ETW (Event Tracing for Windows)
- Description
-
A Microsoft Windows feature that allows recording of kernel and application-defined events. You can configure different Windows services, such as the Windows Firewall and DNS Server, to log events through Windows Event Tracing.
Debug and Analytical channels rely on ETW, and they cannot be collected through regular Windows Event Log channels. NXLog Agent can read these event traces using the Event Tracing for Windows input module. This module does not require you to save logs to an intermediate file on disk. Instead, it reads the data directly from the ETW provider.
- Also known as
-
ETW, Event Tracing for Windows, Windows Event Tracing, event tracing
- See also
-
Collecting ETW logs
DNS logging via ETW providers
Solving log collection challenges with Event Tracing for Windows