Providers
Providers are Event Tracing for Windows (ETW) components that expose events to Windows Performance Recorder (WPR). You can use a single system provider and multiple event providers in a profile, including a heap event provider.
System Providers
A system provider provides kernel events. System providers are defined by using the following:
Keywords for the events to be collected.
Stacks from which to collect events.
Pool tags to indicate the component that made the allocation or the allocation type.
For a description of supported system keywords, see Keyword (in SystemProvider).
Event Providers
You can configure event providers to provide certain types of events (among those that are supported by the provider) by specifying a hexadecimal bitmask keyword. Because providers support different events, there are no string constants for these keywords. Therefore, they must be hexadecimal-style strings.