Microsoft documents one part of the file: TRACE_LOGFILE_HEADER, “the raw
data format of the trace information data in the header of an ETW log file”. It is the
data of the first event in the file, in the first buffer,
and describes the whole trace session. Airbus CERT’s etl-parser requires that first
event to have a system header
and decodes its data as this structure (Microsoft also offers the
EventTrace_Header MOF class for it).
Fields
Two members are pointers, so the offsets after them depend on the pointer size of the
machine that wrote the trace, given by PointerSize. The offsets below are
worked out from the published declaration with normal alignment; they are not stated
by Microsoft.
| Offset (32-bit) | Offset (64-bit) | Size | Name | Description |
|---|---|---|---|---|
0x00 | 0x00 | 4 | BufferSize | The size of each buffer in the file, in bytes. |
0x04 | 0x04 | 4 | Version | The Windows version the trace was taken on: one byte each of MajorVersion, MinorVersion, SubVersion and SubMinorVersion, in that order, as the declaration’s UCHAR fields give it (Microsoft’s prose calls them two bytes each, which does not fit a 4-byte field). The last two are reserved. |
0x08 | 0x08 | 4 | ProviderVersion | The Windows build number. |
0x0C | 0x0C | 4 | NumberOfProcessors | Processors on the machine. |
0x10 | 0x10 | 8 | EndTime | When the session stopped, in 100-nanosecond intervals since 1 January 1601 UTC. 0 if the file was not closed properly. |
0x18 | 0x18 | 4 | TimerResolution | Resolution of the hardware timer, in 100-nanosecond units. |
0x1C | 0x1C | 4 | MaximumFileSize | The largest size the file may reach, in megabytes (kilobytes when EVENT_TRACE_USE_KBYTES_FOR_SIZE is set). |
0x20 | 0x20 | 4 | LogFileMode | The session’s logging mode flags. |
0x24 | 0x24 | 4 | BuffersWritten | Buffers written to the file. |
0x28 | 0x28 | 4 | StartBuffers | Reserved. (These 16 bytes can also be read as a reserved GUID, LogInstanceGuid.) |
0x2C | 0x2C | 4 | PointerSize | Size of a pointer on the writing machine: 4 or 8. |
0x30 | 0x30 | 4 | EventsLost | Events lost during the session. |
0x34 | 0x34 | 4 | CpuSpeedInMHz | Processor speed in MHz. |
0x38 | 0x38 | 4 or 8 | LoggerName | A pointer, meaningless in the file. The session’s name is the first zero-terminated UTF-16 string after the structure. |
0x3C | 0x40 | 4 or 8 | LogFileName | A pointer, meaningless in the file. The log file’s name is the second string after the structure. |
0x40 | 0x48 | 172 | TimeZone | A TIME_ZONE_INFORMATION for the three times in this header: see below. |
0xF0 | 0xF8 | 8 | BootTime | When the machine started, in 100-nanosecond intervals since 1601. Set only for the Global Logger session. |
0xF8 | 0x100 | 8 | PerfFreq | Frequency of the high-resolution performance counter, in counts per second. |
0x100 | 0x108 | 8 | StartTime | When the session started, in 100-nanosecond intervals since 1601. |
0x108 | 0x110 | 4 | ReservedFlags | The clock type of the event timestamps. |
0x10C | 0x114 | 4 | BuffersLost | Buffers lost during the session. |
Microsoft warns that reading the structure directly gives wrong results when the
reader’s pointer size differs from the writer’s, which is why
PointerSize matters.
Clock types
How every event timestamp in the file is counted. The values are those of
WNODE_HEADER.ClientContext.
| Value | Clock | How to turn a timestamp into a time |
|---|---|---|
| 1 | Query performance counter (QPC) | Counts of PerfFreq per second; relate them to StartTime. |
| 2 | System time | 100-nanosecond intervals since 1601, like a Windows FILETIME. |
| 3 | CPU cycle counter | Processor cycles, CpuSpeedInMHz million a second. |
Time zone
| Offset | Size | Name | Description |
|---|---|---|---|
0 | 4 | Bias | Minutes to add to local time to get UTC. |
4 | 64 | StandardName | Name of standard time, 32 UTF-16 characters. |
68 | 16 | StandardDate | When standard time begins, a SYSTEMTIME. |
84 | 4 | StandardBias | Extra minutes of bias in standard time. |
88 | 64 | DaylightName | Name of daylight saving time. |
152 | 16 | DaylightDate | When daylight saving time begins. |
168 | 4 | DaylightBias | Extra minutes of bias in daylight saving time. |
Logging modes
The flags of LogFileMode, from evntrace.h.
| Value | Name | Meaning |
|---|---|---|
0x00000000 | EVENT_TRACE_FILE_MODE_NONE | Sequential, with no maximum size. |
0x00000001 | EVENT_TRACE_FILE_MODE_SEQUENTIAL | Events are written in order; logging stops at the maximum size. |
0x00000002 | EVENT_TRACE_FILE_MODE_CIRCULAR | At the maximum size, the oldest events are overwritten, so buffers may be out of order. |
0x00000004 | EVENT_TRACE_FILE_MODE_APPEND | Events were appended to an existing file. |
0x00000008 | EVENT_TRACE_FILE_MODE_NEWFILE | A new numbered file is started at the maximum size. |
0x00000020 | EVENT_TRACE_FILE_MODE_PREALLOCATE | Disk space was reserved in advance. |
0x00000040 | EVENT_TRACE_NONSTOPPABLE_MODE | The session cannot be stopped (AutoLogger only). |
0x00000080 | EVENT_TRACE_SECURE_MODE | Only callers with permission may log to the session. |
0x00000100 | EVENT_TRACE_REAL_TIME_MODE | Events are also delivered to live consumers. |
0x00000200 | EVENT_TRACE_DELAY_OPEN_FILE_MODE | The file was opened only when the first event came. Not used from Windows Vista. |
0x00000400 | EVENT_TRACE_BUFFERING_MODE | Events go to a circular memory buffer only. |
0x00000800 | EVENT_TRACE_PRIVATE_LOGGER_MODE | A private session inside the provider’s process. |
0x00001000 | EVENT_TRACE_ADD_HEADER_MODE | Adds a header to the file. Not used from Windows Vista. |
0x00002000 | EVENT_TRACE_USE_KBYTES_FOR_SIZE | Sizes are in kilobytes rather than megabytes. |
0x00004000 | EVENT_TRACE_USE_GLOBAL_SEQUENCE | Sequence numbers of TraceMessage events are unique across sessions. |
0x00008000 | EVENT_TRACE_USE_LOCAL_SEQUENCE | Sequence numbers are unique within the session only. |
0x00010000 | EVENT_TRACE_RELOG_MODE | Events logged without an EVENT_TRACE_HEADER; internal. |
0x00020000 | EVENT_TRACE_PRIVATE_IN_PROC | With private logger mode: only the registering process may start it. |
0x00100000 | EVENT_TRACE_MODE_RESERVED | Signals heap and critical-section tracing. |
0x00400000 | EVENT_TRACE_STOP_ON_HYBRID_SHUTDOWN | Logging stops on a hybrid (fast-startup) shutdown. |
0x00800000 | EVENT_TRACE_PERSIST_ON_HYBRID_SHUTDOWN | Logging continues through a hybrid shutdown. |
0x01000000 | EVENT_TRACE_USE_PAGED_MEMORY | Buffers were in paged memory. |
0x02000000 | EVENT_TRACE_SYSTEM_LOGGER_MODE | The session receives events from the kernel’s system trace provider. |
0x08000000 | EVENT_TRACE_INDEPENDENT_SESSION_MODE | Failures to write to other sessions do not affect this one. |
0x10000000 | EVENT_TRACE_NO_PER_PROCESSOR_BUFFERING | All processors share buffers, so events stay in order. |
0x80000000 | EVENT_TRACE_ADDTO_TRIAGE_DUMP | The session’s buffers are added to triage crash dumps. |