Root element of an instrumentation manifest. Not a valid root element for an instrumentation manifest. Used when storing instrumentation data within other XML documents. An instrumentation manifest may contain MESSAGETABLE strings, ETW providers, and/or a Windows Performance Counter V2 provider. Manifests containing MESSAGETABLE strings can be compiled with mc.exe. Manifests containing ETW providers can be compiled with mc.exe, installed or uninstalled with wevtutil.exe, and used with TDH APIs or ETW tools to decode ETL traces. Manifests containing a Performance Counter V2 provider can be compiled with ctrpp.exe, installed using lodctr.exe, and uninstalled using unlodctr.exe. Note that instrumentation manifests must be uninstalled before they can be reinstalled. May contain MESSAGETABLE strings, ETW providers, and/or a Windows Performance Counter V2 provider. The events element is used for MESSAGETABLE strings and ETW providers. The counters element (defined in the counterman.xsd schema) is used for a Windows Performance Counter V2 provider. Contains MESSAGETABLE strings and ETW providers. Defines an ETW provider. A provider is a unit of organization for ETW event definitions. At runtime, the provider GUID is used when opening the ETW handle. When collecting a trace, the provider's control GUID is used to enable or disable the collection of the provider's events. Within the trace data, the provider GUID identifies the provider as the source of the event. When the trace data is processed, the provider GUID is used to match an event to the manifest that contains the event definitions needed to decode it. A manifest-based ETW provider has a decode GUID (used to locate the manifest) and a control GUID (used to enable the provider or filter events). Normally, the same GUID (the provider guid) is used for both decode and control. If distinct values are needed for the decode and control GUIDs, set the "guid" attribute to the decode GUID and set the "controlGuid" attribute to the control GUID. Note that to avoid provider name conflicts, if the controlGuid attribute is used, the provider name must end with the decode guid, e.g. guid="{54bab802-bb0b-4b4a-9ce9-7360a0120b3e}" name="MyProvider.54bab802bb0b4b4a9ce97360a0120b3e" controlGuid="{74d557d9-4a8e-4a3f-9a32-3f1a0eab71ba}" If a provider uses distinct decode and control GUIDs, the resulting traces may not decode properly when decoded on Windows versions prior to Windows 10 Fall Creators Update (2017). Note that distinct decode and control GUIDs are typically used to support tool-generated manifests and are generally unnecessary for hand-maintained manifests. Name of the executable file into which the provider's non-localized template resource is linked, usually the same as the provider's binary. Since the full install path of the provider binary is usually determined at install time, the value of this attribute is usually overridden by using wevtutil.exe's /rf:FullResourceFilePath parameter. Name of the executable file into which the provider's localizable message resource is linked, usually the same as the provider's binary. Since the full install path of the provider binary is usually determined at install time, the value of this attribute is usually overridden by using wevtutil.exe's /mf:FullMessageFilePath parameter. Deprecated. Use channels to describe the destinations for your events. Each channel you define here will show up in the Windows Event Viewer. Declares a channel that is used by events in this manifest but is not owned by this manifest. This may be used to reference well-known channels from winmeta.xml or to reference channels owned by other components that this manifest will depend upon. Note that only the attributes of this element are significant. The text content of this element is not used by mc.exe. Defines a channel that is used by events in this manifest and is owned by this manifest. Note that only the attributes of this element are significant. The text content of this element is not used by mc.exe. Default publishing session/security if not specified explicitly by the channel access attribute. Channel logging config Channel publishing config Amount of memory allocated for the session buffers (KB) Number of etl files to create across enablement Minimum number of session buffers Maximum number of session buffers Buffer flush interval (sec) Clock resolution Defines custom levels for use by this provider. Levels are used to filter events. Note that winmeta.xml provides predefined levels win:LogAlways, win:Critical, win:Error, win:Warning, win:Informational, win:Verbose. Custom levels must use values 16-255. Defines a custom level for use by this provider. Note that only the attributes of this element are significant. The text content of this element is not used by mc.exe. Defines custom tasks for use by this provider. A task is a localizable string label that can be applied to an event. Note that winmeta.xml provides predefined task win:None. Custom tasks must use values 1-65535. Defines a custom task for use by this provider. Note that only the attributes of this element are significant. The text content of this element is not used by mc.exe. Defines custom opcodes for use by this provider. An opcode is a semantic category for certain special types of event. For example, the Start opcode is used on events that trace the beginning of an activity, and the Stop opcode is used on events that trace the end. Note that winmeta.xml provides predefined opcodes win:Info, win:Start, win:Stop, win:DC_Start, win:DC_Stop, win:Extension, win:Reply, win:Resume, win:Suspend, win:Send, win:Receive. Custom opcodes must use values 10-239. Defines a custom opcode for use by this provider. Note that only the attributes of this element are significant. The text content of this element is not used by mc.exe. Defines custom keywords for use by this provider. A keyword is a bit (flag) that specifies a category that an event may belong to. Keywords are used to filter events. Note that winmeta.xml provides several predefined keywords. These keywords should only be used for their described purpose. The reserved keywords should not be used directly (mc.exe adds the reserved keywords to events as appropriate based on the event's channel). Custom keywords must use the low 48 bits of the keyword mask. Defines a custom keyword for use by this provider. Note that only the attributes of this element are significant. The text content of this element is not used by mc.exe. Each keyword must have a unique name, which is used to reference the keyword from the events section of the manifest. Mask is a 64-bit value in which only one bit is set. Mask value cannot be zero. The high 16 bits of the mask are reserved for definition by winmeta.xml. Defines custom enumerated types (maps) for use by this provider. Defines an enumeration value for use in this value map. Note that only the attributes of this element are significant. The text content of this element is not used by mc.exe. Defines a flag value for use in this bit map. Note that only the attributes of this element are significant. The text content of this element is not used by mc.exe. Defines a value for use in this pattern map. Note that only the attributes of this element are significant. The text content of this element is not used by mc.exe. Use templates to describe the payload logged by an event. Many events can share a template. Tags is a 28-bit user-defined metadata value applied to each event that uses this template. The event producer and consumer coordinate to define the semantics of the tags value. During event processing on Windows 10 Fall Creators Update (2017) or later, this value can be retrieved from the TRACE_EVENT_INFO Tags field. Defines the name and type of an event property (field). Note that only the attributes of this element are significant. The text content of this element is not used by mc.exe. Tags is a 28-bit user-defined metadata value applied to this property. The event producer and consumer coordinate to define the semantics of the tags value. During event processing on Windows 10 Fall Creators Update (2017) or later, this value can be retrieved from the EVENT_PROPERTY_INFO Tags field. Defines the properties (fields) of an event structure. Note that only the attributes of this element are significant. The text content of this element is not used by mc.exe. Tags is a 28-bit user-defined metadata value applied to this property. The event producer and consumer coordinate to define the semantics of the tags value. During event processing on Windows 10 Fall Creators Update (2017) or later, this value can be retrieved from the EVENT_PROPERTY_INFO Tags field. Represents binary data in classic eventlog API Defines the events logged by this provider. Defines the event's value (ID), name, level, keywords, fields, etc. Note that only the attributes of this element are significant. The text content of this element is not used by mc.exe. Also referred to as the Event-Id. A manifest-based ETW event is uniquely identified by the {Provider-Guid,Event-Id,Event-Version} tuple. Non-localized event name. During event processing on Windows 10 Fall Creators Update (2017) or later, this value can be retrieved from the TRACE_EVENT_INFO EventNameOffset field. Non-localized event attributes. This should be a semicolon-delimited list of name=value attributes associated with the event. During event processing on Windows 10 Fall Creators Update (2017) or later, this value can be retrieved from the TRACE_EVENT_INFO EventAttributesOffset field. Defined attributes include: FILE=Filename of source code associated with event; LINE=Line number of source code associated with event; FUNC=Function name associated with event; MJ=Major component associated with event (component name); MN=Minor component associated with event (subcomponent name). Values containing semicolons or double-quotes should be quoted using double-quotes; double-quotes within the value should be doubled. Example: attributes='FILE=source.cpp;LINE=123;MJ="Value; ""Quoted"""' Note that most of these attributes are intended for use with tool-generated manifests and may not be appropriate for use with hand-maintained manifests. For example, the FILE ane LINE attributes are not generally appropriate for use in a hand-maintained manifest, since a single event might be emitted from multiple source code locations and the source code locations will change over time. The FILE and LINE attributes are intended for use in cases where the manifest is regenerated (with a new GUID) by a code generation tool each time the source code changes. Reference to the name of a predefined level (from winmeta.xml) or the name of a custom level (defined in the <levels> section). If not specified, the event's level will default to "LogAlways". Event level is a primary filtering attribute. All events should be assigned a meaningful level (win:Critical, win:Error, win:Warning, win:Informational, or win:Verbose) to support effective filtering during event collection. Reference to the name of a custom level defined in the <keywords> section. If not specified, the event will have no keywords set and will bypass most keyword-based event filtering. Event keyword is a primary filtering attribute. All events should be assigned at least one meaningful keyword to support effective filtering during event collection. Increment the version of an event if its template is modified. Use this to indicate that this event has been removed and will not be logged by this version of the provider. The description of the event should be retained in this manifest so that if an etl file collected from an older version of the provider on a different machine is brought to this machine, it can be correctly decoded on this machine. Use this to indicate that the template associated with this event contains valid WinRT types i.e. the event payload fields can come from arguments of projected WinRT methods. This attribute will be used if generating code for WinRT projection APIs. Defines a set of custom filters for use in this provider. Note that only the attributes of this element are significant. The text content of this element is not used by mc.exe. Defines a custom filter for use in this provider. Note that only the attributes of this element are significant. The text content of this element is not used by mc.exe. Specifies values for this provider's provider traits. The provider traits consist of a small binary blob that is registered with the ETW runtime via EventSetInformation and included with each call to EventWrite. The traits blob contains information about a provider's name, decode GUID, and group GUID. When provider traits are needed (i.e. when the provider has different values for its control GUID and its decode GUID or when the traits element is present), the MC tool's -um or -km codegen will generate a provider traits blob, will generate code to automatically register the blob as part of EventRegister, and will include the blob in each call to EventWrite. Optional. Default is false. If true, the provider's name will be included in the provider traits. If false, the provider's name will be left blank to reduce the size of the trace file. Including the provider name makes it possible to filter an event by provider name. Optional. Specifies that this provider is a member of the specified provider group. By default, the provider is not a member of any provider group. Decimal or hexadecimal message ID. Decimal should have no leading 0s. Hexadecimal requires '0x' prefix. Deprecated. Specifies an alias for this string table entry. Contains one or more resource tables, each of which contains resources for a single locale. This attribute is not used. Contains resources for a single locale. Specify the locale of the resources using a Windows locale name, e.g. "en-US". Locale name syntax is documented in MSDN topics such as "locale names" and "LocaleNameToLCID". Localized values of strings referenced in MESSAGETABLE strings and ETW providers. Defines the localized value of a string referenced by an event or a message table in this manifest. Note that only the attributes of this element are significant. The text content of this element is not used by mc.exe. The stringTableId of the string reference in the ETW provider or the MESSAGETABLE string. For example, if a string is referenced as "$(string.MyString1)" then the id would be "MyString1". The localized string. Not used by Windows or mc.exe. This attribute can be used to describe the usage of the string to aid in tracking and localization. Used only by the Microsoft-provided WinMeta.xml file. WinMeta.xml uses this element to document ETW facilities that are built into the Windows operating system or are commonly used by ETW decoding tools. This includes the definitions of the property types supported by TDH APIs as well as Microsoft-defined constants for well-known event levels, opcodes, and channels. Declares an outType supported by Windows. An outType is a sub-type that extends the inType with additional semantics and presentation details for a property of an ETW event. For example, a property could have inType "AnsiString" (indicating nul-terminated CHAR8 string) and outType "Utf8" (indicating UTF-8 character encoding). Declares an inType supported by Windows. An inType is the type of a property of an ETW event. Every ETW event property declares an inType. The inType fully defines the mechanism for determining the size of a property and also gives a general idea of how the property's value should be interpreted. For example, an inType "Int16" indicates the size is 2 and the property should be interpreted as a signed 16-bit integer. Each inType has a set of outTypes that are supported for use with it. The outType adds semantics or presentation details to the inType. For example, the inType "UInt16" can be used with outType "Port" to indicate that an event property is a big-endian 16-bit Internet protocol port number. Each inType specifies one outType as "default", indicating the behavior that should be used when an ETW property uses the inType but does not specify an outType. Declares that Windows supports the use of the specified outType with this inType. Note that only the attributes of this element are significant. The text content of this element is not used by mc.exe. Deprecated. Specifies an alias for this string table entry. A globally unique identifier in Registry format, e.g. {12345678-4321-ABCD-1234-9ABCDEF012345678}. Use GUIDGen.exe or UUIDGen.exe to create a GUID. Symbol is used for code-generation. It should be a valid C Symbol or an empty string. Is used for code-generation on namespaces which should be valid C++ symbols. E.g. Namespace1._Namespace2.Namespace2 1-2 hexadecimal digits with '0x' prefix. 1-4 hexadecimal digits with '0x' prefix. 1-8 hexadecimal digits with '0x' prefix. 1-16 hexadecimal digits with '0x' prefix. 8-bit unsigned decimal or hexadecimal integer. Decimal should have no leading 0s. Hexadecimal requires '0x' prefix. 16-bit unsigned decimal or hexadecimal integer. Decimal should have no leading 0s. Hexadecimal requires '0x' prefix. 32-bit unsigned decimal or hexadecimal integer. Decimal should have no leading 0s. Hexadecimal requires '0x' prefix. 64-bit unsigned decimal or hexadecimal integer. Decimal should have no leading 0s. Hexadecimal requires '0x' prefix. For a constant-Length property, specify the value (decimal). For a variable-Length property, specify the name of the property that will have the length of this property. Length is required for "Binary" properties. It indicates the size (in bytes) of the property value. Length is optional for "UnicodeString" and "AnsiString" properties. If present, Length indicates the size (in characters) of the property value. If Length is not present, the property is assumed to be nul-terminated. Length is not used for other inTypes. Other inTypes either use a well-known constant size (e.g. Int32 length is 4) or encode the size within the value (e.g. nul-terminated strings end at the first 0 character, and "counted" values start with a 16-bit size). In the case of an array (i.e. when the property has a Count), the same Length value applies to all elements of the array. As a result, it is not generally useful to create an array of variable-Length properties. Note that some decoders only recognize Length properties that immediately precede the corresponding variable-Length property. For constant-Count array, specify the value (decimal). For variable-Count array, specify the name of the property that will have the count of this property. Note that some decoders will treat Count="0" as an error, and some decoders will treat Count="1" as non-array. Note that some decoders only recognize Count properties that immediately precede the corresponding variable-Count property. A reference to a localized string value provided elsewhere. The value of this attribute should be of the form "$(string.stringTableId)", where stringTableId is the "id" attribute of a <string> element defined in the <stringTable> section, or of the form "$(mc.mcSymbolId)", where mcSymbolId is the symbol of a message string defined in an .mc file compiled along with this manifest. A fully-qualified path to a file. Standard Windows environment variables are allowed. Typically, the file is of type .exe, .dll, or .sys. Space-separated list of keywords. To support consistent event filtering, all events should have at least one keyword assigned.