I would like to run circular event tracing from the command line with a limited file size which should be written when I stop the trace. It must be possible to run for hours without overfilling the disk or memory. When I trigger the stop it should contain
all the last events which fits into the max size of the trace file (kernel.etl)
The closest I got so far looks as follows:
logman start "NT Kernel Logger" -p "Windows Kernel Trace" (profile,proccntr,dpc,isr,syscall,disk,process,thread,file,dispatcher,pf,hf,img,cswitch) -bs 1024 -nb 128 128 -mode Circular -o kernel.etl -ct perf -max 512 -ets -rt
This will collect the data I need but and it will contain the latest events which fits in 512mb. When opening the file WPA complains about dropped events. That should be okay since it is my intention to do so but in addition all the metadata is missing. As a result the generated trace is completely useless.
According to a post called 'Perview looses data when circular buffer wraps' the EventSource events are logged at the beginning of the trace and will be overwritten when the buffer is full.
Is there any way to tell logman to manage the metadata correctly? Or is there any other existing tool which could be started from the command line and do the job?
Best,
Lars Kleen