Trace Flags

Trace flags are properties of a trace provider, such as a kernel-mode driver or user-mode application. These flags determine which events the trace provider generates. The provider interprets the flags as conditions for generating the message.

Typically, flags represent increasingly detailed reporting levels, but the provider can use the flags to represent any condition for generating the trace message.

The trace provider defines each flag in a WPP_DEFINE_BIT element of the WPP_CONTROL_GUIDS structure. The Windows Software Trace Preprocessor (WPP) assigns bit values to the elements in the order that they appear in the structure, beginning with 1.

When running a trace session, you can use the trace flags to determine which messages will be generated during the session. Trace consumers, such as Tracelog and TraceView, let users set parameters and options to select the trace flags and trace level for each provider in a trace session.

You can change the trace flags while a trace session is running by reenabling the trace provider.