Updated: October 20, 2013

Applies To: Windows 8, Windows 8.1

Represents a collection of keywords that describe events to be captured at the start of a recording. The library requests the provider to log its state information when the provider is enabled. If the Operation attribute is specified, the Keyword elements can be set or added to the collection.




<CaptureStateOnStart Operation = "Set" | "Add"> | “Remove”

  <!-- Child elements -->



Attribute Description Data type Required Default


Indicates whether keywords should be set or added.

This attribute can have one of the following values:

  • Set

  • Add

  • Remove




Element Description Requirement

Keyword (in EventProvider)

Describes the Event Tracing for Windows® (ETW) keyword for a user-mode provider.

Required, one or more.


Element Description


Represents an event provider for the profile.


Represents an event provider identifier.

The following code example shows how this element is used.

<EventProvider Id="sample-provider" Name="SampleProvider" NonPagedMemory="true" Level="5">
    <Keyword Value="0x98"/> <!-- Provider is enabled with these keywords throughout tracing session -->
    <Keyword Value="0xff4"/> <!-- Provider is  enabled with these keywords when tracing is started. -->
    <Keyword Value="0x118"/> <!-- Provider is enabled with these keywords when tracing is saved. -->