Share via

StackFilters

  • Article

StackFilters element specifies event Ids to include or exclude stacks from a manifest based provider.

Note

Available on Windows 10, version 1709 and later.

Element Hierarchy

Syntax

<StackFilters FilterIn = "true" | "false" Operation = "Set" | "Add" | "Remove" >

  <!-- Child elements -->
  <EventId>

</StackFilters>

Attributes and Elements

Attributes

Attribute Description Data type Required Default
FilterIn Indicates whether to include or exclude the specified events. boolean Yes
Operation Indicates whether keywords should be set or added. This attribute can have one of the following values:
  • Set
  • Add
  • Remove
 No Set

Child Elements

Element Description Requirement
EventId The event ID defined in a manifest. Required, 1 or more.

Parent Elements

Element Description
EventProvider Represents an event provider for the profile.

Remark

When stack walking is enabled for a provider, then the stack is captured for all the events generated by the provider. Most of the time, the user is only interested in stack from only certain number of events. This element allows enabling or disabling stack walking on a list of events based on event IDs.

Even though ETW supports powerful payload and attribute filtering, events should primarily be filtered based scope filters or via level and keyword for less CPU overhead.

Example

    <EventProvider Id="EP_Microsoft-Windows-Win32k" Name="8c416c79-d49b-4f01-a467-e56d3aa8234c" NonPagedMemory="true">
      <EventFilters FilterIn="false">
        <EventId Value="164" />
        <EventId Value="166" />
        <EventId Value="167" />
        <EventId Value="169" />
      </EventFilters>
      <StackFilters FilterIn="true">
        <EventId Value="88" />
        <EventId Value="65" />
      </StackFilters>
    </EventProvider>

Elements