A globally unique identifier in Registry format. e.g. {12345678-4321-ABCD-1234-9ABCDEF012345678}. Use GUIDGen.exe or UUIDGen.exe to create a GUID. Symbol is used for code-generation. It should be a valid C Symbol or an empty string. Hex 1-2 digits in size Hex 1-4 digits in size Hex 1-8 digits in size Hex 1-16 digits in size. Hex 1-2 digits in size or unsignedByte Hex 1-4 digits in size or unsignedShort UnsignedInt or Hex 1-8 digits in size. Hex 1-16 digits in size or unsignedLong Length property name string or unsignedShort Count property name string or unsignedShort Value of this attribute should be of the form $(string.stringTableId), where stringTableId is the 'id' attribute of a <string> element defined in the <stringTable> section. Or it could be of the form $(mc.mcSymbolId), where mcSymbolId is the symbol of a message string defined in a .mc file. A fully-qualified path to a file. Standard Windows environment variables are allowed. Typically, the file is of type .exe, .dll, or .sys. Each keyword must have a unique name, which is used to reference the keyword from the events section of the manifest. Mask is a 64-bit value, in which, only one bit is set. Mask value cannot be zero. Leftmost 16 bits of the mask are reserved for use by winmeta.xml. Use keywords to group events together. At run-time, it is possible to enable events belonging to only certain groups (i.e. keywords). This is one way to filter out unwanted events at the time of logging. Use opcodes, in conjunction with a task, to describe different milestones within an activity. Use levels to control the verbosity of events during logging. At run-time, a provider can be enabled with a certain level value, and only events with a level value less than or equal to the specified value will get logged. Use tasks to describe an activity. Use opcodes to describe each unit of work within an activity. Channel logging config Channel publishing config Amount of memory allocated for the session buffers (KB) Number of etl files to create across enablement Minimum number of session buffers Maximum number of session buffers Buffer flush interval (sec) Clock resolution Default publishing session/security if not specified explicitly by the channel access attribute. Use channels to describe the destinations for your events. Each channel you define here will show up in the Windows Event Viewer. Represents binary data in classic eventlog API Use templates to describe the payload logged by an event. Different events can share a template. Also referred to as the Event-Id. An ETW event is uniquely identified by the {Provider-Guid,Event-Id,Event-Version} tuple. Reference to a <level> element defined in the <levels> section. Refer to a level by its attribute 'name'. It is advisable to increment the version of an event if its template is modified between releases. Use this to indicate that this event has been removed and will not be logged by this version of the provider. The description of the event should be retained in this manifest so that if an etl file collected from an older version of the provider on a different machine is brought to this machine, it can be correctly decoded on this machine. List all events logged by the provider in this section. Name of the executable file to which the provider's metadata resource is linked, usually the same as the provider's binary. Name of the executable file to which the provider's localizable message resource is linked, usually the same as the provider's binary. Only the export manifest created by traceRpt.exe should use this attribute to describe whether the provider was a MOF-based legacy provider or a Vista+ manifest-based provider. This is a temporary attribute to turn off application compatibility checks on ETW manifests in the Windows source. A value of 'true' means mc will generate warnings instead of errors, thereby not breaking the build. Feature teams in Windows should not use this attribute without permission from the ETW team.