2.2.11 Trace Provider using Filter Data

Trace providers, once created, can be controlled using the methods provided by the ITraceDataProvider interface of the PLA protocol. A particular focus is given to modifying provider behavior through the use of keywords, levels, and filter data.

The tracing subsystem ETW is used by applications and drivers to log state information for diagnostic or performance analysis. A trace provider is a logical entity which groups events that are raised by an application or the system; in effect, the provider serves as the owner of the event, and allows analysis tools to quickly ascertain which component raised the event. A trace provider is uniquely identified by a PLA-UID. An example using pseudo-code is available in section 4.1.