Mobile software tracing

Event Tracing for Windows (ETW) is an efficient kernel-level tracing facility that lets you log kernel or application-defined events to a log file.

You can consume the events and use them to debug an application or to determine where performance issues are occurring in the application. ETW lets you enable or disable event tracing dynamically, allowing you to perform detailed tracing in a production environment without requiring device or application restarts.

In this section

Retrieve retail ETW logs
Describes how to retrieve logs from a retail device.

Capture event trace logs
Describes how to capture event logs.

Capture power management events
Describes how to capture power management events.

Tracing Tool Concepts
Describes tracing tool concepts.

Tracelog
Provides information about Tracelog and its usage.

ETW User-Mode Reference
Documents ETW user-mode APIs.

ETW Kernel-Mode Reference
Documents ETW kernel-mode APIs.