MSFT_EtwTraceSession class

Represents a running Event Tracing for Windows (ETW) trace session.

The following syntax is simplified from Managed Object Format (MOF) code and includes all of the inherited properties.

Syntax

[UMLPackagePath("CIM::Core::CoreElements"), dynamic, provider("EventTracingManagement"), Version("1.0"), AMENDMENT]
class MSFT_EtwTraceSession : CIM_LogicalElement
{
  string   InstanceID;
  string   Caption;
  string   Description;
  string   ElementName;
  datetime InstallDate;
  uint16   OperationalStatus[];
  string   StatusDescriptions[];
  string   Status;
  uint16   HealthState;
  uint16   CommunicationStatus;
  uint16   DetailedStatus;
  uint16   OperatingStatus;
  uint16   PrimaryStatus;
  string   Name;
  uint32   LogFileMode;
  uint32   BufferSize;
  uint32   MinimumBuffers;
  uint32   MaximumBuffers;
  uint32   FlushTimer;
  uint32   ClockType;
  uint32   MaximumFileSize;
  string   LocalFilePath;
};

Members

The MSFT_EtwTraceSession class has these types of members:

Methods

The MSFT_EtwTraceSession class has these methods.

MethodDescription
Send

Sends the log file of the specified ETW trace session to a remote share.

 

Properties

The MSFT_EtwTraceSession class has these properties.

BufferSize
Data type: uint32
Access type: Read-only

The buffer size for the trace session, in KB.

Caption
Data type: string
Access type: Read-only
Qualifiers: MaxLen (64)

A short one-line description of the object.

This property is inherited from CIM_ManagedElement.

ClockType
Data type: uint32
Access type: Read-only

The clock resolution to use when logging the time stamp for each trace event.

The possible values are:

Performance counter value (high resolution) (1)

Query performance counter. This counter provides a high-resolution (100 nanoseconds) time stamp and is more resource-intensive to retrieve than system time.

System timer (2)

System timer. The system time provides a low-resolution (10 milliseconds) time stamp and is less resource-intensive to retrieve than the query performance counter.

CPU cycle counter (3)

CPU cycle counter. The CPU counter provides the highest resolution time stamp and is the least resource-intensive to retrieve. However, the CPU counter is unreliable and should not be used in production.

CommunicationStatus
Data type: uint16
Access type: Read-only

The ability of the instrumentation to communicate with this element. A NULL value indicates that instrumentation does not support this property.

The possible values are.

Unknown (0)

The instrumentation cannot report on the CommunicationStatus property at this time.

Not Available (1)

The instrumentation is capable of reporting this property, but intentionally does not for this element.

Communication OK (2)

The instrumentation has established communication with the element.

Lost Communication (3)

The element has been contacted in the past, but is currently unreachable.

No Contact (4)

The instrumentation has contact information for this element, but has never been able to communicate with it.

DMTF Reserved

Reserved.

Vendor Reserved

Reserved.

This property is inherited from CIM_ManagedSystemElement.

Description
Data type: string
Access type: Read-only

A textual description of the object.

This property is inherited from CIM_ManagedElement.

DetailedStatus
Data type: uint16
Access type: Read-only
Qualifiers: ModelCorrespondence ("CIM_EnabledLogicalElement.PrimaryStatus", "CIM_ManagedSystemElement.HealthState")

Additional status details that complement the PrimaryStatus property. A NULL value indicates that the instrumentation does not support this property.

The possible values are.

Not Available (0)

The instrumentation is capable of reporting this property, but intentionally does not report it for this element.

No Additional Information (1)

No details have to be added to the PrimaryStatus property, for example when the PrimaryStatus is set to OK.

Stressed (2)

The element functions, but requires attention. Overload and overheated are examples of Stressed states.

Predictive Failure (3)

The element functions nominally, but predicts a failure in the near future.

Non-Recoverable Error (4)

The element is in an error condition that requires intervention.

Supporting Entity in Error (5)

An element on which the element depends is in error. This element might be OK but cannot function because of the state of a dependent element. An example is a network service or endpoint that cannot function due to lower-layer networking problems.

DMTF Reserved

Reserved.

Vendor Reserved

Reserved.

This property is inherited from CIM_ManagedSystemElement.

ElementName
Data type: string
Access type: Read-only

A user-friendly name for the object. This property allows each instance to define a user-friendly name in addition to its key properties, identity data, and description information.

This property is inherited from CIM_ManagedElement.

FlushTimer
Data type: uint32
Access type: Read-only

The timeout value used by the trace session for the flush capture buffer.

HealthState
Data type: uint16
Access type: Read-only

The current health of the element. This attribute expresses the health of this element, but not necessarily the health of its subcomponents.

The possible values are.

Unknown (0)

The implementation cannot report on HealthState at this time.

OK (5)

The element is fully functional and operates within normal operational parameters and without error.

Degraded/Warning (10)

The element is in working order, and all functionality is provided. However, the element does not function to the best of its abilities. For example, the element might not operate at optimal performance, or it might report recoverable errors.

Minor failure (15)

All functionality is available, but some functionality might be degraded.

Major failure (20)

The element is failing. It is possible that some or all of the functionality of this component is degraded or does not work.

Critical failure (25)

The element is nonfunctional, and recovery might not be possible.

Non-recoverable error (30)

The element has completely failed, and recovery is not possible. All functionality that this element provides has been lost.

DMTF Reserved

Reserved.

This property is inherited from CIM_ManagedSystemElement.

InstallDate
Data type: datetime
Access type: Read-only

When the object was installed. The lack of a value does not indicate that the object is not installed.

This property is inherited from CIM_ManagedSystemElement.

InstanceID
Data type: string
Access type: Read-only

Opaquely and uniquely identifies an instance of this class within the scope of the instantiating Namespace.

The value of this property must be unique within the NameSpace.

This property is inherited from CIM_ManagedElement.

LocalFilePath
Data type: string
Access type: Read-only

The local path and filename of the file that receives the trace information.

LogFileMode
Data type: uint32
Access type: Read-only

The log file mode of trace session.

MaximumBuffers
Data type: uint32
Access type: Read-only

The maximum number of buffers to use for the trace session.

MaximumFileSize
Data type: uint32
Access type: Read-only

The maximum file size of the trace event log.

MinimumBuffers
Data type: uint32
Access type: Read-only

The minimum number of buffers to use for the trace session.

Name
Data type: string
Access type: Read-only
Qualifiers: MaxLen (1024), key

Name of the ETW trace session to get.

OperatingStatus
Data type: uint16
Access type: Read-only
Qualifiers: ModelCorrespondence ("CIM_EnabledLogicalElement.EnabledState")

The current operational condition of the element. A NULL value indicates that the instrumentation does not support this property.

The possible values are.

Unknown (0)

The instrumentation cannot report on the OperatingStatus property at this time.

Not Available (1)

The instrumentation is capable of reporting this property, but intentionally does not report it for this element.

Servicing (2)

The element is being configured, maintained, cleaned, or otherwise administered.

Starting (3)

The element is being initialized.

Stopping (4)

The element is being brought to an orderly stop.

Stopped (5)

The element is intentionally stopped.

Aborted (6)

The element stopped in an unexpected way.

Dormant (7)

The element is inactive or quiesced.

Completed (8)

The element completed its operation. We recommend using a PrimaryStatus property value of OK, Error, or Degraded to indicate success or failure of the operation.

Migrating (9)

The element is being moved between host elements.

Emigrating (10)

The element is being moved away from the host element.

Immigrating (11)

The element is being moved to a new host element.

Snapshotting (12)

A snapshot copy of the element is being created.

Shutting Down (13)

The element is being brought to an abrupt stop.

In Test (14)

The element is performing test functions.

Transitioning (15)

The element is between states and is not fully available in either state. Use another value that indicates a more specific transition if one is available.

In Service (16)

The element is in service and operational.

DMTF Reserved

Reserved.

Vendor Reserved

Reserved.

This property is inherited from CIM_ManagedSystemElement.

OperationalStatus
Data type: uint16 array
Access type: Read-only
Qualifiers: ArrayType ("Indexed"), ModelCorrespondence ("CIM_ManagedSystemElement.StatusDescriptions")

An array that contains indicators of the current status of the element. The first value of the OperationalStatus property should contain the primary status for the element.

Note  The OperationalStatus property replaces the deprecated Status property. Due to the widespread use of the existing Status property in management applications, we strongly recommend that providers or instrumentation provide both the Status and OperationalStatus properties. When instrumented, Status, because it is a single-valued property, should also provide the primary status of the element.
 

The possible values are.

Unknown (0)

The implementation cannot report on the OperationalStatus property at this time.

Other (1)

An undefined state.

OK (2)

Full functionality without errors.

Degraded (3)

The element is in working order and all functionality is provided. However, the element does not function to the best of its abilities. For example, the element might not operate at optimal performance, or it might report recoverable errors.

Stressed (4)

The element functions, but requires attention. Overload and overheated are examples of Stressed states.

Predictive Failure (5)

The element functions nominally, but predicts a failure in the near future.

Error (6)

An error has occurred.

Non-Recoverable Error (7)

A nonrecoverable error has occurred.

Starting (8)

The job is starting.

Stopping (9)

The job is stopping.

Stopped (10)

The element has been intentionally stopped.

In Service (11)

The element is being configured, maintained, cleaned, or otherwise administered.

No Contact (12)

The monitoring system has information about this element, but has never been able to establish communications with it.

Lost Communication (13)

The monitoring system has successfully contacted this element in the past, but it is currently unavailable.

Aborted (14)

The job stopped in an unexpected way. The state and configuration of the job might require an update.

Dormant (15)

The job is inactive.

Supporting Entity in Error (16)

An element on which this job depends is in error. This element might be OK but cannot function because of the state of a dependent element. An example is a network service or endpoint that cannot function due to lower-layer networking problems.

Completed (17)

The job has completed its operation. This value should be combined with either OK, Error, or Degraded to indicate to a client whether the completed operation Completed with OK and passed, or completed with Error and failed, or completed with Degraded and finished the operation, but did not complete OK or did not report an error.

Power Mode (18)

The element has additional power model information that is contained in the associated power management service.

DMTF Reserved

Reserved.

Vendor Reserved

Reserved.

This property is inherited from CIM_ManagedSystemElement.

PrimaryStatus
Data type: uint16
Access type: Read-only
Qualifiers: ModelCorrespondence ("CIM_ManagedSystemElement.DetailedStatus", "CIM_ManagedSystemElement.HealthState")

A high-level status value.

The possible values are.

Unknown (0)

OK (1)

Degraded (2)

Error (3)

DMTF Reserved

4–32767

Vendor Reserved

32768 ≤ value

This property is inherited from CIM_ManagedSystemElement.

Status
Data type: string
Access type: Read-only
Qualifiers: Deprecated ("CIM_ManagedSystemElement.OperationalStatus"), MaxLen (10)

The primary status of the object.

Note  This property is deprecated. It is replaced by the OperationalStatus property. If you choose to use the Status property for backward compatibility, it should be secondary to the OperationalStatus property.
 

The possible values are.

"OK"

"Error"

"Degraded"

"Unknown"

"Pred Fail"

"Starting"

"Stopping"

"Service"

"Stressed"

"NonRecover"

"No Contact"

"Lost Comm"

"Stopped"

This property is inherited from CIM_ManagedSystemElement.

StatusDescriptions
Data type: string array
Access type: Read-only
Qualifiers: ArrayType ("Indexed"), ModelCorrespondence ("CIM_ManagedSystemElement.OperationalStatus")

An array that contains descriptions of the corresponding values in the OperationalStatus array.

This property is inherited from CIM_ManagedSystemElement.

Requirements

Minimum supported client

Windows 10

Minimum supported server

Windows Server 2016 Technical Preview

Namespace

Root\Microsoft\Windows\EventTracingManagement

MOF

EventTracingManagement.Mof

DLL

EventTracingManagement.dll

See also

CIM_LogicalElement
Event Tracing Management WMI Provider

 

 

Show: