Tracelog Enumguid Display

When you submit a tracelog -enumguid command, Tracelog displays a list of the trace providers that are running and have registered with Event Tracing for Windows (ETW).

Which Providers Appear in the Display?

The Tracelog enumguid display lists some of the providers that you can enable for a trace session, but it is not a complete list. It includes only the trace providers that are running and have registered with ETW.

The display does not include the following providers:

• Trace providers that are available on the system, but are not registered, usually because they are not running.
• Trace providers that are enabled for a trace session but are not currently running. (These are often called pre-enabled or pre-registered providers.) This includes providers that do not run continuously, such as DLLs that are loaded and unloaded as needed.
• Providers built into Windows, including providers for system sessions and providers for the Global Logger trace session and NT Kernel Logger trace session.

Elements of the Enumguid Display

The table in the Tracelog enumguid display includes the following columns.

Column heading	Description
Guid	The control GUID of the trace provider
Enabled	Shows whether the provider is currently enabled (TRUE) or is registered but not enabled (FALSE).
LoggerId	Identifies the trace session.
Level	The level currently set for the provider. Valid only when the provider is enabled.
Flags	The flags currently set for the provider. Valid only when the provider is enabled.

If a provider is registered but not enabled, then it appears in the enumguid display but its entry in the Enabled column is FALSE.

If a provider is enabled but is not currently running and is, therefore, not registered, then it does not appear in the enumguid display.