Display Filter Reference: Event Tracing for Windows
Protocol field name: etw
Versions: 3.6.0 to 4.4.1
Back to Display Filter Reference
Field name | Description | Type | Versions |
---|---|---|---|
etw | Activity ID | Globally Unique Identifier | 3.6.0 to 4.4.1 |
etw | Alignment | Unsigned integer (8 bits) | 3.6.0 to 4.4.1 |
etw | ID | Unsigned integer (16 bits) | 3.6.0 to 4.4.1 |
etw | Processor Number | Unsigned integer (8 bits) | 3.6.0 to 4.4.1 |
etw | Channel | Unsigned integer (8 bits) | 3.6.0 to 4.4.1 |
etw | ID | Unsigned integer (16 bits) | 3.6.0 to 4.4.1 |
etw | Keywords | Unsigned integer (64 bits) | 3.6.0 to 4.4.1 |
etw | Level | Unsigned integer (8 bits) | 3.6.0 to 4.4.1 |
etw | Opcode | Unsigned integer (8 bits) | 3.6.0 to 4.4.1 |
etw | Task | Unsigned integer (16 bits) | 3.6.0 to 4.4.1 |
etw | Version | Unsigned integer (8 bits) | 3.6.0 to 4.4.1 |
etw | Event Property | Unsigned integer (16 bits) | 3.6.0 to 4.4.1 |
etw | Flags | Unsigned integer (16 bits) | 3.6.0 to 4.4.1 |
etw | 32-bit Header | Unsigned integer (32 bits) | 4.4.0 to 4.4.1 |
etw | 64-bit Header | Unsigned integer (32 bits) | 4.4.0 to 4.4.1 |
etw | Classic Header | Unsigned integer (32 bits) | 4.4.0 to 4.4.1 |
etw | Decode GUID | Unsigned integer (32 bits) | 4.4.0 to 4.4.1 |
etw | Extended Info | Unsigned integer (32 bits) | 4.4.0 to 4.4.1 |
etw | No CPU time | Unsigned integer (32 bits) | 4.4.0 to 4.4.1 |
etw | Private Session | Unsigned integer (32 bits) | 4.4.0 to 4.4.1 |
etw | Processor Index | Unsigned integer (32 bits) | 4.4.0 to 4.4.1 |
etw | String Only | Unsigned integer (32 bits) | 4.4.0 to 4.4.1 |
etw | Trace Message | Unsigned integer (32 bits) | 4.4.0 to 4.4.1 |
etw | Header Type | Unsigned integer (16 bits) | 3.6.0 to 4.4.1 |
etw | Event Message | Character string | 3.6.0 to 4.4.1 |
etw | Message Length | Unsigned integer (32 bits) | 3.6.0 to 4.4.1 |
etw | Process ID | Unsigned integer (32 bits) | 3.6.0 to 4.4.1 |
etw | Processor Time | Unsigned integer (64 bits) | 3.6.0 to 4.4.1 |
etw | Forwarded XML | Unsigned integer (32 bits) | 4.4.0 to 4.4.1 |
etw | Legacy Event Log | Unsigned integer (32 bits) | 4.4.0 to 4.4.1 |
etw | Legacy Reloggable | Unsigned integer (32 bits) | 4.4.0 to 4.4.1 |
etw | XML | Unsigned integer (32 bits) | 4.4.0 to 4.4.1 |
etw | Provider ID | Globally Unique Identifier | 3.6.0 to 4.4.1 |
etw | Provider Name | Character string | 3.6.0 to 4.4.1 |
etw | Provider Name Length | Unsigned integer (32 bits) | 3.6.0 to 4.4.1 |
etw | Size | Unsigned integer (16 bits) | 3.6.0 to 4.4.1 |
etw | Thread ID | Unsigned integer (32 bits) | 3.6.0 to 4.4.1 |
etw | Time Stamp | Unsigned integer (64 bits) | 3.6.0 to 4.4.1 |
etw | User Data Length | Unsigned integer (32 bits) | 3.6.0 to 4.4.1 |