I am new to windows tracelogging and etw events. I am trying to consume events being emitted by one of ETW providers in my code. I used tracelog to capture events for that provider and recorded them in an etl file. Now to decode this etl I have multiple options of "trace consumers" - TraceView, Tracefmt and Tracerpt.
Out of these consumer options - Traceview and Tracefmt require "trace message formatting information" from the PDB file or from a TMF file. TMF file can be generated from PDB files, but the instructions to generate/find PDB file aren't clear at all anywhere.
On the other hand, Tracerpt seems to decode etl files without requiring any PDB or TMF formatting files.
How is it possible that Tracerpt doesn't require formatting information for decoding etl files?
This is the command I used to decode etl file using Tracerpt -
tracerpt MyTraceFile.etl -o logdump.xml -of XML
I also see that Microsoft official doc says -
Other trace consumers, such as Tracerpt, a tool included in Windows, do not use PDB files or TMF files. Instead, they use the information in Managed Object Format (MOF) files to format trace events. These tools cannot format trace messages.
I do not understand this paragraph either. It seems self-contradictory. First it says that it uses MOF files to format trace events, and in next line it says it cannot format trace messages. And practically, I was able to decode ETL file without using any MOF file using the command mentioned above.