System Providers

Beginning in Windows 10 SDK build 20348, the System Trace Provider's events can be enabled in the same way that other ETW providers are, with EnableTraceEx2. The different flags and group masks associated with the System Trace Provider have been mapped to new trace providers, called System Providers, and matching keywords.

Like enabling the System Trace Provider directly, the System Providers can only be enabled by a session with the EVENT_TRACE_SYSTEM_LOGGER_MODE set.

System Provider reference

• System ALPC Provider
• System Config Provider
• System CPU Provider
• System Hypervisor Provider
• System Interrupt Provider
• System IO Provider
• System IO Filter Provider
• System Lock Provider
• System Memory Provider
• System Object Provider
• System Power Provider
• System Process Provider
• System Profile Provider
• System Registry Provider
• System Scheduler Provider
• System Syscall Provider
• System Timer Provider

System ALPC Provider

Provides events related to the ALPC system.

GUID: SystemAlpcProviderGuid {fcb9baaf-e529-4980-92e9-ced1a6aadfdf}

System Config Provider

Provides system configuration events.

GUID: SystemConfigProviderGuid {fef3a8b6-318d-4b67-a96a-3b0f6b8f18fe}

System CPU Provider

Provides events related to the CPU.

GUID: SystemCpuProviderGuid {c6c5265f-eae8-4650-aae4-9d48603d8510}

System Hypervisor Provider

Provides events relating to the hypervisor.

GUID: SystemHypervisorProviderGuid {bafa072a-918a-4bed-b622-bc152097098f}

System Interrupt Provider

Provides events relating to DPCs and interrupts.

GUID: SystemInterruptProviderGuid {d4bbee17-b545-4888-858b-744169015b25}

System IO Provider

Provides events relating to multiple kinds of IO including disk, cache, and network.

GUID: SystemIoProviderGuid {3d5c43e3-0f1c-4202-b817-174c0070dc79}

Note: Enabling the SYSTEM_IO_KW_DRIVERS keyword will automatically enable SYSTEM_IO_KW_FILENAME as well. The SYSTEM_IO_KW_FILENAME is also automatically turned on when the System Memory Provider is enabled with the SYSTEM_MEMORY_KW_MEMORY keyword.

System IO Filter Provider

Provides events related to IO filtering including timing and failures.

GUID: SystemIoFilterProviderGuid {fbd09363-9e22-4661-b8bf-e7a34b535b8c}

System Lock Provider

Provides events relating to kernel locking mechanisms.

GUID: SystemLockProviderGuid {721ddfd3-dacc-4e1e-b26a-a2cb31d4705a}

System Memory Provider

Provides events relating to the memory manager.

GUID: SystemMemoryProviderGuid {82958ca9-b6cd-47f8-a3a8-03ae85a4bc24}

Notes:

• Enabling the SYSTEM_MEMORY_KW_MEMORY keyword will automatically enable SYSTEM_IO_KW_FILENAME on the System IO Provider as well.

• The events enabled by the SYSTEM_MEMORY_KW_POOL support a Pool Tag Filter, to selectively write events only for certain pool tags. This is configured as a Schematized Filter on the System Memory Provider. The PoolTag filter is constructed as follows:

  {
  EVENT_FILTER_HEADER Header; 
  ULONG PoolTags[ETW_MAX_POOLTAG_FILTER];
  }
  

• The EVENT_FILTER_HEADER should be initialized with Id set to SYSTEM_MEMORY_POOL_FILTER_ID and the size field set to the size of Header plus the used portion of the PoolTags array.

• Each Pool Tag is a 4 character string that is stored as a ULONG in the filter.

System Object Provider

Provides events relating to the Object Manager.

GUID: SystemObjectProviderGuid {febd7460-3d1d-47eb-af49-c9eeb1e146f2}

System Power Provider

Provides events relating to the system's power state.

GUID: SystemPowerProviderGuid {c134884a-32d5-4488-80e5-14ed7abb8269}

System Process Provider

Provides events relating to the process, including lifetime information, image load events, and thread related events.

GUID: SystemProcessProviderGuid {151f55dc-467d-471f-83b5-5f889d46ff66}

System Profile Provider

Provides profiling events.

GUID: SystemProfileProviderGuid {bfeb0324-1cee-496f-a409-2ac2b48a6322}

System Registry Provider

Provides events relating to the registry.

GUID: SystemRegistryProviderGuid {16156bd9-fab4-4cfa-a232-89d1099058e3}

System Scheduler Provider

Provides events relating to the scheduler.

GUID: SystemSchedulerProviderGuid {599a2a76-4d91-4910-9ac7-7d33f2e97a6c}

System Syscall Provider

Provides events with information about system calls.

GUID: SystemSyscallProviderGuid {434286f7-6f1b-45bb-b37e-95f623046c7c}

System Timer Provider

Provides events relating to timers in the kernel.

GUID: SystemTimerProviderGuid {4f061568-e215-499f-ab2e-eda0ae890a5b}

Remarks

This new enablement mechanism is in addition to the pre-existing methods for enabling these events. Any code that used to work, will continue to do so.

The events generated by the System Trace Provider are not changing due to this new feature. This means that the outputted events are not marked as being emitted from the individual system providers.

For more information on provider GUID and keyword definitions see evntrace.h.

See Also

Configuring and Starting a SystemTraceProvider Session

evntrace.h header