StackEventNameFilters

StackEventNameFilters element specifies event names to include or exclude stackwalk events from a tracelogging provider.

Note

Available on Windows 10, version 1709 and later.

Element Hierarchy

• <WindowsPerformanceRecorder>
  • <Profiles>
    • <EventProvider>
      • <StackEventNameFilters>
    • <Profile>
      • <Collectors>
        • <EventCollectorId>
          • <EventProviders>
            • <EventProvider>
              • <StackEventNameFilters>

Syntax

<StackEventNameFilters FilterIn = "true|false" Operation = "Set|Add|Remove" >

  <!-- Child elements -->
  <EventName>

</StackEventNameFilters>

Attributes and Elements

Attributes

Attribute	Description	Data type	Required	Default
FilterIn	Indicates whether to include or exclude the specified stackwalk events.	boolean	Yes
Level	event level	Unsigned byte	No
Operation	Indicates whether keywords should be set or added.	This attribute can have one of the following values: Set Add Remove	No	Set

Child Elements

Element	Description	Requirement
EventName	A tracelogging event name.	Required, 1 or more.

Parent Elements

Element	Description
EventProvider	Represents an event provider for the profile.

Remark

When stack walking is enabled for a provider, then the stack is captured for all the events generated by the provider. Most of the time, the user is only interested in stack from only certain number of events.

This element allows enabling or disabling stack walking on a list of events based on event IDs.

Even though ETW supports powerful payload and attribute filtering, events should primarily be filtered based scope filters or via level and keyword for less CPU overhead.

Example

    <EventProvider Id="EventProvider_TraceLogGen" Name="*TraceLogGen">
      <StackEventNameFilters FilterIn="true" Level="5">
        <Keyword Value="0x10000000000000"/>
        <EventName Value="Preset1"/>
        <EventName Value="Preset2"/>
      </StackEventNameFilters>
    </EventProvider>

Related topics

Elements