Updated: October 20, 2013

Applies To: Windows 8, Windows 8.1

Represents a collection of keywords that describe events to be captured when a trace is saved. The library requests the provider to log its state information when the collector is saved. If the Operation attribute is specified, the Keyword elements can be set or added to the collection.




<CaptureStateOnSave Operation = "Set" | "Add"> | “Remove”

  <!-- Child elements -->



Attribute Description Data type Required Default


Indicates whether keywords should be set or added.

This attribute can have one of the following values:

  • Set

  • Add

  • Remove




Element Description Requirement

Keyword (in EventProvider)

Describes the Event Tracing for Windows® (ETW) keyword for a user-mode provider.

Required, one or more.


Element Description


Represents an event provider for the profile.


Represents an event provider identifier.

The following code example shows how this element is used.

<EventProvider Id="EventProvider_DWMWin32k_CaptureState" Name="e7ef96be-969f-414f-97d7-3ddb7b558ccc" NonPagedMemory="true" CaptureStateOnly="true" > 
  <!-- CaptureStateOnly="true" means provider is not enabled throughout the tracing session. -->
    <Keyword Value="0x80000"/> <!-- Provider is enabled with these keywords when tracing is saved. -->