I'm trying to automate some processes around collecting ETW data. To that end, I'm writing a Powershell script. The script includes this command:
Start-EtwTraceSession -Name "leTestSession" -LocalFilePath "C:\Temp\traceit.etl" -FileMode Circular -MaximumFileSize 2000
However, running this command results in the following error:
New-EtwTraceSession : MaximumFileSize is required for the current LogFileMode (0x9000002). At C:\Windows\system32\WindowsPowerShell\v1.0\Modules\EventTracingManagement\EventTracingManagement.psm1:93 char:5
New-EtwTraceSession @PSBoundParameters~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
- CategoryInfo : InvalidArgument: (MSFT_EtwTraceSession:ROOT\Microsoft...EtwTraceSession) >[New-EtwTraceSession], CimException
- FullyQualifiedErrorId : MI RESULT 4,New-EtwTraceSession
When I looked at (https://learn.microsoft.com/en-us/windows/win32/etw/logging-mode-constants?redirectedfrom=MSDN), it suggested that the "Circular" value seems to correspond with a value of 0x00000002, not 0x9000002. I tried overriding that by specifying -LogFileMode 0x9000002, but I still got a nearly identical error output (the value of LogFileMode in the error message is now 0x2).
Is there something I'm missing here?