Windows PowerShell command on Get-command Add-EtwTraceProvider

NAME

Add-EtwTraceProvider

SYNOPSIS

Adds an ETW trace provider to an ETW Autologger configuration or ETW session.

SYNTAX

Add-EtwTraceProvider [-Guid] [-CimSession ] [-Level ] [-MatchAllKeyword ]

[-MatchAnyKeyword ] [-Property ] [-ThrottleLimit ] -AutologgerName

[]

Add-EtwTraceProvider [-Guid] [-CimSession ] [-Level ] [-MatchAllKeyword ]

[-MatchAnyKeyword ] [-Property ] [-ThrottleLimit ] -SessionName

[]

DESCRIPTION

The Add-EtwTraceProvider cmdlet adds an Event Trace for Windows (ETW) trace provider to an ETW Autologger

configuration or to an ETW session.

PARAMETERS

-AutologgerName

Specifies an ETW Autologger configuration. If you specify this parameter, do not specify the SessionName

parameter. Required? true Position? named Default value none Accept pipeline input? false Accept wildcard characters? false

-CimSession []

Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such

as the output of a New-CimSession or Get-CimSession cmdlet. The default is the current session on the local

computer. Required? false Position? named Default value none Accept pipeline input? false Accept wildcard characters? false

-Guid

Specifies the GUID, as a string, of the ETW trace provider that this cmdlet adds to an ETW Autologger configuration or to an ETW session. Required? true Position? 1 Default value none Accept pipeline input? false Accept wildcard characters? false

-Level []

Specifies the provider-defined value that specifies the level of detail included in the event. If you specify

a value, that value entails all the values that have a lower value. For instance, if you specify a value of 3, for TRACE_LEVEL_WARNING, TRACE_LEVEL_ERROR and TRACE_LEVEL_CRITICAL events are also included. Valid values are:

-- 1: TRACE_LEVEL_CRITICAL. Abnormal exit or termination events.

-- 2: TRACE_LEVEL_ERROR. Severe error events.

-- 3: TRACE_LEVEL_WARNING. Warning events such as allocation failures.

-- 4: TRACE_LEVEL_INFORMATION. Non-error events such as entry or exit events.

-- 5: TRACE_LEVEL_VERBOSE. Detailed trace events.

Required? false Position? named Default value none Accept pipeline input? false Accept wildcard characters? false

-MatchAllKeyword []

Specifies keywords, as a bitmask, that further restricts the category of events that the provider writes. If an event keyword meets the conditions specified by the MatchAnyKeyword parameter, the provider writes the event only if all of the bits specified by this parameter exist in the event keyword. Do not specify this parameter if you specify a value of zero for MatchAnyKeyword. Use the following format: 0x0000000000000001. Required? false Position? named Default value none Accept pipeline input? false Accept wildcard characters? false

-MatchAnyKeyword []

Specifies keywords, as a bitmask, that determine the category of events that the provider writes. The provider writes the event if any of the keyword bits match any of the bits set in this mask. Use the following format: 0x0000000000000001. Required? false Position? named Default value none Accept pipeline input? false Accept wildcard characters? false

-Property []

Specifies a bitmask that determines whether to include one or more of the following items in the log file:

-- 0x00000001. The user security identifier

-- 0x00000002. The terminal session identifier

Required? false Position? named Default value none Accept pipeline input? false Accept wildcard characters? false

-SessionName

Specifies the name of the ETW session to which this cmdlet adds the ETW trace provider. If you specify this

parameter, do not specify AutologgerName parameter.

Required? true Position? named Default value none Accept pipeline input? false Accept wildcard characters? false

-ThrottleLimit []

Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of zero is entered, then Windows PowerShellr calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer. Required? false Position? named Default value none Accept pipeline input? false Accept wildcard characters? false This cmdlet supports the common parameters: Verbose, Debug, ErrorAction, ErrorVariable, WarningAction, WarningVariable, OutBuffer, PipelineVariable, and OutVariable. For more information, see about_CommonParameters (https:/go.microsoft.com/fwlink/?LinkID=113216).

INPUTS

OUTPUTS

Example 1: Add an ETW trace provider to an Autologger configuration

PS C:\>Add-EtwTraceProvider -Guid "{5EEFEBDB-E90C-423A-8ABF-0241E7C5B87D}" -AutologgerName "WFP-IPsec Trace"

SessionName :

AutologgerName : WFP-IPsec Trace

Guid : {5EEFEBDB-E90C-423A-8ABF-0241E7C5B87D}

Level : 0 MatchAnyKeyword : 0x0 MatchAllKeyword : 0x0 Property : 0 This command adds the ETW trace provider that has the specified GUID to an Autologger configuration named

WFP-IPsec Trace.

Example 2: Add an ETW trace provider to an ETW session

PS C:\>Add-EtwTraceProvider -Guid "{5EEFEBDB-E90C-423A-8ABF-0241E7C5B87D}" -SessionName "VMM"

SessionName : VMM

AutologgerName :

Guid : {5EEFEBDB-E90C-423A-8ABF-0241E7C5B87D}

Level : 0 MatchAnyKeyword : 0x0 MatchAllKeyword : 0x0 Property : 0 This command adds the ETW trace provider that has the specified GUID to an session named VMM.