Event Tracing for Windows

Filtering events using WPR

October 30, 2022 Oct 30, 2022 10/30/22

Sowoon Pyo

More often than not, we collect bigger trace files than we really need. Even though what we are interested in are just a few types of events from an event provider. Or other times, we want to see the call stacks of just a few events but not the rest from the event provider. Turning on the event provider with stacks without any filtering can ...

Authoring Custom Profile – Part 3

November 8, 2021 Nov 8, 2021 11/8/21

Sowoon Pyo

This blog post explains EventProvider element in WPR profile and its child elements and attributes. Among many elements of the profile, EventProvider is the most used element and most configurable.

Setting up an autologger with WPR

June 25, 2021 Jun 25, 2021 06/25/21

Sowoon Pyo

WPR supports configuring an autologger. Setting up the autologger and collecting the autologger trace is as easy as starting/stopping the trace. This article introduces how to start, stop, and cancel the autologger as well as export the autologger registry keys.

WPR fails to start, insufficient system resources?

March 31, 2021 Mar 31, 2021 03/31/21

Sowoon Pyo

From time to time, I get questions about insufficient system resource error (0x800705aa) when starting the trace using WPR. The error can be frustrating, especially when there is enough memory and storage space left on the system. Some people try to solve the issue by increasing the system resources such as killing some apps and services. It ...

Controlling the event session name with the instance name

January 27, 2021 Jan 27, 2021 01/27/21

Sowoon Pyo

In this post, I explained what the session name is in ETW and how to set the session name through WPR with the instancename option.

Authoring Custom Profiles – Part 2

December 10, 2020 Dec 10, 2020 12/10/20

Sowoon Pyo

In this post, we enhance the simple custom profile for WPR by adding the system tracing session. Because kernel events provide critical information about processes, threads, modules, and more, collecting the system events greatly extends your ability to analyze traces and diagnose issues.

Authoring custom profiles – Part 1

November 10, 2020 Nov 10, 2020 11/10/20

Sowoon Pyo

This is the first post in a multi-part series about authoring custom profiles for Windows Performance Recorder (WPR.) In a previous post, we have looked at how to start a trace with built-in profiles. The built-in profiles offer wide variety of preset profiles that we can use for different scenarios. There are built-in profiles for CPU ...

Performance and Diagnostics