3 ms·
If all you want is user-mode tracing, there's ETW. Where you run into problems is that it doesn't let you block on calls, etc.
by dataflow 5y ago
If all you want is user-mode tracing, there's ETW. Where you run into problems is that it doesn't let you block on calls, etc.
- GordonS 5y agoI do need to block on calls. I also need the process and user that made the change, and ETW doesn't provide those (to get them myself would require blocking).