Event Tracing for Windows

Much of the functional interface that supports Event Tracing for Windows (ETW) in user mode is implemented in NTDLL.DLL. Some, but certainly not all, of these NTDLL functions are forwarded from ADVAPI32, which exports them with a slight change of name. Use of the ADVAPI32 functions should be preferred, if not on the principle of using the highest-level interface for the job, then at least for the practical reason that where Microsoft documents any of these functions, it is as exports from ADVAPI32. Put another way, the interface boundary for ETW is at ADVAPI32. That the actual work is done in NTLL is just an implementation detail. This is not just theory: functions have moved from ADVAPI32 to NTDLL and back again.

That said, the main reason these notes exist is that parts of the interface are not documented at all or are sufficiently under-documented to have made it seem worth attempting to infer properties of the interface from inspection of the implementation. Because of this, these notes try more to categorise things as they are than as they are said to be. The list that follows is of ETW functions implemented in NTDLL version 6.0, i.e., for Windows Vista. These functions are all new for version 6.0 unless otherwise noted. Highlights indicate functions that appear to have no documentation, even as ADVAPI32 exports, in the Windows SDK dated January 2007 for Windows Vista.

NTDLL version 5.2 exports more functions, which are here treated as discontinued. Most are forwards from ADVAPI32. Indeed, most have an earlier implementation in ADVAPI32. They moved to NTDLL for version 5.2 and then back to ADVAPI32 for version 6.0, except for EtwTraceEvent, which was renamed to EtwLogTraceEvent.

Microsoft documents ETW as dating from Windows 2000, which indeed it does, but ETW in Windows 2000 and Windows XP is not the work of NTDLL.

This page was created on 18th November 2008 and was last modified on 21st November 2008.

Copyright © 2008. Geoff Chappell. All rights reserved. Conditions apply.