Tracelog Overview

Tracelog controls event tracing from the command line, and it provides the following functions and features:

• Starts and stops tracing sessions, including private tracing sessions and tracing of Windows kernel and boot-time events.
• Configures and changes the properties of tracing sessions.
• Enables and disables trace providers.
• Flushes tracing session buffers.
• Lists active (real-time) tracing sessions.
• Lists registered trace providers.
• Measures time spent in deferred procedure calls (DPCs) and interrupt service routines (ISRs).

Tracelog produces an event trace log (.etl) file that contains the trace messages generated by the provider during the tracing session. The messages are stored in binary format in the file. To display the trace messages in a readable format, use TraceView or Tracefmt, tools that are part of the Windows Driver Kit and installed with Visual Studio.

Tracelog controls kernel-mode and private (user-mode) tracing sessions, as well as special tracing sessions, such as NT Kernel Logger, which traces Windows kernel events, and Global Logger, which traces events that occur during the boot process.

For more information about Tracelog, TraveView, and Tracefmt, see Tracelog (Windows Drivers), TraceView (Windows Drivers), Tracefmt (Windows Drivers) on MSDN.