MaximumFileSize parameter in Start-EtwTraceSession appears to not work

1

I'm trying to automate some processes around collecting ETW data. To that end, I'm writing a Powershell script. The script includes this command:

Start-EtwTraceSession -Name "leTestSession" -LocalFilePath "C:\Temp\traceit.etl" -FileMode Circular -MaximumFileSize 2000

However, running this command results in the following error:

New-EtwTraceSession : MaximumFileSize is required for the current LogFileMode (0x9000002). At C:\Windows\system32\WindowsPowerShell\v1.0\Modules\EventTracingManagement\EventTracingManagement.psm1:93 char:5

  • New-EtwTraceSession @PSBoundParameters
    
  • ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    
    • CategoryInfo : InvalidArgument: (MSFT_EtwTraceSession:ROOT\Microsoft...EtwTraceSession) >[New-EtwTraceSession], CimException
    • FullyQualifiedErrorId : MI RESULT 4,New-EtwTraceSession

When I looked at (https://docs.microsoft.com/en-us/windows/win32/etw/logging-mode-constants?redirectedfrom=MSDN), it suggested that the "Circular" value seems to correspond with a value of 0x00000002, not 0x9000002. I tried overriding that by specifying -LogFileMode 0x9000002, but I still got a nearly identical error output (the value of LogFileMode in the error message is now 0x2).

Is there something I'm missing here?

powershell
etw
asked on Stack Overflow Oct 7, 2020 by GWLlosa

0 Answers

Nobody has answered this question yet.


User contributions licensed under CC BY-SA 3.0