How to subscribe to all registered valid event channels?
Yen-Ming Chiu
21
Reputation points
I used EvtOpenChannelEnum to fetch all registered events on the computer, then trying to subscribe to them with EvtSubscribe.
And some of them lead to the error 4201 (The instance name passed was not recognized as valid by a WMI data provider.)
I did filter out those channels which have "/Analytic" and "/Debug" at the end of the name, and those channels are named "Analytic" or "Debug". But it still doesn't work.
Is there have any other limitations with ETW subscriptions?
PS: the following picture shows a part of what I got after fetching and filtering.
Sign in to answer