Showing category results for Event Tracing for Windows

Windows Performance Analyzer (WPA) is one of the most powerful tools available for understanding system performance on Windows. It helps engineers investigate Event Tracing for Windows (ETW) traces across CPU, memory, disk, networking, scheduling, input, and many other areas of the operating system. That power also comes with complexity. A singl...

If you’ve ever opened an ETL trace with hundreds of data tables and wondered “where do I even start?” This post is for you. We’re releasing an early preview of the ETW MCP, a Model Context Protocol server that lets GitHub Copilot, or any MCP-aware AI assistant, read, query, and reason over Event Tracing for Windows (ETW) traces the same way an expe...

More often than not, we collect bigger trace files than we really need. Even though what we are interested in are just a few types of events from an event provider. Or other times, we want to see the call stacks of just a few events but not the rest from the event provider. Turning on the event provider with stacks without any filtering can result ...

This blog post explains EventProvider element in WPR profile and its child elements and attributes. Among many elements of the profile, EventProvider is the most used element and most configurable.

WPR supports configuring an autologger. Setting up the autologger and collecting the autologger trace is as easy as starting/stopping the trace. This article introduces how to start, stop, and cancel the autologger as well as export the autologger registry keys.

From time to time, I get questions about insufficient system resource error (0x800705aa) when starting the trace using WPR. The error can be frustrating, especially when there is enough memory and storage space left on the system. Some people try to solve the issue by increasing the system resources such as killing some apps and services. It does n...

In this post, I explained what the session name is in ETW and how to set the session name through WPR with the instancename option.

In this post, we enhance the simple custom profile for WPR by adding the system tracing session. Because kernel events provide critical information about processes, threads, modules, and more, collecting the system events greatly extends your ability to analyze traces and diagnose issues.

This is the first post in a multi-part series about authoring custom profiles for Windows Performance Recorder (WPR.) In a previous post, we have looked at how to start a trace with built-in profiles. The built-in profiles offer wide variety of preset profiles that we can use for different scenarios. There are built-in profiles for CPU usage, Ne...