Set-EtwTraceSession

Applies To: Windows 10, Windows Server Technical Preview

Set-EtwTraceSession

Modifies an ETW trace session.

Syntax

Parameter Set: ByName
Set-EtwTraceSession [-Name] <String[]> [-BufferSize <UInt32> ] [-CimSession <CimSession[]> ] [-ClockType <ClockType> {Performance | System | Cycle} ] [-FlushTimer <UInt32> ] [-LocalFilePath <String> ] [-LogFileMode <UInt32> ] [-MaximumBuffers <UInt32> ] [-MaximumFileSize <UInt32> ] [-PassThru] [-ThrottleLimit <Int32> ] [-Confirm] [-WhatIf] [ <CommonParameters>] [ <WorkflowParameters>]

Parameter Set: InputObject (cdxml)
Set-EtwTraceSession [-BufferSize <UInt32> ] [-CimSession <CimSession[]> ] [-ClockType <ClockType> {Performance | System | Cycle} ] [-FlushTimer <UInt32> ] [-LocalFilePath <String> ] [-LogFileMode <UInt32> ] [-MaximumBuffers <UInt32> ] [-MaximumFileSize <UInt32> ] [-PassThru] [-ThrottleLimit <Int32> ] [-Confirm] [-WhatIf] [ <CommonParameters>] [ <WorkflowParameters>]

Detailed Description

The Set-EtwTraceSession cmdlet modifies an Event Trace for Windows (ETW) trace session. After you run this cmdlet, changes become effective immediately. You do not need to stop and restart the session.

Parameters

-BufferSize<UInt32>

Specifies the size, in kilobytes, of buffers. We recommend less than 1000 kilobytes. If you do not specify a value for this parameter, ETW uses the size of physical memory to calculate a default value.

-CimSession<CimSession[]>

Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a New-CimSession or Get-CimSession cmdlet. The default is the current session on the local computer.

-ClockType<ClockType>

Specifies the timer to use for the time stamp for events. Valid values are:

-- Performance. Performance counter value (high resolution)
-- System. System timer
-- Cycle. CPU cycle counter

The default value is Performance on computers that run Windows Vista and subsequent versions of the Windows operating system. The default value is System for previous versions of the Windows operating system.

-FlushTimer<UInt32>

Specifies the interval, in seconds, at which to flush trace buffers. The minimum value is 1 second. This forced flush is in addition to the automatic flush that occurs when a buffer is full and when the trace session stops.

For a real-time logger, the default value of zero means that the flush time is 1 second. You can configure a real-time logger by specifying a value of EVENT_TRACE_REAL_TIME_MODE for the LogFileMode parameter.

The default value is zero. By default, buffers are flushed only when they are full.

-LocalFilePath<String>

Specifies the full path for an ETW log file.

-LogFileMode<UInt32>

Specifies one or more log modes. For valid values, see Logging Mode Constants.

Instead of writing to a log file, you can specify either EVENT_TRACE_BUFFERING_MODE or EVENT_TRACE_REAL_TIME_MODE. EVENT_TRACE_BUFFERING_MODE avoids the cost of flushing the contents of the session to disk when the file system becomes available.

Autologger sessions do not support the EVENT_TRACE_FILE_MODE_NEWFILE logging mode.

If you specify EVENT_TRACE_FILE_MODE_APPEND, specify a value for the BufferSize parameter that is the same in both the logger and the file being appended.

Specify more than one log mode, add the values of the modes. For instance, to include both EVENT_TRACE_FILE_MODE_CIRCULAR, which has a value of 0x00000002, and EVENT_TRACE_NO_PER_PROCESSOR_BUFFERING, which has a value of 0x10000000, add 0x10000000 and 0x00000002 to obtain 0x1000002.

-MaximumBuffers<UInt32>

Specifies the maximum number of buffers to allocate to the Autologger session. We recommend a value of the MinimumBuffers parameter plus twenty. The value must be greater than or equal to MinimumBuffers. If you do not specify a value for the current parameter, ETW uses the buffer size and the size of physical memory to calculate a default value.

This cmdlet can only increase the maximum number of buffers. It cannot decrease that number.

-MaximumFileSize<UInt32>

Specifies the maximum size, in megabytes, of a log file. The session is closed when the maximum size is reached, unless the session uses the circular log file mode. To specify no limit, specify a value of zero. The default value is 100 MB. When the log file size reaches its maximum size, the behavior depends on the value specified by the LogFileMode parameter.

-Name<String[]>

Specifies an array of names of the ETW trace sessions to modify.

-PassThru

Indicates that this cmdlet returns an object that represents the item on which it operates. By default, this cmdlet does not generate any output.

-ThrottleLimit<Int32>

Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of zero is entered, then Windows PowerShell® calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.

-Confirm

Prompts you for confirmation before running the cmdlet.

-WhatIf

Shows what would happen if the cmdlet runs. The cmdlet is not run.

<CommonParameters>

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see    about_CommonParameters.

<WorkflowParameters>

This cmdlet supports the following workflow common parameters: -PSParameterCollection, -PSComputerName, -PSCredential, -PSConnectionRetryCount, -PSConnectionRetryIntervalSec, -PSRunningTimeoutSec, -PSElapsedTimeoutSec, -PSPersist, -PSAuthentication, -PSAuthenticationLevel, -PSApplicationName, -PSPort, -PSUseSSL, -PSConfigurationName, -PSConnectionURI, -PSAllowRedirection, -PSSessionOption, -PSCertificateThumbprint, -PSPrivateMetadata, -AsJob, -JobName, and –InputObject. For more information, see    about_WorkflowCommonParameters.

Inputs

The input type is the type of the objects that you can pipe to the cmdlet.

Outputs

The output type is the type of the objects that the cmdlet emits.

Examples

Example 1: Modifyies a trace sessiony

This command increases the maximum number of buffers for the trace session named NetCfgTrace.

PS C:\> Set-EtwTraceSession -Name "NetCfgTrace" -MaximumBuffers 24

Related topics

Logging Mode Constants

Get-EtwTraceSession

Remove-EtwTraceSession

Send-EtwTraceSession