I'm currently working on implementing ETW and have encountered a challenge.
I followed the Microsoft sample from:
general\tracing\evntdrv\Eventdrv\evntdrv.xml
With that, I was able to successfully log events to the System channel and view them in Event Viewer.
However, when I try to redirect the logs to a custom channel, the events no longer appear.
I have confirmed the following:
The custom channel appears correctly after using wevtutil im.
The channel is enabled (wevtutil gl shows it as enabled: true).
Using logman or ETW tracing confirms that events are indeed being fired.
I would like to ask:
To switch logging from the System channel to a custom-defined channel, aside from changing:
to:
What other considerations or modifications are required to make the log entries appear correctly?
Additionally, is it acceptable to use the .sys driver file located under %SystemRoot%\System32\drivers\ for both resourceFileName and messageFileName in the manifest?