Adding a System ETW Provider
As part of its tracing facilities, Message Analyzer retrieves events from system ETW Providers. System ETW Providers that are registered on your system write events that are issued by various Windows components that have been instrumented with ETW provider technology to write such events. These providers are accessible from a searchable provider library in the Trace Scenario Configuration pane of the Message Analyzer Trace Session configuration interface. To begin your search for a system ETW Provider, you can click in the search box to display a list of providers that Message Analyzer enumerated on your system during installation. You can also enter search characters in the search box to quickly locate a system ETW Provider by name.
After you select a system ETW Provider, configuration settings are displayed in the Trace Scenario Configuration pane under ETW Provider Core Configuration. If you want to further refine the focus of the provider’s data retrieval action, you can modify the provider filtering configuration. For example, you can change event Level and Keyword filtering settings if the particular system ETW Provider defines such filters.
To learn more about the configuration settings for system ETW Providers, including Keyword and Level filter configuration, see System ETW Provider Configuration Settings.
To learn more about the ETW framework and system ETW Provider functionality, see the ETW Framework Tutorial.