MSFT_EtwTraceSession class
Represents a running Event Tracing for Windows (ETW) trace session.
The following syntax is simplified from Managed Object Format (MOF) code and includes all of the inherited properties.
Syntax
[UMLPackagePath("CIM::Core::CoreElements"), dynamic, provider("EventTracingManagement"), Version("1.0"), AMENDMENT]
class MSFT_EtwTraceSession : CIM_LogicalElement
{
string InstanceID;
string Caption;
string Description;
string ElementName;
datetime InstallDate;
uint16 OperationalStatus[];
string StatusDescriptions[];
string Status;
uint16 HealthState;
uint16 CommunicationStatus;
uint16 DetailedStatus;
uint16 OperatingStatus;
uint16 PrimaryStatus;
string Name;
uint32 LogFileMode;
uint32 BufferSize;
uint32 MinimumBuffers;
uint32 MaximumBuffers;
uint32 FlushTimer;
uint32 ClockType;
uint32 MaximumFileSize;
string LocalFilePath;
};
Members
The MSFT_EtwTraceSession class has these types of members:
Methods
The MSFT_EtwTraceSession class has these methods.
| Method | Description |
|---|---|
| Send | Sends the log file of the specified ETW trace session to a remote share. |
Properties
The MSFT_EtwTraceSession class has these properties.
-
BufferSize
-
-
Data type: uint32
-
Access type: Read-only
The buffer size for the trace session, in KB.
-
-
Caption
-
-
Data type: string
-
Access type: Read-only
-
Qualifiers: MaxLen (64)
A short one-line description of the object.
This property is inherited from CIM_ManagedElement.
-
-
ClockType
-
-
Data type: uint32
-
Access type: Read-only
The clock resolution to use when logging the time stamp for each trace event.
The possible values are:
-
-
Performance counter value (high resolution) (1)
-
Query performance counter. This counter provides a high-resolution (100 nanoseconds) time stamp and is more resource-intensive to retrieve than system time.
-
System timer (2)
-
System timer. The system time provides a low-resolution (10 milliseconds) time stamp and is less resource-intensive to retrieve than the query performance counter.
-
CPU cycle counter (3)
-
CPU cycle counter. The CPU counter provides the highest resolution time stamp and is the least resource-intensive to retrieve. However, the CPU counter is unreliable and should not be used in production.
CommunicationStatus
-
Data type: uint16
-
Access type: Read-only
The ability of the instrumentation to communicate with this element. A NULL value indicates that instrumentation does not support this property.
The possible values are.
Unknown (0)
The instrumentation cannot report on the CommunicationStatus property at this time.
Not Available (1)
The instrumentation is capable of reporting this property, but intentionally does not for this element.
Communication OK (2)
The instrumentation has established communication with the element.
Lost Communication (3)
The element has been contacted in the past, but is currently unreachable.
No Contact (4)
The instrumentation has contact information for this element, but has never been able to communicate with it.
DMTF Reserved
Reserved.
Vendor Reserved
Reserved.
This property is inherited from CIM_ManagedSystemElement.
Description
-
Data type: string
-
Access type: Read-only
A textual description of the object.
This property is inherited from CIM_ManagedElement.
DetailedStatus
-
Data type: uint16
-
Access type: Read-only
-
Qualifiers: ModelCorrespondence ("CIM_EnabledLogicalElement.PrimaryStatus", "CIM_ManagedSystemElement.HealthState")
Additional status details that complement the PrimaryStatus property. A NULL value indicates that the instrumentation does not support this property.
The possible values are.
Not Available (0)
The instrumentation is capable of reporting this property, but intentionally does not report it for this element.
No Additional Information (1)
No details have to be added to the PrimaryStatus property, for example when the PrimaryStatus is set to OK.
Stressed (2)
The element functions, but requires attention. Overload and overheated are examples of Stressed states.
Predictive Failure (3)
The element functions nominally, but predicts a failure in the near future.
Non-Recoverable Error (4)
The element is in an error condition that requires intervention.
Supporting Entity in Error (5)
An element on which the element depends is in error. This element might be OK but cannot function because of the state of a dependent element. An example is a network service or endpoint that cannot function due to lower-layer networking problems.
DMTF Reserved
Reserved.
Vendor Reserved
Reserved.
This property is inherited from CIM_ManagedSystemElement.
ElementName
-
Data type: string
-
Access type: Read-only
A user-friendly name for the object. This property allows each instance to define a user-friendly name in addition to its key properties, identity data, and description information.
This property is inherited from CIM_ManagedElement.
FlushTimer
-
Data type: uint32
-
Access type: Read-only
The timeout value used by the trace session for the flush capture buffer.
HealthState
-
Data type: uint16
-
Access type: Read-only
The current health of the element. This attribute expresses the health of this element, but not necessarily the health of its subcomponents.
The possible values are.
Unknown (0)
The implementation cannot report on HealthState at this time.
OK (5)
The element is fully functional and operates within normal operational parameters and without error.
Degraded/Warning (10)
The element is in working order, and all functionality is provided. However, the element does not function to the best of its abilities. For example, the element might not operate at optimal performance, or it might report recoverable errors.
Minor failure (15)
All functionality is available, but some functionality might be degraded.
Major failure (20)
The element is failing. It is possible that some or all of the functionality of this component is degraded or does not work.
Critical failure (25)
The element is nonfunctional, and recovery might not be possible.
Non-recoverable error (30)
The element has completely failed, and recovery is not possible. All functionality that this element provides has been lost.
DMTF Reserved
Reserved.
This property is inherited from CIM_ManagedSystemElement.
InstallDate
-
Data type: datetime
-
Access type: Read-only
When the object was installed. The lack of a value does not indicate that the object is not installed.
This property is inherited from CIM_ManagedSystemElement.
InstanceID
-
Data type: string
-
Access type: Read-only
Opaquely and uniquely identifies an instance of this class within the scope of the instantiating Namespace.
The value of this property must be unique within the NameSpace.
This property is inherited from CIM_ManagedElement.
LocalFilePath
-
Data type: string
-
Access type: Read-only
The local path and filename of the file that receives the trace information.
LogFileMode
-
Data type: uint32
-
Access type: Read-only
The log file mode of trace session.
MaximumBuffers
-
Data type: uint32
-
Access type: Read-only
The maximum number of buffers to use for the trace session.
MaximumFileSize
-
Data type: uint32
-
Access type: Read-only
The maximum file size of the trace event log.
MinimumBuffers
-
Data type: uint32
-
Access type: Read-only
The minimum number of buffers to use for the trace session.
Name
Name of the ETW trace session to get.
OperatingStatus
-
Data type: uint16
-
Access type: Read-only
-
Qualifiers: ModelCorrespondence ("CIM_EnabledLogicalElement.EnabledState")
The current operational condition of the element. A NULL value indicates that the instrumentation does not support this property.
The possible values are.
Unknown (0)
The instrumentation cannot report on the OperatingStatus property at this time.
Not Available (1)
The instrumentation is capable of reporting this property, but intentionally does not report it for this element.
Servicing (2)
The element is being configured, maintained, cleaned, or otherwise administered.
Starting (3)
The element is being initialized.
Stopping (4)
The element is being brought to an orderly stop.
Stopped (5)
The element is intentionally stopped.
Aborted (6)
The element stopped in an unexpected way.
Dormant (7)
The element is inactive or quiesced.
Completed (8)
The element completed its operation. We recommend using a PrimaryStatus property value of OK, Error, or Degraded to indicate success or failure of the operation.
Migrating (9)
The element is being moved between host elements.
Emigrating (10)
The element is being moved away from the host element.
Immigrating (11)
The element is being moved to a new host element.
Snapshotting (12)
A snapshot copy of the element is being created.
Shutting Down (13)
The element is being brought to an abrupt stop.
In Test (14)
The element is performing test functions.
Transitioning (15)
The element is between states and is not fully available in either state. Use another value that indicates a more specific transition if one is available.
In Service (16)
The element is in service and operational.
DMTF Reserved
Reserved.
Vendor Reserved
Reserved.
This property is inherited from CIM_ManagedSystemElement.
OperationalStatus
-
Data type: uint16 array
-
Access type: Read-only
-
Qualifiers: ArrayType ("Indexed"), ModelCorrespondence ("CIM_ManagedSystemElement.StatusDescriptions")
An array that contains indicators of the current status of the element. The first value of the OperationalStatus property should contain the primary status for the element.
Note
The OperationalStatus property replaces the deprecated Status property. Due to the widespread use of the existing Status property in management applications, we strongly recommend that providers or instrumentation provide both the Status and OperationalStatus properties. When instrumented, Status, because it is a single-valued property, should also provide the primary status of the element.
The possible values are.
Unknown (0)
The implementation cannot report on the OperationalStatus property at this time.
Other (1)
An undefined state.
OK (2)
Full functionality without errors.
Degraded (3)
The element is in working order and all functionality is provided. However, the element does not function to the best of its abilities. For example, the element might not operate at optimal performance, or it might report recoverable errors.
Stressed (4)
The element functions, but requires attention. Overload and overheated are examples of Stressed states.
Predictive Failure (5)
The element functions nominally, but predicts a failure in the near future.
Error (6)
An error has occurred.
Non-Recoverable Error (7)
A nonrecoverable error has occurred.
Starting (8)
The job is starting.
Stopping (9)
The job is stopping.
Stopped (10)
The element has been intentionally stopped.
In Service (11)
The element is being configured, maintained, cleaned, or otherwise administered.
No Contact (12)
The monitoring system has information about this element, but has never been able to establish communications with it.
Lost Communication (13)
The monitoring system has successfully contacted this element in the past, but it is currently unavailable.
Aborted (14)
The job stopped in an unexpected way. The state and configuration of the job might require an update.
Dormant (15)
The job is inactive.
Supporting Entity in Error (16)
An element on which this job depends is in error. This element might be OK but cannot function because of the state of a dependent element. An example is a network service or endpoint that cannot function due to lower-layer networking problems.
Completed (17)
The job has completed its operation. This value should be combined with either OK, Error, or Degraded to indicate to a client whether the completed operation Completed with OK and passed, or completed with Error and failed, or completed with Degraded and finished the operation, but did not complete OK or did not report an error.
Power Mode (18)
The element has additional power model information that is contained in the associated power management service.
DMTF Reserved
Reserved.
Vendor Reserved
Reserved.
This property is inherited from CIM_ManagedSystemElement.
PrimaryStatus
-
Data type: uint16
-
Access type: Read-only
-
Qualifiers: ModelCorrespondence ("CIM_ManagedSystemElement.DetailedStatus", "CIM_ManagedSystemElement.HealthState")
A high-level status value.
The possible values are.
Unknown (0)
OK (1)
Degraded (2)
Error (3)
DMTF Reserved
Vendor Reserved
This property is inherited from CIM_ManagedSystemElement.
Status
-
Data type: string
-
Access type: Read-only
-
Qualifiers: Deprecated ("CIM_ManagedSystemElement.OperationalStatus"), MaxLen (10)
The primary status of the object.
Note
This property is deprecated. It is replaced by the OperationalStatus property. If you choose to use the Status property for backward compatibility, it should be secondary to the OperationalStatus property.
The possible values are.
"OK"
"Error"
"Degraded"
"Unknown"
"Pred Fail"
"Starting"
"Stopping"
"Service"
"Stressed"
"NonRecover"
"No Contact"
"Lost Comm"
"Stopped"
This property is inherited from CIM_ManagedSystemElement.
StatusDescriptions
-
Data type: string array
-
Access type: Read-only
-
Qualifiers: ArrayType ("Indexed"), ModelCorrespondence ("CIM_ManagedSystemElement.OperationalStatus")
An array that contains descriptions of the corresponding values in the OperationalStatus array.
This property is inherited from CIM_ManagedSystemElement.
Requirements
| Minimum supported client |
Windows 10 [desktop apps only] |
| Minimum supported server |
Windows Server 2016 |
| Namespace |
Root\Microsoft\Windows\EventTracingManagement |
| MOF |
|
| DLL |
|