Edit

Tracelog Properties Display

  • Article

Tracelog displays the properties of a trace session when you start, stop, update, or query the session.

The data comes from the EVENT_TRACE_PROPERTIES structure for the log session. The following table describes the fields in the display.

Field Description

Operation Status

The status returned by the system. For a list of status messages and system error codes, see the Microsoft Windows SDK documentation.

Logger Name

The name of the trace session.

Logger ID

Identifies the trace session.

Logger Thread ID

Identifies the thread that runs the trace session.

Buffer Size

The size of each buffer in KB.

Maximum Buffers

The maximum number of buffers being used at one time. Use the -max parameter to change this value.

Minimum Buffers

The minimum number of buffers allocated for the session. Use the -min parameter to set this value.

Number of Buffers

The actual number of buffers allocated for the session.

Free Buffers

Buffers that are allocated, but not currently in use.

Buffers Written

The total number of buffers written during the trace session. This includes buffers written, flushed, and then rewritten, so it can exceed the value of Maximum Buffers.

To estimate the size of a sequential log file, multiply Buffers Written by Buffer Size.

Events Lost

The number of events that were generated but not recorded, usually because all allocated buffers were full.

Log Buffers Lost

The number of buffers whose content could not be written to a log. Typically, this occurs only when there is not enough disk space to hold the log contents.

Real Time Buffers Lost

The number of buffers whose content could not be delivered. Typically, this occurs when system resources are insufficient.

AgeLimit

The time delay before unused buffers are freed. To change this value, use -age.

Mode

(Real Time mode enabled, Log File mode, Buffering mode only)

The logging modes that are enabled for this session. For a complete list of logging mode constants, see the Windows SDK documentation.

Note

The Log File Mode entry appears even when a log file is not being written. It displays the log file format.

Enabled tracing

The NT Kernel Logger events that are being traced. This field appears only when tracing the NT Kernel Logger session.

Note

DPC, ISR, and context switch events do not appear in this field, even when they are being traced.

Log Filename

The log file used for the session. For real-time and buffered trace sessions, the field value is blank.

To change this value, use -f.

Local/Global Sequence numbers in use.

Appears only when local or global sequence numbers are used.

To change this property, use -ls or -gs.