Rather than using the Win32 API directly, I would recommend using WPP.
WPP is a pre-processor which allow you to write printf-like trace lines anywhere in your code and have the result of those, along with the additional data (e.g. the arguments passed to the various %d and %s in the trace) be logged to ETW.
发布评论
评论（2）
我建议使用 WPP，而不是直接使用 Win32 API。
WPP 是一个预处理器，它允许您在代码中的任何位置编写类似 printf 的跟踪行，并获得这些结果以及附加数据（例如，传递给跟踪中的各个 %d 和 %s 的参数）登录到 ETW。
明确的指南是 WPP Visual C++ 2010 项目中的跟踪。
Rather than using the Win32 API directly, I would recommend using WPP.
WPP is a pre-processor which allow you to write printf-like trace lines anywhere in your code and have the result of those, along with the additional data (e.g. the arguments passed to the various %d and %s in the trace) be logged to ETW.
The definite guide for this is WPP Tracing in Visual C++ 2010 Projects.
一方面，ETW非常强大。但同时，开始也不是那么容易。
但是，GitHub 上有一个项目可以简化您自己的 ETW 提供程序的编写。这是一个很好的编写示例：
请查看英特尔单事件 API (SEAPI) wiki。
On the one hand, ETW is very powerful. But at the same time, it's not that easy to start with it.
However, there is a project on GitHub that simplifies writing your own ETW provider. And it's a good example of writing:
Please look at the Intel single event API (SEAPI) wiki.