How to use ETW from a C++ Windows client

c++ etw
Charles picture Charles · Jan 25, 2010 · Viewed 11.6k times · Source

I'm researching Event Tracing for Windows (ETW) to allow a user-mode windows client to write out tracing information. The existing documentation is, to put it lightly, insanely incomplete. What would really help is a simple C++ example that writes out tracing messages using ETW. Does such an example exist? Is there other ETW documentation you might recommend?

Answer

bahree picture bahree · Jan 25, 2010

To write a Provider for ETW, you have two options:

  • write it as a manifest-based provider (preferred for Windows Vista or higher). Check out an example here.

  • write it as a classic provider for legacy support. You can find an example here.

I suppose you want to use a manifest-based approach, as its better and can support up to eight sessions. The first step a manifest-based provider needs to do is to register the event using EventRegister() and then write to it via the EventWrite() or EventWriteString() function.

Related questions

Easiest way to convert int to string in C++

What is the easiest way to convert from int to equivalent string in C++. I am aware of two methods. Is there any easier way? (1) int a = 10; char *intStr = itoa(a); string str = string(intStr); (2) int a = 10; stringstream ss; ss &…

Read More
The Definitive C++ Book Guide and List

This question attempts to collect the few pearls among the dozens of bad C++ books that are published every year. Unlike many other programming languages, which are often picked up on the go from tutorials found on the Internet, few …

Read More
How do I iterate over the words of a string?

I'm trying to iterate over the words of a string. The string can be assumed to be composed of words separated by whitespace. Note that I'm not interested in C string functions or that kind of character manipulation/access. Also, …

Read More