trace_start_etw_capture
[external]
Starts bounded ETW capture before an IIS worker starts. Returns after the providers are ready.
From GliderTrace 1.2.0. Requires an elevated local Windows stdio server.
Before you use this tool
Requires explicit consent for sensitive and machine-wide ETW data. Requires elevation and local stdio; HTTP cannot own this capture. This tool does not start IIS or send requests.
Try it locally in the GliderTrace playground
Parameters
| Name | Type | Required | Description |
|---|---|---|---|
| profile | string | Yes | Fixed ETW profile: framework-iis-cold-start. |
| acknowledgeSensitive | boolean | Yes | Required true: raw ETL can contain secrets and request values. |
| acknowledgeMachineWideCapture | boolean | Yes | Required true: kernel and provider events can include other processes. |
| durationSeconds | number | No | Hard deadline in seconds, 1..120. Defaults to 30. Default: 30 |
| label | string | No | Optional short label for the stored session, for example nightly-baseline. Use it to find the session again with trace_list_sessions. Maximum 128 characters. |
Examples
Replace sample paths and symbol keys with values from your workspace.
Start capture after explicit consent for sensitive and machine-wide evidence
{
"profile": "framework-iis-cold-start",
"acknowledgeSensitive": true,
"acknowledgeMachineWideCapture": true,
"durationSeconds": 30
}Full MCP request
{
"jsonrpc": "2.0",
"id": 1,
"method": "tools/call",
"params": {
"name": "trace_start_etw_capture",
"arguments": {
"profile": "framework-iis-cold-start",
"acknowledgeSensitive": true,
"acknowledgeMachineWideCapture": true,
"durationSeconds": 30
}
}
}Response Notes
Returns captureId, sessionId, enabledAt, deadline, and warnings after provider readiness. The caller triggers the IIS worker separately. Use a fresh trace_list_processes result to select the worker for trace_stop_etw_capture. Capture ends at its deadline or server shutdown. An abrupt crash can leave ETW active; follow ownership recovery guidance before another capture.
GliderTrace 1.0.0 returns compact JSON for every tool. Result fields appear beside success; there is no response-format parameter. success describes the tool call. Check the process or session status and exitCode separately. Scalar results and fields that conflict with reserved names appear under result.
To migrate an envelope consumer, read response.sessionId instead of response.data.sessionId. Stored sessions and exported files keep their formats. --max-response-chars limits response text to 60,000 UTF-16 characters by default. Use 0 to disable it, or at least 1,000. This limit counts text characters, not transport bytes or tokens.
outputLimit.truncated marks omitted response detail. It does not change capture completeness. Use the returned next tool and arguments when available. Do not repeat a command or feedback submission to recover omitted output. For event pages, keep the filters and cursor while reducing limit.
For session details, set includeArtifacts and includeTopFindings to false to reduce output. Check error, actionable meta, warnings, and coverage before drawing conclusions. Internal diagnostics stay in local server logs.