How to Create and Manage Event Tracing Sessions Using logman in Windows 11

Event Tracing for Windows (ETW) provides the highest-fidelity, lowest-overhead diagnostic and telemetry infrastructure available in the Windows NT kernel. Used extensively by Windows operating system architects, performance engineers, and enterprise security platforms (EDRs), ETW captures millisecond-level kernel scheduling, socket transitions, file system I/O, and driver dispatch routines. While graphical utilities like Performance Monitor (perfmon) allow manual configuration, the built-in command-line tool logman provides comprehensive, scriptable control over Data Collector Sets and ETW tracing sessions directly from elevated command shells.

Understanding the ETW Architecture: Providers, Controllers, and Consumers

ETW operates across a decoupled three-tier model:

• Controllers: Applications or utilities—such as logman.exe—that start and stop trace sessions, configure buffer sizes, and bind specific providers.
• Providers: Software components, drivers, or kernel subsystems that publish trace events. Windows registers thousands of built-in providers identified by name or unique GUIDs.
• Consumers: Utilities (such as Windows Performance Analyzer, Event Viewer, or PowerShell) that parse the generated Event Trace Log (.etl) binary files.

Querying Registered Providers with logman

To inspect the available trace providers installed on your Windows 11 system:

1. Click Start, type cmd or PowerShell, right-click the console icon, and select Run as administrator.
2. To list registered ETW providers across the operating system:

logman query providers

Because thousands of providers exist, you can filter for specific subsystems (such as Microsoft Defender, DNS Client, or Kernel Network) using PowerShell matching:

logman query providers | Select-String "DNS"

This displays providers such as Microsoft-Windows-DNS-Client alongside its unique GUID (e.g., {1C950233-BE22-4F1F-B1CC-58B008484B58}).

Creating and Starting a Real-Time ETW Session

To create a high-speed event trace session capturing DNS lookups or network activity:

logman create trace "DNS_Diagnostics" -p "Microsoft-Windows-DNS-Client" -o "C:\Traces\dns_trace.etl" -ets

Deconstructing the parameters:

• create trace "DNS_Diagnostics": Establishes a new Event Trace session name.
• -p "Microsoft-Windows-DNS-Client": Binds the specific provider name or GUID.
• -o "C:\Traces\dns_trace.etl": Designates the binary output file path.
• -ets: Sends the command directly to the Event Trace Session manager, activating event logging immediately without requiring a separate start call.

Querying Active Trace Sessions and Buffer Metrics

To monitor active sessions and verify buffer consumption:

logman query "DNS_Diagnostics" -ets

The console returns operational session details:

• Status: Displays Running.
• Buffer Size: Size of memory buffers (typically 64 KB).
• Events Lost: Confirms whether the storage subsystem is keeping up with event generation rates. A value of 0 indicates zero dropped events.

Stopping and Finalising Traces

Once you have reproduced the network issue or performance bottleneck, halt the trace session to flush in-memory buffers to disk:

logman stop "DNS_Diagnostics" -ets

The command cleanly closes the binary handle and finalises C:\Traces\dns_trace.etl. You can now inspect this log using Windows Performance Analyzer (WPA), PerfView, or convert it to readable XML via tracerpt C:\Traces\dns_trace.etl -of XML -o C:\Traces\dns_report.xml.

Capturing Kernel-Level Hardware Events with System Trace

To capture deep kernel events (disk I/O, process creation, interrupt activity, and memory page faults), logman supports dedicated NT Kernel Logger flags:

logman start "NT Kernel Logger" -p "Windows Kernel Trace" (process,net,disk) -o "C:\Traces\kernel.etl" -ets

Always stop the kernel session promptly after capturing your reproduction window using logman stop "NT Kernel Logger" -ets to prevent excessive disk utilization on high-throughput storage drives.