Adding a System ETW Provider
As part of its tracing facilities, Message Analyzer retrieves events from system ETW Providers. System ETW Providers that are registered on your system write events that are issued by various Windows components that have been instrumented with ETW technology to write such events. These providers are accessible from a searchable Add Provider drop-down library on the ETW Providers toolbar that is located on the Live Trace tab of the New Session dialog. Many of these providers are based upon managed object format (MOF) schemas to define their events for ETW.
To begin your search for a system ETW Provider, click in the Add Provider search box to display a list of providers that Message Analyzer enumerated on your local system during installation. You can also enter search characters in the search box to quickly locate a system ETW Provider by name.
Configuring System ETW Providers
After you select a system ETW Provider and it displays in the ETW Providers list, you can access the configuration settings for the provider on the ETW Core tab of the Advanced Settings dialog. This dialog displays when you click the Configure link that appears immediately to the right of the Id for any provider that is listed in the ETW Providers list on the Live Trace tab of the New Session dialog. If you want to further refine the focus of the provider’s data retrieval action, you can modify the provider filtering configuration. For example, you can specify event Keyword and Level filtering settings if the particular system ETW Provider defines such filters.
Support for WPP Trace Providers
Message Analyzer can parse and display events that are generated by a Windows software trace preprocessor (WPP) trace provider. Because these providers write events that can integrate with the ETW framework, Message Analyzer can capture them live or load them from a saved event trace log (ETL) file that is created by an appropriate system tool. To enable parsing of WPP-generated events, users must provide supplemental formatting information, such as a program database (PDB) or trace message format (TMF) file, to define the WPP event structure.
If you want to use Message Analyzer to capture WPP-generated events live, you must have a corresponding managed object format (MOF) provider that is registered on your system. When this is the case, Message Analyzer displays the WPP/MOF provider in the ETW provider list in your Live Trace Session configuration. You can then select the provider and run a trace to capture the events that are generated by the WPP/MOF-based trace provider.
To learn more about Message Analyzer support for MOF-based providers, including how to register and deploy one, see MOF-Based ETW Providers.
To learn more about the configuration settings for system ETW Providers, including Keyword and Level filter configuration, see System ETW Provider Configuration Settings.
To learn more about the ETW framework and system ETW Provider functionality, see the ETW Framework Tutorial.
To learn more about how Message Analyzer supports WPP trace providers, see Processing WPP-Generated Events.