Display Filter Reference: Event Tracing for Windows
Protocol field name: etw
Versions: 3.6.0 to 4.4.2
Back to Display Filter Reference
| Field name | Description | Type | Versions |
|---|---|---|---|
| etw | Activity ID | Globally Unique Identifier | 3.6.0 to 4.4.2 |
| etw | Alignment | Unsigned integer (8 bits) | 3.6.0 to 4.4.2 |
| etw | ID | Unsigned integer (16 bits) | 3.6.0 to 4.4.2 |
| etw | Processor Number | Unsigned integer (8 bits) | 3.6.0 to 4.4.2 |
| etw | Channel | Unsigned integer (8 bits) | 3.6.0 to 4.4.2 |
| etw | ID | Unsigned integer (16 bits) | 3.6.0 to 4.4.2 |
| etw | Keywords | Unsigned integer (64 bits) | 3.6.0 to 4.4.2 |
| etw | Level | Unsigned integer (8 bits) | 3.6.0 to 4.4.2 |
| etw | Opcode | Unsigned integer (8 bits) | 3.6.0 to 4.4.2 |
| etw | Task | Unsigned integer (16 bits) | 3.6.0 to 4.4.2 |
| etw | Version | Unsigned integer (8 bits) | 3.6.0 to 4.4.2 |
| etw | Event Property | Unsigned integer (16 bits) | 3.6.0 to 4.4.2 |
| etw | Flags | Unsigned integer (16 bits) | 3.6.0 to 4.4.2 |
| etw | 32-bit Header | Unsigned integer (32 bits) | 4.4.0 to 4.4.2 |
| etw | 64-bit Header | Unsigned integer (32 bits) | 4.4.0 to 4.4.2 |
| etw | Classic Header | Unsigned integer (32 bits) | 4.4.0 to 4.4.2 |
| etw | Decode GUID | Unsigned integer (32 bits) | 4.4.0 to 4.4.2 |
| etw | Extended Info | Unsigned integer (32 bits) | 4.4.0 to 4.4.2 |
| etw | No CPU time | Unsigned integer (32 bits) | 4.4.0 to 4.4.2 |
| etw | Private Session | Unsigned integer (32 bits) | 4.4.0 to 4.4.2 |
| etw | Processor Index | Unsigned integer (32 bits) | 4.4.0 to 4.4.2 |
| etw | String Only | Unsigned integer (32 bits) | 4.4.0 to 4.4.2 |
| etw | Trace Message | Unsigned integer (32 bits) | 4.4.0 to 4.4.2 |
| etw | Header Type | Unsigned integer (16 bits) | 3.6.0 to 4.4.2 |
| etw | Event Message | Character string | 3.6.0 to 4.4.2 |
| etw | Message Length | Unsigned integer (32 bits) | 3.6.0 to 4.4.2 |
| etw | Process ID | Unsigned integer (32 bits) | 3.6.0 to 4.4.2 |
| etw | Processor Time | Unsigned integer (64 bits) | 3.6.0 to 4.4.2 |
| etw | Forwarded XML | Unsigned integer (32 bits) | 4.4.0 to 4.4.2 |
| etw | Legacy Event Log | Unsigned integer (32 bits) | 4.4.0 to 4.4.2 |
| etw | Legacy Reloggable | Unsigned integer (32 bits) | 4.4.0 to 4.4.2 |
| etw | XML | Unsigned integer (32 bits) | 4.4.0 to 4.4.2 |
| etw | Provider ID | Globally Unique Identifier | 3.6.0 to 4.4.2 |
| etw | Provider Name | Character string | 3.6.0 to 4.4.2 |
| etw | Provider Name Length | Unsigned integer (32 bits) | 3.6.0 to 4.4.2 |
| etw | Size | Unsigned integer (16 bits) | 3.6.0 to 4.4.2 |
| etw | Thread ID | Unsigned integer (32 bits) | 3.6.0 to 4.4.2 |
| etw | Time Stamp | Unsigned integer (64 bits) | 3.6.0 to 4.4.2 |
| etw | User Data Length | Unsigned integer (32 bits) | 3.6.0 to 4.4.2 |