There are four main types of providers: MOF (classic) providers, WPP providers, manifest-based providers, and TraceLogging providers. This lets you add event tracing to your application without requiring that it generate events all the time.Īlthough the ETW model separates the controller and provider into separate applications, an application can include both components.įor more information, see Providing Events. Generally, an enabled provider generates events, while a disabled provider does not. The provider defines its interpretation of being enabled or disabled. After a provider registers itself, a controller can then enable or disable event tracing in the provider. Providers are applications that contain event tracing instrumentation.
Session statistics include the number of buffers used, the number of buffers delivered, and the number of events and buffers lost.įor more information, see Controlling Event Tracing Sessions. The following diagram shows the event tracing model.Ĭontrollers are applications that define the size and location of the log file, start and stop event tracing sessions, enable providers so they can log events to the session, manage the size of the buffer pool, and obtain execution statistics for sessions.
Controllers, which start and stop an event tracing session and enable providers.The Event Tracing API is broken into three distinct components:
You can consume the events in real time or from a log file and use them to debug an application or to determine where performance issues are occurring in the application.ĮTW lets you enable or disable event tracing dynamically, allowing you to perform detailed tracing in a production environment without requiring computer or application restarts.
#Win32 forms datagraph windows#
Event Tracing for Windows (ETW) is an efficient kernel-level tracing facility that lets you log kernel or application-defined events to a log file.
0 kommentar(er)
