Edit

Event Tracing MOF Classes

  • Article

The classes are defined in the \root\wmi namespace. The EventVersion qualifier for the kernel events associates the class with a specific operating system. For example, version zero is associated with Windows 2000, version one with Windows XP and Windows Server 2003, and version two with Windows Vista.

The following MOF classes define the ETW event classes.

The following MOF classes define the kernel events classes.