Tracelog Properties Display
Tracelog displays the properties of a trace session when you start, stop, update, or query the session.
The data comes from the EVENT_TRACE_PROPERTIES structure for the log session. The following table describes the fields in the display.
The status returned by the system. For a list of status messages and system error codes, see the Microsoft Windows SDK documentation.
The name of the trace session.
Identifies the trace session.
Logger Thread ID
Identifies the thread that runs the trace session.
The size of each buffer in KB.
The maximum number of buffers being used at one time. Use the -max parameter to change this value.
The minimum number of buffers allocated for the session. Use the -min parameter to set this value.
Number of Buffers
The actual number of buffers allocated for the session.
Buffers that are allocated, but not currently in use.
The total number of buffers written during the trace session. This includes buffers written, flushed, and then rewritten, so it can exceed the value of Maximum Buffers.
To estimate the size of a sequential log file, multiply Buffers Written by Buffer Size.
The number of events that were generated but not recorded, usually because all allocated buffers were full.
Log Buffers Lost
The number of buffers whose content could not be written to a log. Typically, this occurs only when there is not enough disk space to hold the log contents.
Real Time Buffers Lost
The number of buffers whose content could not be delivered. Typically, this occurs when system resources are insufficient.
The time delay before unused buffers are freed. To change this value, use -age.
(Real Time mode enabled, Log File mode, Buffering mode only)
The logging modes that are enabled for this session. For a complete list of logging mode constants, see the Windows SDK documentation.
The Log File Mode entry appears even when a log file is not being written. It displays the log file format.
The NT Kernel Logger events that are being traced. This field appears only when tracing the NT Kernel Logger session.
DPC, ISR, and context switch events do not appear in this field, even when they are being traced.
The log file used for the session. For real-time and buffered trace sessions, the field value is blank.
To change this value, use -f.
Local/Global Sequence numbers in use.
Appears only when local or global sequence numbers are used.
To change this property, use -ls or -gs.