Trace Level

Trace levels are properties of a trace provider, such as a kernel-mode driver or user-mode application. Trace levels determine which events the trace provider generates. Typically, the trace level represents the severity of the event (information, warning, or error), but trace providers can define them to represent any condition for generating the trace message.

Unlike trace flags, which are defined by the trace provider in the WPP_CONTROL_GUIDS structure, trace levels are defined in Evntrace.h, a public header file. However, the trace provider interprets the level and determines its effect

Trace consumers such as Tracelog and TraceView, pass a trace level to the provider in the EnableLevel parameter of the EnableTrace function. For information about EnableTrace, see the Microsoft Windows SDK documentation.

Developers of trace providers can also write customized tracing functions (alternatives to DoTraceMessage) that include the trace level as a condition for generating the trace message. For instructions, see Can I customize DoTraceMessage?

When running a trace session, users can use the trace level to determine which messages will be generated during the session. Trace consumers, such as Tracelog and TraceView, let users set parameters and options to select the trace flags and trace level for each provider in a trace session.

Like trace flags, users can change the trace level while a trace session is running by reenabling the trace provider.