Share via

EventNameFilters

  • Article

EventNameFilters element includes or excludes tracelogging events based on their names.

Note

Available on Windows 10, version 1709 and later.

Element Hierarchy

Syntax

<EventNameFilters FilterIn="true|false" Level="unsigned byte" Operation ="Set|Add|Remove" >

  <!-- Child elements -->
  <Keyword>
  <EventName>

</EventNameFilters>

Attributes and Elements

Attributes

Attribute Description Data type Required Default
FilterIn Indicates whether to include or exclude the specified stackwalk events. boolean Yes
Level event level Unsigned byte No
Operation Indicates whether keywords should be set or added. This attribute can have one of the following values:
  • Set
  • Add
  • Remove
 No Set

Child Elements

Element Description Requirement
EventName A tracelogging event name. Required, 1 or more.
Keyword Event keyword Optional

Parent Elements

Element Description
EventProvider Represents an event provider for the profile.

Remark

EventNameFilters element enables event filtering through EVENT_FILTER_DESCRIPTOR, Type EVENT_FILTER_TYPE_EVENT_NAME.

Even though ETW supports powerful payload and attribute filtering, events should primarily be filtered based scope filters or via level and keyword for less CPU overhead.

Example

    <EventProvider Id="EventProvider_TraceLogGen" Name="3970F9cf-2c0c-4f11-b1cc-e3a1e9958833">
      <EventNameFilters FilterIn="true" Level="5">
        <Keyword Value="0x10000000000000"/>
        <EventName Value="Preset1"/>
        <EventName Value="Preset2"/>
      </EventNameFilters>
    </EventProvider>

Elements