SystemProvider

Article
02/10/2014

Applies To: Windows 8, Windows 8.1

Describes the configuration to enable the kernel-mode provider. The system provider definition specifies what system keywords, stacks, and pool tags to enable.

Element Hierarchy

Syntax

<SystemProvider Id   = IdType
                Base = string>

  <!-- Child elements -->
  Keywords,
  Stacks,
  PoolTags

</SystemProvider>

Attributes and Elements

Attributes

Attribute	Description	Data type	Required	Default
Id	Uniquely identifies the system provider.	String that must have at least one character and cannot contain colons (:) or spaces.	Yes
Base	Indicates the base of the system provider. Derived providers have all the attributes of the base provider by default. These can be overridden by explicitly specifying them in the derived provider.	string	No

Child Elements

Element	Description	Requirement
Keywords (in SystemProvider)	Represents a collection of keywords and custom keywords.	Required, exactly 1.
Stacks	Represents a collection of stacks.	Required, exactly 1.
PoolTags	Represents a collection of pool tags.	Required, exactly 1.

Parent Elements

Element	Description
Profiles	Represents a collection of collectors, providers, and profiles.
SystemCollectorId	Represents a system collector identifier.

Remarks

For information about how to define pool tags, see PoolTag.

Example

<SystemProvider Id="system-provider">
  <Keywords>
    <Keyword Value="ProcessThread"/>
    <Keyword Value="Loader"/>
    <Keyword Value="CSwitch"/>
  </Keywords>
  <Stacks>
    <Stack Value="ThreadCreate"/>
    <Stack Value="ReadyThread"/>
    <Stack Value="CSwitch"/>
  </Stacks>
  <PoolTags>
    <PoolTag Value="a*"/>
    <PoolTag Value="b*"/> 
    <PoolTag Value="c*"/> 
    <PoolTag Value="d*"/> 
  </PoolTags>
</SystemProvider>