EventCollector

Article
03/17/2014

Applies To: Windows 8, Windows 8.1

Represents an event collector for the profile.

Element Hierarchy

Syntax

<EventCollector Id             = IdType
                Base           = string
                Name           = string
                FileName       = string
                Realtime       = boolean
                Private        = boolean
                ProcessPrivate = boolean
                Secure         = boolean>

  <!-- Child elements -->
  BufferSize,
  Buffers,
  StackCaching

</EventCollector>

Attributes and Elements

Attributes

Attribute	Description	Data type	Required	Default
Id	Uniquely identifies the event collector.	String that must have at least one character and cannot contain colons (:) or spaces.	Yes
Base	Identifies the base of the event collector.	string	No
Name	Indicates the name of the ETW session.	string	Yes
FileName	Indicates the file to which to log events.	string	Yes
Realtime	Indicates whether the event collector operates in real time.	boolean	No	false
Private	If set to "true", indicates a user-mode session that runs in the same process as its event provider. If set to "false", indicates a global user-mode session.	boolean	No	false
ProcessPrivate	If set to "true", indicates a user-mode session that runs in the same process as its event provider and should be controlled only by the process that registered the provider. If set to "false", indicates a global user-mode session. Use this attribute in conjunction with the Private attribute.	boolean	No	false
Secure	If set to "true", indicates that only users with administrative privileges and proper access rights can control the session. If set to "false", indicates that all users can control the session.	boolean	No	false

Child Elements

Element	Description	Requirement
BufferSize	Describes the size of each buffer, in KB.	Required, exactly 1.
Buffers	Describes the number of buffers to be allocated when starting a session or the percentage of total memory to be allocated for the session, depending on the value of the PercentageOfTotalMemory attribute.	Required, exactly 1.
StackCaching	Describes stack caching attributes of collectors.

Parent Elements

Element	Description
Profiles	Represents a collection of collectors, providers, and profiles.

Remarks

System collector definitions must precede event collector definitions.

Derived collectors inherit all attributes of the base collector unless they are explicitly specified in the derived collector. For more information, see Inheritance.

Example

The following code example defines an event collector with 64 buffers of 128 KB each.

<EventCollector
  Id="WPREventCollector"
  Name="WPR Event Collector"
  FileName="somefilename.etl"> 
  <BufferSize
    Value="128"/> 
  <Buffers
    Value="64"/>
</EventCollector>