Skip to content

Instantly share code, notes, and snippets.

What would you like to do?
EventTracingManagement Cmdlets Test (added in Windows 10)
$ErrorActionPreference = "Stop"
Import-Module EventTracingManagement #Require Windows 10 enviroment(it use underlying CIM APIs
Use-NuGetPackage Microsoft.Diagnostics.Tracing.TraceEvent -Verbose #Require PSNuGet<>
$sessionName = "MyRealTimeSession"
$providerName = "Sample.EtwTrace"
$providerGuid = [Microsoft.Diagnostics.Tracing.Session.TraceEventProviders]::GetEventSourceGuidFromName($providerName)
Write-Verbose ('Create ETW RealTimeSession')
$params = @{
Name = $sessionName
LogFileMode = 0x8400100 #RealTimeSession value
MinimumBuffers = 1024
MaximumBuffers = 1290
$traceSession = New-EtwTraceSession @params
Write-Verbose ('Add ETW Provider to session')
$params = @{
SessionName = $traceSession.Name
Guid = $providerGuid.ToString('B') #specific GUID string format required?
$traceSession = Add-EtwTraceProvider @params
#TODO: There is no way to start RealTimeTraceSession proceccing that equivalent to session.Source.Process();
sleep 10
#TODO: RealTimeSession don't support this Cmdlets?
#Send-EtwTraceSession -Name $sessionName -DestinationFolder "C:\Temp"
Remove-EtwTraceSession -Name $sessionName -ErrorAction Ignore
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.