etw

Is there a tool to dump/show event data templates defined in a provider's manifest?

> wevtutil.exe gp <provider-name> /ge /gm /f:xml

prints the manifest given a provider, except for its data templates. Is there a tool I am missing that would display the templates defined in an installed provider's manifest? They must be out there in the binary WEVT_TEMPLATE resource, since the Tdh* functions seem to know about them.

Solution

  • Perfview can do this with this command:

    PerfView userCommand DumpRegisteredManifest <provider-name>

    This dumps the complete manifest into an XML.