Edit

Share via

Start-SbecSimpleLogSession

Module:
BootEventCollector Module

Starts a log session with the forwarding of events to the Collector.

Syntax

Default (Default) 

Start-SbecSimpleLogSession
    [-Name] <String>
    [[-SessionGuid] <Guid>]
    [[-ProviderName] <String[]>]
    [[-ProviderGuid] <Guid[]>]
    [[-Level] <SeverityLevel>]
    [[-ClockType] <ClientContext>]
    [[-BufferSize] <UInt32>]
    [[-MinimumBufferCount] <UInt32>]
    [[-MaximumBufferCount] <UInt32>]
    [[-FlushSeconds] <UInt32>]
    [[-LogFileMode] <LoggingMode>]
    [[-KernelEnableFlags] <EventTraceFlag>]
    [-PassThru]
    [<CommonParameters>]

Description

The Start-SbecSimpleLogSession cmdlet starts a log session in boot event mode with a simpler subset of parameters.

To start a log session with more parameters, use Start-SbecLogSession.

Parameters

-BufferSize

Specifies the buffer size for the session, in kilobytes. This is the size of one buffer, with the count of these buffers set by the MinimumBufferCount and MaximumBufferCount parameters.

Parameter properties

Type:UInt32
Default value:None
Supports wildcards:False
DontShow:False

Parameter sets

(All)
Position:6
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-ClockType

Specifies the type of clock used for the events collected by this session: The acceptable values for this parameter are:

  • Default.
  • QueryPerformanceCounter. The high-resolution (period of 100 nanoseconds) clock that is typically used for performance measurement.
  • SystemTime. The lower-resolution system time similar to FILETIME (period of 10 milliseconds). This value is most typical for the data collection through SBEC.
  • CpuCycleCounter. The highest-resolution, with the frequency of the CPU, but may be unreliable depending on the CPU model and the thermal and power modes.

Parameter properties

Type:ClientContext
Default value:None
Accepted values:Default, QueryPerformanceCounter, SystemTime, CpuCycleCounter
Supports wildcards:False
DontShow:False

Parameter sets

(All)
Position:5
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-FlushSeconds

Specifies the timeout, in seconds, for the session buffers to automatically flush. You can disable the flushing of buffers on timeout by setting this parameter to 0, then the buffers will be written only when full or on an explicit flush.

Parameter properties

Type:UInt32
Default value:None
Supports wildcards:False
DontShow:False
Aliases:FlushTimer

Parameter sets

(All)
Position:9
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-KernelEnableFlags

Specifies flags for the NT Kernel Logger that enable the kernel events. For the setup and boot monitoring, the only reasonable flag is Process. This enumeration type is defined in $PsHome\Modules\BootEventCollector\SbecTraceHelpers.psm1. The acceptable values for this parameter are:

  • None
  • Process
  • Thread
  • ImageLoad
  • ProcessCounters
  • ContextSwitch
  • Dpc
  • Interrupt
  • SystemCall
  • DiskIO
  • DiskFileIO
  • DiskIOInit
  • Dispatcher
  • MemoryPageFaults
  • MemoryHardFaults
  • VirtualAlloc
  • NetworkTCPIP
  • Registry
  • Alpc
  • SplitIO
  • Driver
  • FileIO
  • FileIOInit
  • Profile

Parameter properties

Type:EventTraceFlag
Default value:None
Accepted values:None, Process, Thread, ImageLoad, ProcessCounters, ContextSwitch, Dpc, Interrupt, SystemCall, DiskIO, DiskFileIO, DiskIOInit, Dispatcher, MemoryPageFaults, MemoryHardFaults, VirtualAlloc, NetworkTCPIP, Registry, Alpc, SplitIO, Driver, FileIO, FileIOInit, Profile
Supports wildcards:False
DontShow:False

Parameter sets

(All)
Position:11
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-Level

Specifies the highest detail level value to enable for providers. This enumeration type is defined in $PsHome\Modules\BootEventCollector\SbecTraceHelpers.psm1. The acceptable values for this parameter are:

  • Undefined
  • Fatal
  • Error
  • Warning
  • Information
  • Verbose
  • All

Parameter properties

Type:SeverityLevel
Default value:None
Accepted values:Undefined, Fatal, Error, Warning, Information, Verbose, All
Supports wildcards:False
DontShow:False

Parameter sets

(All)
Position:4
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-LogFileMode

Specifies the new flags for the log file mode. The EnableKd and DisableKd values parameters are applied on top of these flags. This enumeration type is defined in $PsHome\Modules\BootEventCollector\SbecTraceHelpers.psm1. The cmdlet automatically adds the RealTime and KdFilter values to this parameter. Other frequently used flags for this context are:

  • Secure. Restricts who can log events to the session to those with TRACELOG_LOG_EVENT permission.
  • UsePagedMemory. Use the paged memory for the buffers.
  • NoPerProcessorBuffering. Write the events from all processors to the same buffer. This preserves the order of the events, and is recommended for sending the events to the event collector.

The acceptable values for this parameter are:

  • None
  • FileNone
  • FileSequential
  • FileCircular
  • FileAppend
  • FileNewFile
  • Reserved0x00000010
  • FilePreallocate
  • Nonstoppable
  • Secure
  • RealTime
  • DelayOpenFile
  • Buffering
  • PrivateLogger
  • AddHeader
  • UseKilobytesForSize
  • UseGlobalSequence
  • Relog
  • PrivateInProc
  • BufferInterface
  • KdFilter
  • RealtimeRelog
  • LostEventsDebug
  • StopOnHybridShutdown
  • PersistOnHybridShutdown
  • UsePagedMemory
  • SystemLogger
  • Compressed
  • IndependentSession
  • NoPerProcessorBuffering
  • Blocking
  • Reserved0x40000000
  • AddToTriageDump
  • Fatal
  • Error
  • Warning
  • Information
  • Verbose
  • All

Parameter properties

Type:LoggingMode
Default value:None
Accepted values:None, FileNone, FileSequential, FileCircular, FileAppend, FileNewFile, Reserved0x00000010, FilePreallocate, Nonstoppable, Secure, RealTime, DelayOpenFile, Buffering, PrivateLogger, AddHeader, UseKilobytesForSize, UseGlobalSequence, UseLocalSequence, Relog, PrivateInProc, BufferInterface, KdFilter, RealtimeRelog, LostEventsDebug, StopOnHybridShutdown, PersistOnHybridShutdown, UsePagedMemory, SystemLogger, Compressed, IndependentSession, NoPerProcessorBuffering, Blocking, Reserved0x40000000, AddToTriageDump
Supports wildcards:False
DontShow:False

Parameter sets

(All)
Position:10
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-MaximumBufferCount

Specifies the maximum number of buffers to allocate for this session.

Parameter properties

Type:UInt32
Default value:None
Supports wildcards:False
DontShow:False
Aliases:MaximumBuffers, maxbuf

Parameter sets

(All)
Position:8
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-MinimumBufferCount

Specifies the minimum number of buffers to allocate for this session.

Parameter properties

Type:UInt32
Default value:None
Supports wildcards:False
DontShow:False
Aliases:MinimumBuffers, minbuf

Parameter sets

(All)
Position:7
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-Name

Specifies the name of the session to create.

Parameter properties

Type:String
Default value:None
Supports wildcards:False
DontShow:False

Parameter sets

(All)
Position:0
Mandatory:True
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-PassThru

Returns an object representing the item with which you are working. By default, this cmdlet does not generate any output.

Parameter properties

Type:SwitchParameter
Default value:None
Supports wildcards:False
DontShow:False

Parameter sets

(All)
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-ProviderGuid

Specifies the provider GUIDs to subscribe this session to. The providers are configured to include all events up to the level specified by the Level parameter.

Parameter properties

Type:

Guid[]

Default value:None
Supports wildcards:False
DontShow:False
Aliases:pg

Parameter sets

(All)
Position:3
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-ProviderName

Specifies the provider names to subscribe this session to. The providers are configured to include all events up to the level specified by the Level parameter.

Parameter properties

Type:

String[]

Default value:None
Supports wildcards:False
DontShow:False
Aliases:pn

Parameter sets

(All)
Position:2
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-SessionGuid

Specifies the GUID for the session. By default the GUID gets generated and assigned automatically.

Parameter properties

Type:Guid
Default value:None
Supports wildcards:False
DontShow:False

Parameter sets

(All)
Position:1
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

CommonParameters

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

Inputs

None.

Outputs

SbecEtwTrace.TraceSessionInfo

The SbecEtwTrace.TraceSessionInfo class is defined in $PsHome\Modules\BootEventCollector\SbecTraceHelpers.psm1.