SystemCollector

  • Article

Describes the configurations to enable the Event Tracing for Windows (ETW) kernel-mode session.

Element Hierarchy

Syntax

<SystemCollector Id       = IdType
                 Base     = string
                 Name     = "NT Kernel Logger" | "Circular Kernel Context Logger"
                 Realtime = boolean>

  <!-- Child elements -->
  BufferSize,
  Buffers,
   StackCaching,
  MaximumFileSize,
  FileMax

</SystemCollector>

Attributes and Elements

Attributes

Attribute Description Data type Required Default
Id Uniquely identifies the system collector. String that must have at least one character and cannot contain colons (:) or spaces. Yes
Base Identifies the base of the system collector. Derived collectors have all the attributes of the base collector. These can be overridden by explicitly specifying them in the derived collector. string No
Name Indicates the name of the system collector. This attribute can have one of the following values:
  • NT Kernel Logger
  • Circular Kernel Context Logger
 Yes
Realtime Indicates whether the collector works in real time. boolean No false

Child Elements

Element Description Requirement Default
BufferSize Describes the size of each buffer, in KB. Optional, 1. 128
Buffers Describes the number of buffers to be allocated when starting a session. Optional, 1. 64
StackCaching Describes stack caching attributes of collectors. Optional, 1.
MaximumFileSize Describes maximum trace file size. Optional, 1.
FileMax Describes the maximum number of instances of the log file that ETW creates for Autologger trace. Optional, 1.

Parent Elements

Element Description
Profiles Represents a collection of collectors, providers, and profiles.

Remarks

System collector definitions should precede event collector definitions.

Example

The following code example defines a system collector.

<SystemCollector
  Id="WPRSystemCollector”
  Name="NT Kernel Logger"
  FileName="WPRKernel.etl">
  <BufferSize Value="512"/>
  <Buffers Value="3" PercentageOfTotalMemory="true"/>
</SystemCollector>

Elements