#etw

Event Tracing for Windows (ETW): The Kernel's Built-In Instrumentation System

The high-performance, always-available tracing infrastructure built directly into the Windows kernel, and why it's the foundation nearly every serious Windows diagnostic and monitoring tool is actually built on.