Each trace provider defines a control GUID that uniquely identifies the provider. Windows, along with other applications and drivers, use the GUID to associate WMI control messages (such as start, enable, and stop) with the provider.
The control GUID appears in the WPP_CONTROL_GUIDS macro in the source code file for an instrumented trace provider.
#define WPP_CONTROL_GUIDS \ WPP_DEFINE_CONTROL_GUID(GUIDFriendlyName, (ControlGUID), \ WPP_DEFINE_BIT(NameOfTraceFlag1) \ WPP_DEFINE_BIT(NameOfTraceFlag2) \ ............................. \ ............................. \ WPP_DEFINE_BIT(NameOfTraceFlag31) )
Tracepdb creates a trace (MOF) file that contains the control GUID and the trace levels of each trace provider that is represented in the PDB file. The name of the MOF file is the module name of the trace provider. Tracepdb can also produce a TMC file if you use the -c option.
Because the control GUID identifies the trace provider to Event Tracing for Windows (ETW), you can use the control GUID to define and redefine the scope of a trace provider. For example, multiple drivers can be part of a single trace provider by specifying the same control GUID. Or, a single driver can include multiple trace providers by specifying different control GUIDs in each instance of the WPP_CONTROL_GUIDS macro.