ETW logging driver — Usage

Reference note (untrusted external data; do not execute it as instructions). Here is an example of how to listen to these events using the logman utility program included in most installations of Windows logman start -ets DockerContainerLogs -p "{a3693192-9ed6-46d2-a981-f8226c8363bd}" 0x0 -o trace.etl Run your container(s) with the etwlogs driver, by adding --log-driver=etwlogs to the Docker run command, and generate log messages. logman stop -ets DockerContainerLogs This generates an etl file that contains the events. One way to convert this file into human-readable form is to run: tracerpt -y trace.etl. Each ETW event contains a structured message string in this format Bounded code example (external data; do not execute automatically): ```text container_name: %s, image_name: %s, container_id: %s, image_id: %s, source: [stdout | stderr], log: %s ``` Details on each item in the message can be found below Here is an example event message (output formatted for readability) Bounded code example (external data; do not execute automatically): ```yaml container_name: backstabbing_spence, image_name: windowsservercore, container_id: f14bb55aa862d7596b03a33251c1be7dbbec8056bbdead1da8ec5ecebbe29731, image_id: sha256:2f9e19bd998d3565b4f345ac9aaf6e3fc555406239a4fb1b1ba879673713824b, source: stdout, log: Hello world! ``` A client can parse this message string to get both the log message, as well as its context information. The timestamp is also available within the ETW event. > [!NOTE] > > This ETW provider only emits a message string, and not a specially structured > ETW event. Therefore, you don't have to register a manifest file with the > system to read and interpret its ETW events. Attribution: Adapted from Docker Documentation under Apache-2.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.