Registered Provider

A registered provider is a trace provider that registers with Event Tracing for Windows (ETW), which are the tracing components of Windows. As part of the registration, Windows associates the trace provider's control GUID with the GUIDs of its event trace classes. Users can enumerate registered providers and refer to them by name.

Trace providers typically register with ETW when they start, either by calling RegisterTraceGuids or by using the WPP_INIT_TRACING macro. They unregister just before they stop, either by calling UnregisterTraceGuids or by using the WPP_CLEANUP macro.

Providers are not required to register with Windows, and many do not, so the list of registered providers on the system might not include many of the available trace providers.

Trace providers also can register with Windows Management Instrumentation (WMI) by submitting a Managed Object Format (MOF) file. Registering with WMI does not register a provider with ETW; the registrations are independent. Providers who register with WMI are not considered to be "registered providers."

To display trace messages from a registered provider, use TraceView. For instructions, see Creating a trace session for a registered provider.

For more information about registered providers, see Event Tracing in the Microsoft Windows SDK.