Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.honeycomb.io/llms.txt

Use this file to discover all available pages before exploring further.

Ent+
This feature is available as an add-on for the Honeycomb Enterprise plan. Please contact your Honeycomb account team for details.

​
Prerequisites

This source is built on top of Windows ETW, which has resource limitations and was not initially designed for long-term monitoring. Please use with caution on your host systems.While the source supports reading events from ETL logs, using them for continuous event collection may result in dropped events and increased resource utilization on your hosts if not tuned to your specific environment (the default settings may not work out of the box).
This source creates a Real-Time ETW Session to ingest Event Tracing Logs from Windows using the Event Tracing API. Currently, only real-time monitoring sessions are supported.

​
System Requirements

  • Windows system with Event Tracing for Windows (ETW) enabled
  • Familiarity with ETW provider GUIDs for configuration
  • Administrative privileges for ETW session creation
For more information on ETW, refer to Microsoft’s ETW Documentation.

​
Supported Platforms

PlatformSupported
Windows✓
Available in Bindplane Distro for OpenTelemetry Collector v1.75.0+.

​
Configuration Fields

FieldDescription
Session NameName of the ETW session to create and monitor. Default: “Bindplane-ETW-Session”
ProvidersProvider names or GUIDs to monitor (e.g., Microsoft-Windows-Kernel-File)
Enable Raw Logs (XML)When enabled, logs are saved as raw XML strings instead of parsed objects. Useful for XML analysis in some destinations.
LevelMaximum event level to ingest. Options: none, verbose, informational, warning, error, critical.
Session Buffer SizeBuffer size for the ETW session. Default: 64 KiB
Require All ProvidersWhen enabled, source only starts if all providers are available. Default: false

​
Common ETW Providers

Provider Name
Microsoft-Windows-Kernel-File
Microsoft-Windows-DNS-Client

​
Discovering Available Providers

To list all registered ETW providers on your system, run this command in an administrative PowerShell session: 
logman query providers

​
Best Practices

  1. Start with a minimal set of providers and expand gradually based on monitoring needs
  2. Monitor resource usage when enabling multiple providers
  3. Use Performance Monitor to view session settings under Event Trace Sessions
  4. Consider the impact on system performance when enabling verbose logging levels