Providers are Event Tracing for Windows (ETW) components that expose events to Windows Performance Recorder (WPR). You can use a single system provider and multiple event providers in a profile, including a heap event provider.
A system provider provides kernel events. System providers are defined by using the following:
Keywords for the events to be collected.
Stacks from which to collect events.
Pool tags to indicate the component that made the allocation or the allocation type.
For a description of supported system keywords, see Keyword (in SystemProvider).
You can configure event providers to provide certain types of events (among those that are supported by the provider) by specifying a hexadecimal bitmask keyword. Because providers support different events, there are no string constants for these keywords. Therefore, they must be hexadecimal-style strings.