1. Enable Host IPS 8.0 debug logging. See KB72869 for details.
2. Download the EtlTrace.zip tool, from the Attachment section of this article, to the affected system running the Host IPS software.
3. Extract the EtlTrace.zip tool to a local directory.
4. Click Start, type cmd.exe in the Search bar, right-click Command Prompt from the list, and select Run as administrator.
5. Navigate to the directory to which you extracted EtlTrace.zip, and run the following command with administrator rights:
    
   EtlTrace.exe -Start
    
   NOTE: Do not restart your computer after the ETL logging has started, because it will interrupt the logging process.
    
6. Reproduce the issue.
7. Return to the command prompt and run the following command:
    
   EtlTrace.exe -Stop
     
8. Collect the EtlTrace.log and Syscore.etl files for Technical Support.

1. Enable Host IPS 8.0 debug logging. See KB72869 for details.
2. Download the EtlTrace.zip tool, from the Attachment section of this article, to the affected system running the Host IPS software.
3. Extract the EtlTrace.zip tool to a local directory.
4. Press Windows+R, type cmd, and click OK.
5. Navigate to the directory to which you extracted EtlTrace.zip and run the following command:
    
   EtlTrace.exe -StartBoot 
     
6. Restart your computer.
7. At the command prompt, run the following command:
    
   EtlTrace.exe -StopBoot
     
8. Collect the EtlTrace.log and Syscore.etl files for Technical Support.

CAUTION: This article contains information about opening or modifying the registry.

• The following information is intended for System Administrators. Registry modifications are irreversible and could cause system failure if done incorrectly.
• Before proceeding, Technical Support strongly recommends that you back up your registry and understand the restore process. For more information, see: http://support.microsoft.com/kb/256986.
• Do not run a REG file that is not confirmed to be a genuine registry import file.

NOTE: For Windows Server 2012 R2 systems, the boot time ETL is limited to 100 KB when using EtlTrace.exe. To remove this limitation, add the following registry keys before rebooting:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\_Syscore_Etl_Trace
(DWORD) BufferSize = 0x20
(DWORD) MaximumBuffers = 0x40