OK, I finally got one... but there was only 1 journal log entry. The previous time there were like maybe 10 (also very little), but the 2 times before that had enough for me to have to page through the log. I actually messed up on a variable in my script so missed the actual time, but the trace still encompassed entries around the log entry time when I copied it manually. I fixed the script, tested it and have it running again for the next time. GZip compressed the 1GB trace down to 43MB, but PLZip got it down to 19.5MB: https://1drv.ms/f/s!AkkOvekTOCrYn0kEFtJzreV7gCTD All 3 files are from the same trace, but wanted to give you options in case you didn't have plzip. The journal entry (time): [501180.585516] computername kernel: xhci_hcd 0000:00:14.0: ERROR unknown event type 37 On Wed, Jan 2, 2019 at 5:32 AM Mathias Nyman <mathias.nyman@xxxxxxxxxxxxxxx> wrote: > > The event type 37 is a host controller event, most likely a event ring full error. > > So there are probably so many events that we fill the event ring before we can handle them. > > Could you take traces of this? > Note that the trace file will be huge. > > mount -t debugfs none /sys/kernel/debug > echo 81920 > /sys/kernel/debug/tracing/buffer_size_kb > echo 1 > /sys/kernel/debug/tracing/events/xhci-hcd/enable > > copy the traces somewhere safe once the error is triggered: > cp /sys/kernel/debug/tracing/trace /<somewhere> > > -Mathias
