NT Kernel Logger max size for CommandLine field

Ori Carmely 6 Reputation points
2022-03-05T17:41:14.297+00:00

Hi :)
I'm using the following commands to trace the command line arguments of sub-processes: 

logman start "NT Kernel Logger" -p "Windows Kernel Trace" (process) -o out.etl -ets

//... running main process which I want to trace its sub-process calls...

logman stop "NT Kernel Logger" -ets

I've used both tracerpt and traceview to read the event data, specifically the CommandLine field of the process event.

I'm seeing a behavior where the CommandLine field of process events is capped at 512 character.

00000365 MSNT_SystemTrace 2472 10724 4 0 03\05\2022-13:48:08:671 {"UniqueProcessKey":"0xFFFFA50D2C7EE080","ProcessId":"0x30E8","ParentId":"0x9A8","SessionId":1,"ExitStatus":259,"DirectoryTableBase":"0x1186AD000","Flags":0,"UserSID":"S-1-5-21-1109103017-3393704352-1484820215-1001","ImageFileName":"xxxxxx.exe","CommandLine":"xxxxxx xxxxx/xxx/xxx.x xxxxx/xxxxxxx/xxxxxxx/xxx/xxxxxxxxxxxxxxxxxxx/xxxxxx.x xxxxx/xxxxxxx/xxxxxxx/xxx/xxxxxxxxxxxxxxxxxxx/xxxxxx.x xxxxx/xxxxxxx/xxxxxxx/xxx/xxxxxxxxxxxxxxxxxxx/xxxxxx.x xxxxx/xxxxxxx/xxxxxxx/xxx/xxxxxxxxxxxxxxxxxxx/xxxx.x xxxxx/xxxxxxx/xxxxxxx/xxx/xxxxxxxxxxxxxxxxxxx/xxxx.x xxxxx/xxxxxxx/xxxxxxx/xxx/xxxxxxxxxxxxxxxxxxx/xxxxx.x xxxxx/xxxxxxx/xxxxxxx/xxx/xxxxxxxxxxxxxxxxxxx/xxxxx.x xxxxx/xxxxxxx/xxxxxxx/xxx/xxxxxxxxxxxxxxxxxxx/xxxxxxxx.x xxxxx/xxxxxxx/xxxxxxx/xxx/xxxxxxxxxxxxxxxxxxx/xxxxxx","PackageFullName":"","ApplicationId":"","meta":{"provider":"MSNT_SystemTrace","event":"Start","time":"2022-03-05T13:48:08.671","cpu":4,"pid":2472,"tid":10724,"task":"Process"}}

I'm really not sure what is causing this limit and would be glad for assistance.

Thanks in advance!
Ori

Windows 10
Windows 10
A Microsoft operating system that runs on personal computers and tablets.
10,617 questions
Sysinternals
Sysinternals
Advanced system utilities to manage, troubleshoot, and diagnose Windows and Linux systems and applications.
1,087 questions