How are flag values assigned?

Trace flags are defined independently by each trace provider. As a result, the flag values for one provider can mean something completely different from the flag values for another provider. To interpret the values, you need to understand the provider.

Typically, trace flags represent increasingly detailed reporting levels.

Flag values are defined in the WPP_DEFINE_BIT elements of the WPP_CONTROL_GUIDS macro, such as in this example:

#define WPP_CONTROL_GUIDS \
    WPP_DEFINE_CONTROL_GUID(GUIDFriendlyName, (ControlGUID),  \
        WPP_DEFINE_BIT(Error)  \
        WPP_DEFINE_BIT(Unusual)  \
        WPP_DEFINE_BIT(Noise) )

Windows assigns to each WPP_DEFINE_BIT element a consecutive bit value beginning with 1. For example, it would assign 1 to the first bit (Error), 2 to the second bit (Unusual), and 4 to the third bit (Noise).

When you start a trace session, use the bit value to represent the flags. For example, the following command uses Tracelog to start a trace session with the trace provider defined earlier. It sets the flag value to 4 (Noise).

tracelog -start MyTrace -guid MyDriver.guid -flags 4