ETW

Event Tracing for Windows (ETW) is a high‑performance, low‑overhead tracing facility built into the Microsoft Windows operating system. Introduced in Windows 2000, ETW provides a unified infrastructure for kernel‑mode and user‑mode components to emit structured event data that can be collected, filtered, and analyzed by developers, system administrators, and diagnostic tools.

ETW operates on the principle of providers, sessions, and consumers. A provider is a software component that defines one or more event types and writes events to the ETW subsystem. A session represents a tracing instance that specifies which providers are enabled, the level of detail to capture, and where the resulting data is stored, either in memory buffers or log files. Consumers are applications or utilities that retrieve and interpret the event data, commonly using the Windows Performance Analyzer, xperf, or third‑party solutions such as PerfView.

Key features of ETW include dynamic enablement of providers without requiring system restarts, selective filtering based on event level and keyword masks, and support for high‑frequency event generation with minimal impact on system performance. ETW data is stored in binary ETL (Event Trace Log) files, which can be post‑processed to generate visualizations, latency histograms, and other performance metrics.

Since its inception, ETW has been extended to cover a broad range of subsystems, including networking, storage, graphics, power management, and the .NET runtime. It also underpins Windows 10’s built‑in diagnostics tools such as Windows Performance Recorder and Windows Event Viewer. Microsoft continues to enhance ETW, adding new providers and improving tooling to aid in profiling, debugging, and security analysis across Windows platforms.