How do I update the flags in a running trace session?
Flags and levels are properties of a trace provider, not of the trace session. Therefore, tracelog -update, the command to update the trace session, cannot be used to change the properties of a provider. Instead, use the tracelog -enable command to re-enable the provider with the new properties.
You can also use TraceView to change the flags or levels in a trace session that you started by using TraceView. The graphical user interface makes it easy to see what properties can be changed while the session runs, and to change them.