Large number of providers from GetRegisteredOrEnabledProviders() goes against documentation

[victorlin]

I have used these methods to get a list of providers on my machine:

• logman query providers : 1108 providers
• TraceEventProviders.GetPublishedProviders() : 1104 providers
• TraceEventProviders.GetRegisteredOrEnabledProviders() : ~2540 providers (fluctuates consistently around this number)

The documentation for GetRegisteredOrEnabledProviders() states:

This is a relatively small list (less than 1000), unlike GetPublishedProviders.

I am not getting a "small list". What is causing this inconsistency?

It's also worth noting that calling TraceEventProviders.GetProviderName() on each of these >2000 provider GUIDs only yields ~790 names that can be mapped.

[billwert]

Those are very old comments. They probably pre-date the support Windows 10 for Tracelogging, which allows for trivial dynamic provider creation. My guess is that modern systems will have substantially more providers running than are registered.

Is this a question about why the comment is wrong, or are you hitting an issue?

[victorlin]

Ah ok, my main concern was the outdated comments. Thanks for the clarification.

A related concern is the difference in results between logman query providers and TraceEventProviders.GetPublishedProviders(). The documentation for this method states:

This is the same list that the 'logman query providers' command will generate.

However, there is a difference in the number of providers as well as a few provider name differences. How do these two ways of retrieving a list of providers differ?

[github-actions]

Due to lack of recent activity, this issue has been labeled as 'stale'. It will be closed if no further activity occurs within 30 more days. Any new comment will remove the label.

[github-actions]

This issue will now be closed since it has been labeled 'stale' without activity for 30 days.