Start-SbecNtKernelLogSession is accessible with the help of BootEventCollector module. To configure BootEventCollector, go through this link.
Synopsis
Starts an NT Kernel Logger log session with forwarding of events to the Collector.
Description
The Start-SbecNtKernelLogSession cmdlet starts a real-time NT Kernel Logger trace session with forwarding of the events to the Collector. The name of the session is fixed as NT Kernel Logger and the GUID is fixed as {9e814aad-3204-11d2-9a82-006008a86939}.
Parameters
-BufferSize
Specifies the buffer size for the session, in kilobytes. This is the size of one buffer, with the count of these buffers set by the MinimumBufferCount and MaximumBufferCount parameters.
| Type: | UInt32 |
| Position: | 1 |
| Default value: | None |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-ClockType
Specifies the type of clock used for the events collected by this session: The acceptable values for this parameter are:
- Default.
- QueryPerformanceCounter. The high-resolution (period of 100 nanoseconds) clock that is typically used for performance measurement.
- SystemTime. The lower-resolution system time similar to FILETIME (period of 10 milliseconds). This value is most typical for the data collection through SBEC.
- CpuCycleCounter. The highest-resolution, with the frequency of the CPU, but may be unreliable depending on the CPU model and the thermal and power modes.
| Type: | ClientContext |
| Accepted values: | Default, QueryPerformanceCounter, SystemTime, CpuCycleCounter |
| Position: | 0 |
| Default value: | None |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-FlushSeconds
Specifies the timeout in seconds for the session buffers to get automatically flushed. You can disable the flushing of buffers on timeout by setting this parameter to 0, then the buffers will be written only when full or on an explicit flush.
| Type: | UInt32 |
| Aliases: | FlushTimer |
| Position: | 4 |
| Default value: | None |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-KernelEnableFlags
Specifies flags for the NT Kernel Logger that enable the kernel events. For the setup and boot monitoring, the only reasonable flag is Process. This enumeration type is defined in $PsHome\Modules\BootEventCollector\SbecTraceHelpers.psm1. The acceptable values for this parameter are:
- Process
- Thread
- ImageLoad
- ProcessCounters
- ContextSwitch
- Dpc
- Interrupt
- SystemCall
- DiskIO
- DiskFileIO
- DiskIOInit
- Dispatcher
- MemoryPageFaults
- MemoryHardFaults
- VirtualAlloc
- NetworkTCPIP
- Registry
- Alpc
- SplitIO
- Driver
- FileIO
- FileIOInit
- Profile
| Type: | EventTraceFlag |
| Accepted values: | None, Process, Thread, ImageLoad, ProcessCounters, ContextSwitch, Dpc, Interrupt, SystemCall, DiskIO, DiskFileIO, DiskIOInit, Dispatcher, MemoryPageFaults, MemoryHardFaults, VirtualAlloc, NetworkTCPIP, Registry, Alpc, SplitIO, Driver, FileIO, FileIOInit, Profile |
| Position: | 5 |
| Default value: | None |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-MaximumBufferCount
Specifies the maximum number of buffers to allocate for this session.
| Type: | UInt32 |
| Aliases: | MaximumBuffers, maxbuf |
| Position: | 3 |
| Default value: | None |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-MinimumBufferCount
Specifies the minimum number of buffers to allocate for this session.
| Type: | UInt32 |
| Aliases: | MinimumBuffers, minbuf |
| Position: | 2 |
| Default value: | None |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-PassThru
Returns an object representing the item with which you are working. By default, this cmdlet does not generate any output.
| Type: | SwitchParameter |
| Position: | Named |
| Default value: | None |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
Syntax
Start-SbecNtKernelLogSession [[-ClockType] <ClientContext>] [[-BufferSize] <UInt32>] [[-MinimumBufferCount] <UInt32>] [[-MaximumBufferCount] <UInt32>] [[-FlushSeconds] <UInt32>] [[-KernelEnableFlags] <EventTraceFlag>] [-PassThru] [<CommonParameters>]
You can check the Version, CommandType and Source of this cmdlet by giving below command.
Get-Command Start-SbecNtKernelLogSession
You can also read about
- Get-SbecLogSession
- Start-SbecLogSession
- Start-SbecSimpleLogSession
- Stop-SbecLogSession
- Set-SbecLogSession
- Save-SbecLogSession
To know more PowerShell cmdlets(Commands) on BootEventCollector click here