2.2.9 ExtendedModes

ExtendedModes is a subset of the LogFileMode constants, for more information see [MSDN-EVENT_TRACE_PROPERTIES]. The following values are valid for ExtendedModes.

Constant/value

Description

EVENT_TRACE_PRIVATE_LOGGER_MODE

0x00000800

Uses a private trace session for logging events. A private event tracing session is a tracing session that runs in the same process as the event trace provider that is logging events to that session. The memory for buffers comes from the process memory.

To create a unique log file name, ETW will append the process identifier to the log file name. For example, if the log file name is myprivatelog.etl, the log file that will be created is myprivatelog.etl_nnnn where nnnn is the process identifier.

ETW imposes the following restrictions on private event tracing sessions:

  • A private session can record events only for the threads of the process in which it is executing.

  • ETW only supports a private session for user-mode event tracing providers. ETW does not support private session tracing for kernel-mode providers.

  • There can be only one private session per process.

  • Private sessions cannot be used when ITraceDataCollector::StreamMode is set to plaRealTime.

  • Only the 'LocalSystem' account, the administrator, and users in the administrator group that run in an elevated process can create a private session.

EVENT_TRACE_USE_GLOBAL_SEQUENCE

0x00004000

Uses sequence numbers that are unique across event tracing sessions.

EVENT_TRACE_USE_LOCAL_SEQUENCE

0x00008000

Uses sequence numbers that are unique only for an individual event tracing session

EVENT_TRACE_USE_PAGED_MEMORY

0x01000000

Uses paged memory. This setting is recommended so that events do not use up the nonpaged memory. Nonpaged buffers use expensive nonpaged memory for buffer space. Because nonpaged buffers are never paged out, a logging session performs well. Using pageable buffers is less costly. Tracing sessions that are to receive events from kernel mode components at an interrupt request level (IRQL) higher than passive level cannot use paged pool buffers.

EVENT_TRACE_USE_GLOBAL_SEQUENCE and EVENT_TRACE_USE_LOCAL_SEQUENCE are mutually exclusive.