session list, boot sequence and first UTC operational events and the first lower-level HRESULT if one exists for it.
- Change no policy, provider set or destination except for this test: restart only the responsible service or boot-time trace configuration and verify whether the expected session appears for it.
- Compare the produced artifacts and operational events, not only the top-level return Value.
The most informative neighbor is UTC_E_TRACERS_DONT_EXIST. The distinction is concrete: UTC_E_TRACERS_DONT_EXIST means tracer objects were never initialized, not merely that the always-on session stopped for it. Keeping both symbolic names in logs prevents a broad “DiagTrack error” bucket from hiding whether the failure occurred during parsing, authorization, resource acquisition, execution or teardown for it.
Trace-session note
Use an ETW controller view to list session name, GUID, mode, buffers and enabled providers while this result is active. The presence of an ETL file from an earlier run is not proof that the required in-memory session currently exists or is owned by UTC for it.
Confirm the repair
Repair the AutoLogger or service startup path before retrying the dependent action; do not fabricate an ETL file for it. Apply that change only to the owning boundary for it. A successful repair must make the controlled case cross this boundary while retaining the intended policy, trace providers, destination and security context for it.
Do not treat this result as permission to bypass collection policy, script approval, path restrictions or trace arbitration for it. A repair that only weakens those controls is not a valid regression result for it.
- the same request now produces its documented success or nonfatal status without a second hidden retry
- the operational log shows one coherent request lifetime and no orphaned action, timer, process or trace session
- teardown followed by a second run does not reuse stale state or recreate always-on trace controller
- the nearby condition remains distinguishable: UTC_E_TRACERS_DONT_EXIST means tracer objects were never initialized, not merely that the always-on session stopped
Technical references
- Microsoft Open Specifications: Windows error-code registry — reference for ETW trace-session control while interpreting it.
- Microsoft: Universal Telemetry Client configuration diagnosis
- Microsoft: Event Tracing for Windows
- Microsoft: WPR and ETW sessions
Looking for a different code? Search another status or error code.