到底如何抓取Windows OS event trace log

我列举了一些可以用的命令logman，和新一代命令 xperf，需要管理员权限运行

logman query providers

logman query providers "Microsoft-Windows-Kernel-Acpi"

logman create trace acpilog -p "Microsoft-Windows-Kernel-Acpi" 0xffffffffffffffff 0x4 -o C:\userdata\github\install\acpi.etl

logman start acpilog

logman start acpilog -ets

logman query providers "ACPI Driver Trace Provider"

logman update acpilog -p "ACPI Driver Trace Provider" -o C:\userdata\github\install\acpi_drv.etl

logman start acpidriver

xperf -Loggers

如何抓取boot启动时候的Event Tracing Log

需要把任务抓log的任务下挂windows Autologger

HKEY_LOCAL_MACHINE
   \SYSTEM
      \CurrentControlSet
         \Control
            \WMI
               \Autologger
                  \Logger Session A
                     \{ProviderGuid1}
                     \{ProviderGuid2}
                  \Logger Session B
                  \Logger Session C