Check out the codes in GitHub.
Getting the logs
Now that I have my modules spitting out logs for me, it’s time to actually consume (or view) them. Most of the time, I use
MFTrace is primarily a tool for generating logs for Media Foundation apps, it is a great tool for viewing ETW logs in general as well. It is included in the MS SDK.
To view logs in real time, I use this command in either Powershell or command line:
To stop the trace collection, press
logman is a very powerful builtin performance counter and event trace log tool from Microsoft. For more information, have a look at here.
You can use
logman as alternative to
Collecting ETW traces from test/production systems
To collect ETW trace logs from test/production systems, manifest file and message/resource file need not be registered.
c:\output.etl is just an example. You can use any location and any filename as long as the extension is .etl. The output .etl file can only be read on a system where the manifest file and the resource/message file are registered. To read the traces:
The default readable output file that contains all the trace information will be
summary.txt file will also be generated. For more information about
tracerpt, have a look at here.
Check out part 5.---
If you have any questions or feedback, please reach out @flowerinthenyt.
This work is licensed under a Creative Commons Attribution 4.0 International License.