Windows PowerShell command on Get-command Remove-EtwTraceProvider

NAME

Remove-EtwTraceProvider

SYNOPSIS

Removes an ETW trace provider from an ETW Autologger configuration or an ETW session.

SYNTAX

Remove-EtwTraceProvider [-Guid] [-CimSession ] [-PassThru] [-ThrottleLimit ]

-AutologgerName []

Remove-EtwTraceProvider [-Guid] [-CimSession ] [-PassThru] [-ThrottleLimit ]

-SessionName []

Remove-EtwTraceProvider [-CimSession ] [-PassThru] [-ThrottleLimit ] []

DESCRIPTION

The Remove-EtwTraceProvider cmdlet removes an Event Trace for Windows (ETW) trace provider from an ETW Autologger

configuration or an ETW session.

PARAMETERS

-AutologgerName

Specifies an array of names of the ETW Autologger configurations from which to remove an ETW trace provider.

If you specify this parameter, do not specify the SessionName parameter.

Required? true Position? named Default value none Accept pipeline input? false Accept wildcard characters? false

-CimSession []

Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such

as the output of a New-CimSession or Get-CimSession cmdlet. The default is the current session on the local

computer. Required? false Position? named Default value none Accept pipeline input? false Accept wildcard characters? false

-Guid

Specifies an array of GUIDs, as strings, of the ETW trace providers that this cmdlet removes from an ETW Autologger configuration or ETW session. Required? true Position? 1 Default value none

Accept pipeline input? true(ByPropertyName)

Accept wildcard characters? false

-PassThru []

Indicates that this cmdlet returns an object that represents the item on which it operates. By default, this cmdlet does not generate any output. Required? false Position? named Default value none Accept pipeline input? false Accept wildcard characters? false

-SessionName

Specifies an array of names of the ETW sessions that contain the ETW trace provider that this cmdlet removes.

If you specify this parameter, then do not specify the AutologgerName parameter.

Required? true Position? named Default value none Accept pipeline input? false Accept wildcard characters? false

-ThrottleLimit []

Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of zero is entered, then Windows PowerShellr calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer. Required? false Position? named Default value none Accept pipeline input? false Accept wildcard characters? false This cmdlet supports the common parameters: Verbose, Debug, ErrorAction, ErrorVariable, WarningAction, WarningVariable, OutBuffer, PipelineVariable, and OutVariable. For more information, see about_CommonParameters (https:/go.microsoft.com/fwlink/?LinkID=113216).

INPUTS

OUTPUTS

Example 1: Remove an ETW trace provider from a session

PS C:\>Remove-EtwTraceProvider -Guid "{9C88041D-349D-4647-8BFD-2C0A167BFE58}" -SessionName "TestSession17"

SessionName : TestSession

AutologgerName :

Guid : {5EEFEBDB-E90C-423A-8ABF-0241E7C5B87D }

Level : 2 MatchAnyKeyword : 0xFFFFFFFF MatchAllKeyword : 0x00000000 Property : This command removes the ETW Trace Provider that has the specified GUID from the session named TestSession17.