New event viewer warning

Question

New event viewer warning

Xander Warren 70

Ever since around the time I got Malwarebytes because defender would crash when scanning (that's fixed now) I've noticed a new warning from Kernel-EventTracing its evnet ID 1 with the description "The backing-file for the real-time session "DefenderApiLogger" has reached its maximum size. As a result, new events will not be logged to this session until space becomes available. This error is often caused by starting a trace session in real-time mode without having any real-time consumers."

Not sure if this is something that needs to be fixed or if it can be ignored. Haven't noticed any system weirdness or slowdowns or anything wrong with defender. So I guess the question is, is this normal windows 11 behavior? If not is it normal if using another antivirus like Malwarebytes as my main antivirus and have defender running in a passive mode.

0 comments

Answer accepted by question author

Clary-N 15,730 Microsoft External Staff Moderator

Hi Xander Warren,

Based on the information you've provided and the AI Answer, I would not be concerned about this warning by itself.

The Kernel-EventTracing, Event ID 1 entry for DefenderApiLogger generally indicates that the trace session reached its configured log size limit and temporarily stopped recording additional events. This is typically considered a logging-related notification rather than an indication that Microsoft Defender or Windows security has failed.

Since you've mentioned that Defender is no longer crashing during scans, Windows is otherwise stable and you're not experiencing performance issues or security-related symptoms, this warning alone would not normally require any corrective action.

It's also worth noting that if you're using Malwarebytes as your primary antivirus, Microsoft Defender may continue to run certain background components and logging services even when it is operating in a passive or limited role. In that scenario, occasional DefenderApiLogger warnings are not necessarily unexpected.

The main thing I would watch for is whether you begin seeing Microsoft Defender errors, such as Event ID 5008 or if Windows Security starts reporting protection issues. If neither of those is occurring, I'd be inclined to treat this as an informational Event Viewer entry and simply monitor it rather than attempt to fix it.

I hope this helps clarify what you're seeing. If you have any other questions, please let me know.

If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Xander Warren 70 Reputation points

2026-08-31T05:59:53.7266667+00:00

The reason I'm asking about this is because I've never had this error in my long history with my pc (5+ years) and is only now being shown/happening when I swapped to another antivirus.

Could defender being in a more passive state make it so it doesn't free/rotate its storage? If that's the case it would explain this but I can't find anything related to it.
Clary-N 15,730 Reputation points Microsoft External Staff Moderator

2026-08-31T08:39:31.22+00:00

Hi Xander Warren,

That timing could still be related to installing Malwarebytes, but I could not find Microsoft documentation confirming that Defender in a passive or limited state stops freeing or rotating the DefenderApiLogger trace file.

On Windows 11, if a third-party antivirus is registered as the primary provider, Microsoft Defender Antivirus normally moves to disabled mode on a device that is not onboarded to Microsoft Defender for Endpoint. One exception is when Smart App Control is enabled, in which case Defender may appear in passive mode, although Microsoft notes that this differs from the passive mode used with Microsoft Defender for Endpoint.

Therefore, the antivirus change may explain why the warning started appearing, but the event alone does not establish that Defender failed to rotate or release its logging storage. It only indicates that the DefenderApiLogger trace session reached its configured maximum file size.

Since Defender is no longer crashing during scans and Windows Security is not reporting a protection issue, I would continue monitoring rather than modify the trace settings. To clarify the current configuration, could you check Windows Security > Virus & threat protection > Who’s protecting me? > Manage providers and confirm which antivirus is listed as active? Also, does the warning return after every restart or only occasionally?
Clary-N 15,730 Reputation points Microsoft External Staff Moderator

2026-09-01T08:29:03.07+00:00

Hi Xander Warren,

May I know if you have got any chance to check my answer?

I am glad to help if you have any other questions.
Xander Warren 70 Reputation points

2026-09-02T23:06:03.5666667+00:00

I have somewhat confirmed my suspicion, my free trial ended yesterday so I swapped to defender being the main antivirus so Malwarebytes wasn't integrating into defender and the events stopped
Clary-N 15,730 Reputation points Microsoft External Staff Moderator

2026-09-04T05:14:05.3066667+00:00

Hi Xander Warren,

Thanks for the update. That does seem to support the idea that the warnings were related to Malwarebytes being the active antivirus provider rather than a problem with Defender itself.

Since the events stopped after Defender resumed as the primary antivirus and there are no other protection issues, I'd simply continue monitoring for now. If the warnings remain gone through a few restarts and normal use, that would be a good sign that the issue has resolved itself.

I appreciate you sharing the results and please let me know if the warnings return later. I'll happy to assist further.

Best regards.

1 additional answer

Your answer

Xander Warren 70 Reputation points

2026-08-31T05:59:53.7266667+00:00

The reason I'm asking about this is because I've never had this error in my long history with my pc (5+ years) and is only now being shown/happening when I swapped to another antivirus.

Could defender being in a more passive state make it so it doesn't free/rotate its storage? If that's the case it would explain this but I can't find anything related to it.
Clary-N 15,730 Reputation points Microsoft External Staff Moderator

2026-08-31T08:39:31.22+00:00

Hi Xander Warren,

That timing could still be related to installing Malwarebytes, but I could not find Microsoft documentation confirming that Defender in a passive or limited state stops freeing or rotating the DefenderApiLogger trace file.

On Windows 11, if a third-party antivirus is registered as the primary provider, Microsoft Defender Antivirus normally moves to disabled mode on a device that is not onboarded to Microsoft Defender for Endpoint. One exception is when Smart App Control is enabled, in which case Defender may appear in passive mode, although Microsoft notes that this differs from the passive mode used with Microsoft Defender for Endpoint.

Therefore, the antivirus change may explain why the warning started appearing, but the event alone does not establish that Defender failed to rotate or release its logging storage. It only indicates that the DefenderApiLogger trace session reached its configured maximum file size.

Since Defender is no longer crashing during scans and Windows Security is not reporting a protection issue, I would continue monitoring rather than modify the trace settings. To clarify the current configuration, could you check Windows Security > Virus & threat protection > Who’s protecting me? > Manage providers and confirm which antivirus is listed as active? Also, does the warning return after every restart or only occasionally?
Clary-N 15,730 Reputation points Microsoft External Staff Moderator

2026-09-01T08:29:03.07+00:00

Hi Xander Warren,

May I know if you have got any chance to check my answer?

I am glad to help if you have any other questions.
Xander Warren 70 Reputation points

2026-09-02T23:06:03.5666667+00:00

I have somewhat confirmed my suspicion, my free trial ended yesterday so I swapped to defender being the main antivirus so Malwarebytes wasn't integrating into defender and the events stopped
Clary-N 15,730 Reputation points Microsoft External Staff Moderator

2026-09-04T05:14:05.3066667+00:00

Hi Xander Warren,

Thanks for the update. That does seem to support the idea that the warnings were related to Malwarebytes being the active antivirus provider rather than a problem with Defender itself.

Since the events stopped after Defender resumed as the primary antivirus and there are no other protection issues, I'd simply continue monitoring for now. If the warnings remain gone through a few restarts and normal use, that would be a good sign that the issue has resolved itself.

I appreciate you sharing the results and please let me know if the warnings return later. I'll happy to assist further.

Best regards.

Answer 1

This warning can usually be ignored in this scenario.

For Defender-related Event ID 1 in the System log, the documented meaning is that the backing file for a real-time session reached its maximum size, so new events stop being logged until space becomes available. The documented action for that event is Normal operating notification; no action required.

To verify it:

Open Event Viewer.
Open Windows Logs > System.
Find Kernel-EventTracing with Event ID 1.

If the system is otherwise stable and Microsoft Defender is working normally, this event by itself does not indicate a Defender failure.

A separate Defender event to watch for is Event ID 5008, which means the antimalware engine encountered an error and failed. If that appears again, the documented troubleshooting is to restart the service from an elevated command prompt:

net stop msmpsvc
net start msmpsvc

Note: restarting security services is a system-level action. Save work first and use it only if Event ID 5008 is actually occurring again.

References: