Skip to content

Latest commit

 

History

History
24 lines (13 loc) · 968 Bytes

README.md

File metadata and controls

24 lines (13 loc) · 968 Bytes

EtwExplorer

View ETW Provider metadata

Event Tracing for Windows (ETW) is a logging facility built into the Windows OS. Modern providers register a manifest that describes all the events they support, with their properties. Classic providers register a MOF instead.

ETW Explorer attempts to show these events with a simple GUI.

ETWExplorer

Added Features

This is a fork of zodiacon's EtwExplorer that adds Task version diffing.

Tasks can be viewed as a list in the Tasks tab with side by side argument comparison:

TasksView

And tasks with multiple versions can be diff'd to view the raw template XML comparison:

DiffView

Additionally when browsing events, you can right click the event and select "Go to task" to naviate directly to the task comparison view:

GoToTask