CmdID / PowerShell / Cmdlets / Start
Start-EtwTraceSession
Starts an ETW session with the specified name and settings. Windows Server PowerShell reference
From the Windows Server PowerShell reference 16 parameters Its page in the reference
Parameters
-BufferSizeSpecifies the Event Tracing for Windows (ETW) session buffer size, in kilobytes.-CimSessionRuns the cmdlet in a remote session or on a remote computer.-ClockTypeSpecifies the type of timestamp that will be used for each event logged to this ETW session.-CompressControls whether ETW should compress the saved buffers as they are filled.-Confirm, -cfPrompts you for confirmation before running the cmdlet.-FileModeSpecifies how events received by the session should be saved.-FlushTimerWhen set, all active buffers in the session will be flushed at this interval, in seconds.-LocalFilePathSpecifies the full path to the file the ETW session should write to.-LogFileModeSpecifies the ETW session logging mode.-MaximumBuffersSpecifies the maximum number of buffers the ETW session should use.-MaximumFileSizeSpecifies the maximum file size for the output .etl file to grow to, in megabytes.-MinimumBuffersSpecifies the minimum number of buffers the ETW session should use.-NameSpecifies the name of the ETW trace session.-NonPagedControls whether ETW should use memory from the non-paged pool for the session buffers.-RealTimeControls whether ETW should allow real-time consumers to connect to the session.-WhatIf, -wiShows what would happen if the cmdlet runs.