Thread by @vagnerpilar

#ETW is an efficient kernel-level tracing facility that lets you log kernel or app-defined events to a log file (#ETL). You can consume the events in real time or from a log file and use them to debug an app or to determine where perf issues are occurring in the app. (1/17)

ETW lets you enable or disable event tracing dynamically, allowing you to perform detailed tracing in a production environment without requiring computer or application restarts. (2/17)

The Event Tracing API is broken into three distinct components:
1 - Controllers, which start and stop an event tracing session and enable providers
2 - Providers, which provide the events
3 - Consumers, which consume the events (3/17)

The following diagram shows the event tracing model: 4/17)

Controllers: Controllers are applications that define the size and location of the log file, start and stop event tracing sessions, enable providers so they can log events to the session, manage the size of the buffer pool, and obtain execution statistics for sessions. (5/17)

Session statistics include the number of buffers used, the number of buffers delivered, and the number of events and buffers lost. Common applications include the Windows Performance Recorder (WPR), Log Manager (Logman), Xperf (Legacy). (6/17)

Providers: Providers are applications that contain event tracing instrumentation. After a provider registers itself, a controller can then enable or disable event tracing in the provider. The provider defines its interpretation of being enabled or disabled. (7/17)

Generally, an enabled provider generates events, while a disabled provider does not. This lets you add event tracing to your application without requiring that it generate events all the time. (8/17)

Although the ETW model separates the controller and provider into separate applications, an application can include both components. (9/17)

Consumers: Consumers are applications that select one or more event tracing sessions as a source of events. A consumer can request events from multiple event tracing sessions simultaneously; the system delivers the events in chronological order. (10/17)

Consumers can receive events stored in log files (ETL), or from sessions that deliver events in real time. When processing events, a consumer can specify start and end times, and only events that occur in the specified time frame will be delivered. (11/17)

Missing Events: Perfmon, System Diagnostics, and other system tools may report on missing events in the Event Log and indicate that the settings for Event Tracing for Windows (ETW) may not be optimal. (12/17)

Events can be lost for a number of reasons:
The total event size is greater than 64K. This includes the ETW header plus the data or payload. A user has no control over these missing events since the event size is configured by the application. (13/17)

The ETW buffer size is smaller than the total event size. A user has no control over these missing events since the event size is configured by the application logging the events. (14/17)

For real-time logging, the real-time consumer is not consuming events fast enough or is not present altogether and then the backing file is filling up. This can result if the Event Log service is stopped and started when events are being logged. (15/17)

A user has no control over these missing events.
When logging to a file, the disk is too slow to keep up with the logging rate.
If the missing events are being reported in the Event Log Service, this may indicate a problem with the configuration of the Event Log service. (16/17)

The user may have some limited ability to increase the maximum disk space to be used by the Event Log Service which may reduce the number of missing events. (17/17)