Share via

NT Kernel Logger max size for CommandLine field

Ori Carmely 6 Reputation points
2022-03-05T17:41:14.297+00:00

Hi :)
I'm using the following commands to trace the command line arguments of sub-processes:

logman start "NT Kernel Logger" -p "Windows Kernel Trace" (process) -o out.etl -ets

//... running main process which I want to trace its sub-process calls...

logman stop "NT Kernel Logger" -ets

I've used both tracerpt and traceview to read the event data, specifically the CommandLine field of the process event.

I'm seeing a behavior where the CommandLine field of process events is capped at 512 character.

00000365 MSNT_SystemTrace 2472 10724 4 0 03\05\2022-13:48:08:671 {"UniqueProcessKey":"0xFFFFA50D2C7EE080","ProcessId":"0x30E8","ParentId":"0x9A8","SessionId":1,"ExitStatus":259,"DirectoryTableBase":"0x1186AD000","Flags":0,"UserSID":"S-1-5-21-1109103017-3393704352-1484820215-1001","ImageFileName":"xxxxxx.exe","CommandLine":"xxxxxx xxxxx/xxx/xxx.x xxxxx/xxxxxxx/xxxxxxx/xxx/xxxxxxxxxxxxxxxxxxx/xxxxxx.x xxxxx/xxxxxxx/xxxxxxx/xxx/xxxxxxxxxxxxxxxxxxx/xxxxxx.x xxxxx/xxxxxxx/xxxxxxx/xxx/xxxxxxxxxxxxxxxxxxx/xxxxxx.x xxxxx/xxxxxxx/xxxxxxx/xxx/xxxxxxxxxxxxxxxxxxx/xxxx.x xxxxx/xxxxxxx/xxxxxxx/xxx/xxxxxxxxxxxxxxxxxxx/xxxx.x xxxxx/xxxxxxx/xxxxxxx/xxx/xxxxxxxxxxxxxxxxxxx/xxxxx.x xxxxx/xxxxxxx/xxxxxxx/xxx/xxxxxxxxxxxxxxxxxxx/xxxxx.x xxxxx/xxxxxxx/xxxxxxx/xxx/xxxxxxxxxxxxxxxxxxx/xxxxxxxx.x xxxxx/xxxxxxx/xxxxxxx/xxx/xxxxxxxxxxxxxxxxxxx/xxxxxx","PackageFullName":"","ApplicationId":"","meta":{"provider":"MSNT_SystemTrace","event":"Start","time":"2022-03-05T13:48:08.671","cpu":4,"pid":2472,"tid":10724,"task":"Process"}}

I'm really not sure what is causing this limit and would be glad for assistance.

Thanks in advance!
Ori

Sysinternals
Sysinternals

Advanced system utilities to manage, troubleshoot, and diagnose Windows and Linux systems and applications.

Windows for business | Windows Client for IT Pros | User experience | Other

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.