2.2.9 ExtendedModes
ExtendedModes is a subset of the LogFileMode constants, for more information see [MSDN-EVENT_TRACE_PROPERTIES]. The following values are valid for ExtendedModes.
|
Constant/value |
Description |
|---|---|
|
EVENT_TRACE_PRIVATE_LOGGER_MODE 0x00000800 |
Uses a private trace session for logging events. A private event tracing session is a tracing session that runs in the same process as the event trace provider that is logging events to that session. The memory for buffers comes from the process memory. To create a unique log file name, ETW will append the process identifier to the log file name. For example, if the log file name is myprivatelog.etl, the log file that will be created is myprivatelog.etl_nnnn where nnnn is the process identifier. ETW imposes the following restrictions on private event tracing sessions:
|
|
EVENT_TRACE_USE_GLOBAL_SEQUENCE 0x00004000 |
Uses sequence numbers that are unique across event tracing sessions. |
|
EVENT_TRACE_USE_LOCAL_SEQUENCE 0x00008000 |
Uses sequence numbers that are unique only for an individual event tracing session |
|
EVENT_TRACE_USE_PAGED_MEMORY 0x01000000 |
Uses paged memory. This setting is recommended so that events do not use up the nonpaged memory. Nonpaged buffers use expensive nonpaged memory for buffer space. Because nonpaged buffers are never paged out, a logging session performs well. Using pageable buffers is less costly. Tracing sessions that are to receive events from kernel mode components at an interrupt request level (IRQL) higher than passive level cannot use paged pool buffers. |
EVENT_TRACE_USE_GLOBAL_SEQUENCE and EVENT_TRACE_USE_LOCAL_SEQUENCE are mutually exclusive.