This section describes the new features that were added to ETW for each release.

Windows 7 and Windows Server 2008 R2

The following features were added in this release:

• The ability for providers to define filters in the manifest. In Windows Vista, controllers could pass filter data to the provider. However, the layout of the filter data was not defined in the manifest, so the provider would have to use other means to provide the filter definition to controllers. With this release, providers can define the filter definition in the manifest (see the filters attribute of the ProviderType complex type). Controllers can then use the TdhEnumerateProviderFilters function to determine the filter definition. Providers that use filters should use the EventWriteEx function to write the event.
• The ability to use a single buffer to gather events generated on multiple processors. Using a single buffer eliminates events from appearing out of order on multi-processors computers. For details, see the EVENT_TRACE_NO_PER_PROCESSOR_BUFFERING logging mode. By default, ETW uses per-processor buffers.
• The ability to capture a stack trace for events. To enable stack tracing for kernel events, see the TraceSetInformation function. To enable stack tracing for user events, see the EVENT_ENABLE_PROPERTY_STACK_TRACE flag for the EnableProperty member of ENABLE_TRACE_PARAMETERS.
• The ability to specify the EVENT_TRACE_BUFFERING_MODE or EVENT_TRACE_FILE_MODE_NEWFILE logging mode with the EVENT_TRACE_PRIVATE_LOGGER_MODE logging mode (see Logging Mode Constants).
• The ability to enable a provider synchronously. By default, providers are enabled asynchronously. To enable a provider synchronously, set the Timeout parameter of EnableTraceEx2.
• The ability for the controller to request that the provider log its state. For details, see the EVENT_CONTROL_CODE_CAPTURE_STATE flag for the ControlCode parameter of EnableTraceEx2.
• The ability for consumers to format event data using the TdhFormatProperty function.
• The ability to decode manifested events on computers that do not contain the provider. For details, see the TdhLoadManifest function.

The following functions were added in this release:

• EnableTraceEx2
• EventWriteEx
• TdhEnumerateProviderFilters
• TdhFormatProperty
• TdhLoadManifest
• TdhUnloadManifest
• TraceSetInformation

The following structures were added in this release:

• CLASSIC_EVENT_ID
• ENABLE_TRACE_PARAMETERS
• EVENT_EXTENDED_ITEM_STACK_TRACE32
• EVENT_EXTENDED_ITEM_STACK_TRACE64
• EVENT_FILTER_HEADER
• PROVIDER_FILTER_INFO

The following enumerations were added in this release:

• TRACE_INFO_CLASS

The following MOF classes were added in this release:

• StackWalk
• StackWalk_Event

Send comments about this topic to Microsoft

Build date: 10/15/2009