How to subscribe to all registered valid event channels?

Yen-Ming Chiu 21 Reputation points
2021-03-25T08:40:02.403+00:00

I used EvtOpenChannelEnum to fetch all registered events on the computer, then trying to subscribe to them with EvtSubscribe.
And some of them lead to the error 4201 (The instance name passed was not recognized as valid by a WMI data provider.)

I did filter out those channels which have "/Analytic" and "/Debug" at the end of the name, and those channels are named "Analytic" or "Debug". But it still doesn't work.
Is there have any other limitations with ETW subscriptions?

PS: the following picture shows a part of what I got after fetching and filtering.
81492-etw-channels.png

Windows API - Win32
Windows API - Win32
A core set of Windows application programming interfaces (APIs) for desktop and server applications. Previously known as Win32 API.
2,412 questions
C++
C++
A high-level, general-purpose programming language, created as an extension of the C programming language, that has object-oriented, generic, and functional features in addition to facilities for low-level memory manipulation.
3,519 questions