On Windows, TraceLogging is a system for creating self-describing ETW events that can be decoded without a manifest. Support for TraceLogging on Windows is included with the Windows OS and the Windows SDK. The technology includes:
- Rules for how to pack the data into the event payload and for how to send the event to the ETW system.
- Operating system support for decoding events, including TDH APIs.
- SDK tools for decoding events, including tracefmt.
- TraceLoggingProvider.h header in the Windows SDK supports generating TraceLogging-encoded events using C or C++ for kernel and user-mode code.
- EventSource
class supports generating TraceLogging-encoded events (when using the
Writemethod or when constructed using the EtwSelfDescribingEventFormat flag). - LoggingChannel Windows Runtime class supports generating TraceLogging-encoded events.
This project provides additional support for TraceLogging developers:
- TraceLoggingDynamic for C++ provides support for generating runtime-dynamic events from C++ code.
- TraceLoggingDynamic for C# provides support for generating runtime-dynamic events from C# code.
- TraceLoggingDynamic for Python provides support for generating runtime-dynamic events from Python3 code.
- TraceLogging for Rust provides support for generating events from Rust code.