< Back
Add-EtwTraceProvider
Post
NAME Add-EtwTraceProvider
SYNOPSIS
Adds an ETW trace provider to an ETW Autologger configuration or ETW session.
SYNTAX
Add-EtwTraceProvider [-Guid] <String> [-CimSession <CimSession[]>] [-Level <Byte>] [-MatchAllKeyword <UInt64>] [-MatchAnyKeyword <UInt64>]
[-Property <UInt32>] [-ThrottleLimit <Int32>] -AutologgerName <String> [<CommonParameters>]
Add-EtwTraceProvider [-Guid] <String> [-CimSession <CimSession[]>] [-Level <Byte>] [-MatchAllKeyword <UInt64>] [-MatchAnyKeyword <UInt64>]
[-Property <UInt32>] [-ThrottleLimit <Int32>] -SessionName <String> [<CommonParameters>]
DESCRIPTION
The Add-EtwTraceProvider cmdlet adds an Event Trace for Windows (ETW) trace provider to an ETW Autologger configuration or to an ETW session.
PARAMETERS
-AutologgerName <String>
Specifies an ETW Autologger configuration. If you specify this parameter, do not specify the SessionName parameter.
Required? true
Position? named
Default value none
Accept pipeline input? false
Accept wildcard characters? false
-CimSession [<CimSession[]>]
Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a New-CimSession
or Get-CimSession cmdlet. The default is the current session on the local computer.
Required? false
Position? named
Default value none
Accept pipeline input? false
Accept wildcard characters? false
-Guid <String>
Specifies the GUID, as a string, of the ETW trace provider that this cmdlet adds to an ETW Autologger configuration or to an ETW session.
Required? true
Position? 1
Default value none
Accept pipeline input? false
Accept wildcard characters? false
-Level [<Byte>]
Specifies the provider-defined value that specifies the level of detail included in the event. If you specify a value, that value entails all
the values that have a lower value. For instance, if you specify a value of 3, for TRACE_LEVEL_WARNING, TRACE_LEVEL_ERROR and
TRACE_LEVEL_CRITICAL events are also included. Valid values are:
-- 1: TRACE_LEVEL_CRITICAL. Abnormal exit or termination events.
-- 2: TRACE_LEVEL_ERROR. Severe error events.
-- 3: TRACE_LEVEL_WARNING. Warning events such as allocation failures.
-- 4: TRACE_LEVEL_INFORMATION. Non-error events such as entry or exit events.
-- 5: TRACE_LEVEL_VERBOSE. Detailed trace events.
Required? false
Position? named
Default value none
Accept pipeline input? false
Accept wildcard characters? false
-MatchAllKeyword [<UInt64>]
Specifies keywords, as a bitmask, that further restricts the category of events that the provider writes. If an event keyword meets the
conditions specified by the MatchAnyKeyword parameter, the provider writes the event only if all of the bits specified by this parameter exist
in the event keyword. Do not specify this parameter if you specify a value of zero for MatchAnyKeyword. Use the following format:
0x0000000000000001.
Required? false
Position? named
Default value none
Accept pipeline input? false
Accept wildcard characters? false
-MatchAnyKeyword [<UInt64>]
Specifies keywords, as a bitmask, that determine the category of events that the provider writes. The provider writes the event if any of the
keyword bits match any of the bits set in this mask. Use the following format: 0x0000000000000001.
Required? false
Position? named
Default value none
Accept pipeline input? false
Accept wildcard characters? false
-Property [<UInt32>]
Specifies a bitmask that determines whether to include one or more of the following items in the log file:
-- 0x00000001. The user security identifier
-- 0x00000002. The terminal session identifier
Required? false
Position? named
Default value none
Accept pipeline input? false
Accept wildcard characters? false
-SessionName <String>
Specifies the name of the ETW session to which this cmdlet adds the ETW trace provider. If you specify this parameter, do not specify
AutologgerName parameter.
Required? true
Position? named
Default value none
Accept pipeline input? false
Accept wildcard characters? false
-ThrottleLimit [<Int32>]
Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of
zero is entered, then Windows PowerShell???? calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are
running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.
Required? false
Position? named
Default value none
Accept pipeline input? false
Accept wildcard characters? false
<CommonParameters>
This cmdlet supports the common parameters: Verbose, Debug,
ErrorAction, ErrorVariable, WarningAction, WarningVariable,
OutBuffer, PipelineVariable, and OutVariable. For more information, see
about_CommonParameters (http://go.microsoft.com/fwlink/?LinkID=113216).
INPUTS
OUTPUTS
Example 1: Add an ETW trace provider to an Autologger configuration
PS C:\\>Add-EtwTraceProvider -Guid "{5EEFEBDB-E90C-423A-8ABF-0241E7C5B87D}" -AutologgerName "WFP-IPsec Trace"
SessionName :
AutologgerName : WFP-IPsec Trace
Guid : {5EEFEBDB-E90C-423A-8ABF-0241E7C5B87D}
Level : 0
MatchAnyKeyword : 0x0
MatchAllKeyword : 0x0
Property : 0
This command adds the ETW trace provider that has the specified GUID to an Autologger configuration named WFP-IPsec Trace.
Example 2: Add an ETW trace provider to an ETW session
PS C:\\>Add-EtwTraceProvider -Guid "{5EEFEBDB-E90C-423A-8ABF-0241E7C5B87D}" -SessionName "VMM"
SessionName : VMM
AutologgerName :
Guid : {5EEFEBDB-E90C-423A-8ABF-0241E7C5B87D}
Level : 0
MatchAnyKeyword : 0x0
MatchAllKeyword : 0x0
Property : 0
This command adds the ETW trace provider that has the specified GUID to an session named VMM.
RELATED LINKS
Configuring and Starting an AutoLogger Session
Configuring and Starting an Event Tracing Session
Get-EtwTraceProvider
Remove-EtwTraceProvider
Set-EtwTraceProvider
SYNOPSIS
Adds an ETW trace provider to an ETW Autologger configuration or ETW session.
SYNTAX
Add-EtwTraceProvider [-Guid] <String> [-CimSession <CimSession[]>] [-Level <Byte>] [-MatchAllKeyword <UInt64>] [-MatchAnyKeyword <UInt64>]
[-Property <UInt32>] [-ThrottleLimit <Int32>] -AutologgerName <String> [<CommonParameters>]
Add-EtwTraceProvider [-Guid] <String> [-CimSession <CimSession[]>] [-Level <Byte>] [-MatchAllKeyword <UInt64>] [-MatchAnyKeyword <UInt64>]
[-Property <UInt32>] [-ThrottleLimit <Int32>] -SessionName <String> [<CommonParameters>]
DESCRIPTION
The Add-EtwTraceProvider cmdlet adds an Event Trace for Windows (ETW) trace provider to an ETW Autologger configuration or to an ETW session.
PARAMETERS
-AutologgerName <String>
Specifies an ETW Autologger configuration. If you specify this parameter, do not specify the SessionName parameter.
Required? true
Position? named
Default value none
Accept pipeline input? false
Accept wildcard characters? false
-CimSession [<CimSession[]>]
Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a New-CimSession
or Get-CimSession cmdlet. The default is the current session on the local computer.
Required? false
Position? named
Default value none
Accept pipeline input? false
Accept wildcard characters? false
-Guid <String>
Specifies the GUID, as a string, of the ETW trace provider that this cmdlet adds to an ETW Autologger configuration or to an ETW session.
Required? true
Position? 1
Default value none
Accept pipeline input? false
Accept wildcard characters? false
-Level [<Byte>]
Specifies the provider-defined value that specifies the level of detail included in the event. If you specify a value, that value entails all
the values that have a lower value. For instance, if you specify a value of 3, for TRACE_LEVEL_WARNING, TRACE_LEVEL_ERROR and
TRACE_LEVEL_CRITICAL events are also included. Valid values are:
-- 1: TRACE_LEVEL_CRITICAL. Abnormal exit or termination events.
-- 2: TRACE_LEVEL_ERROR. Severe error events.
-- 3: TRACE_LEVEL_WARNING. Warning events such as allocation failures.
-- 4: TRACE_LEVEL_INFORMATION. Non-error events such as entry or exit events.
-- 5: TRACE_LEVEL_VERBOSE. Detailed trace events.
Required? false
Position? named
Default value none
Accept pipeline input? false
Accept wildcard characters? false
-MatchAllKeyword [<UInt64>]
Specifies keywords, as a bitmask, that further restricts the category of events that the provider writes. If an event keyword meets the
conditions specified by the MatchAnyKeyword parameter, the provider writes the event only if all of the bits specified by this parameter exist
in the event keyword. Do not specify this parameter if you specify a value of zero for MatchAnyKeyword. Use the following format:
0x0000000000000001.
Required? false
Position? named
Default value none
Accept pipeline input? false
Accept wildcard characters? false
-MatchAnyKeyword [<UInt64>]
Specifies keywords, as a bitmask, that determine the category of events that the provider writes. The provider writes the event if any of the
keyword bits match any of the bits set in this mask. Use the following format: 0x0000000000000001.
Required? false
Position? named
Default value none
Accept pipeline input? false
Accept wildcard characters? false
-Property [<UInt32>]
Specifies a bitmask that determines whether to include one or more of the following items in the log file:
-- 0x00000001. The user security identifier
-- 0x00000002. The terminal session identifier
Required? false
Position? named
Default value none
Accept pipeline input? false
Accept wildcard characters? false
-SessionName <String>
Specifies the name of the ETW session to which this cmdlet adds the ETW trace provider. If you specify this parameter, do not specify
AutologgerName parameter.
Required? true
Position? named
Default value none
Accept pipeline input? false
Accept wildcard characters? false
-ThrottleLimit [<Int32>]
Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of
zero is entered, then Windows PowerShell???? calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are
running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.
Required? false
Position? named
Default value none
Accept pipeline input? false
Accept wildcard characters? false
<CommonParameters>
This cmdlet supports the common parameters: Verbose, Debug,
ErrorAction, ErrorVariable, WarningAction, WarningVariable,
OutBuffer, PipelineVariable, and OutVariable. For more information, see
about_CommonParameters (http://go.microsoft.com/fwlink/?LinkID=113216).
INPUTS
OUTPUTS
Example 1: Add an ETW trace provider to an Autologger configuration
PS C:\\>Add-EtwTraceProvider -Guid "{5EEFEBDB-E90C-423A-8ABF-0241E7C5B87D}" -AutologgerName "WFP-IPsec Trace"
SessionName :
AutologgerName : WFP-IPsec Trace
Guid : {5EEFEBDB-E90C-423A-8ABF-0241E7C5B87D}
Level : 0
MatchAnyKeyword : 0x0
MatchAllKeyword : 0x0
Property : 0
This command adds the ETW trace provider that has the specified GUID to an Autologger configuration named WFP-IPsec Trace.
Example 2: Add an ETW trace provider to an ETW session
PS C:\\>Add-EtwTraceProvider -Guid "{5EEFEBDB-E90C-423A-8ABF-0241E7C5B87D}" -SessionName "VMM"
SessionName : VMM
AutologgerName :
Guid : {5EEFEBDB-E90C-423A-8ABF-0241E7C5B87D}
Level : 0
MatchAnyKeyword : 0x0
MatchAllKeyword : 0x0
Property : 0
This command adds the ETW trace provider that has the specified GUID to an session named VMM.
RELATED LINKS
Configuring and Starting an AutoLogger Session
Configuring and Starting an Event Tracing Session
Get-EtwTraceProvider
Remove-EtwTraceProvider
Set-EtwTraceProvider