ChannelType Complex Type

• Application
• System
• Custom

            L"O:BAG:SYD:"
            L"(A;;0xf0007;;;SY)"                // local system               (read, write, clear)
            L"(A;;0x7;;;BA)"                    // built-in admins            (read, write, clear)
            L"(A;;0x7;;;SO)"                    // server operators           (read, write, clear)
            L"(A;;0x3;;;IU)"                    // INTERACTIVE LOGON          (read, write)
            L"(A;;0x3;;;SU)"                    // SERVICES LOGON             (read, write)
            L"(A;;0x3;;;S-1-5-3)"               // BATCH LOGON                (read, write)
            L"(A;;0x3;;;S-1-5-33)"              // write restricted service   (read, write)
            L"(A;;0x1;;;S-1-5-32-573)";         // event log readers          (read) 

The default permissions for System are (shown using SDDL):

            L"O:BAG:SYD:"
            L"(A;;0xf0007;;;SY)"                // local system             (read, write, clear)
            L"(A;;0x7;;;BA)"                    // built-in admins          (read, write, clear)
            L"(A;;0x3;;;BO)"                    // backup operators         (read, write)
            L"(A;;0x5;;;SO)"                    // server operators         (read, clear) 
            L"(A;;0x1;;;IU)"                    // INTERACTIVE LOGON        (read)
            L"(A;;0x3;;;SU)"                    // SERVICES LOGON           (read, write)
            L"(A;;0x1;;;S-1-5-3)"               // BATCH LOGON              (read)
            L"(A;;0x2;;;S-1-5-33)"              // write restricted service (write)
            L"(A;;0x1;;;S-1-5-32-573)";         // event log readers        (read)

The default permissions for Custom isolation is the same as Application.

Channels that specify Application isolation use the same ETW session. The same is true for System isolation. However, if you specify Custom isolation, the service creates a separate ETW session for the channel. Using Custom isolation lets you control the access permissions for the channel and backing file. Because there are only 64 ETW sessions available, you should limit your use of Custom isolation.

The name of the channel. The name must be unique within the list of channels that the provider uses. The convention for naming channels is to append the channel type to the provider's name. For example. if the provider's name is Company-Product-Component and you are defining an operational channel, the name would be Company-Product-Component/Operational.

Channel names must be less that 255 characters and cannot contain the following characters: '>', '<', '&', '"', '|', '\', ':', '`', '?', '*', or characters with codes less than 31.

Identifies the channel's type. You can specify one of the following types:

• Admin
• Operational
• Analytic
• Debug

Admin type channels support events that target end users, administrators, and support personnel. Events written to the Admin channels should have a well-defined solution on which the administrator can act. An example of an admin event is an event that occurs when an application fails to connect to a printer. These events are either well-documented or have a message associated with them that gives the reader direct instructions of what must be done to rectify the problem.

Operational type channels support events that are used for analyzing and diagnosing a problem or occurrence. They can be used to trigger tools or tasks based on the problem or occurrence. An example of an operational event is an event that occurs when a printer is added or removed from a system.

Analytic type channels support events that are published in high volume. They describe program operation and indicate problems that cannot be handled by user intervention.

Debug type channels support events that are used solely by developers to diagnose a problem for debugging.

Analytic and debug channels are disabled by default and should only enabled to determine the cause of an issue. For example, you would enable the channel, run the scenario that is causing the issue, disable the channel, and then query the events. Note that enabling the channel clears the channel of existing events. If the analytic and debug channel uses a circular backing file, you must disable the channel to query its events.

All Admin channels use the same ETW session; the same is true for Operational channels. However, each Analytic and Debug channel uses a separate ETW session, which is another reason to only enable these channel types when needed (there is a limited number of ETW sessions available).