NotificationsYou must be signed in to change notification settings
Fork8.1k
Star50.7k

Remove the use of Windows PowerShell ETW provider id and update`PSDiagnostics` module to work for PowerShell 7#25590

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Jump to bottom

Merged

daxian-dbw merged 3 commits intoPowerShell:masterfromdaxian-dbw:provider-id

Oct 1, 2025

Merged

Remove the use of Windows PowerShell ETW provider id and update`PSDiagnostics` module to work for PowerShell 7#25590

daxian-dbw merged 3 commits intoPowerShell:masterfromdaxian-dbw:provider-id

Oct 1, 2025

Conversation

Copy link

Member

daxian-dbw commentedMay 21, 2025•
edited
Loading

PR Summary

This PR includes 2 changes to clean up the ETW logging related code in PowerShell:

Remove the use of Windows PowerShell ETW provider id (a0c1853b-5c40-4b15-8766-3cf1c58f985a) in current code base. This seems to be an oversight from the initial effort to create manifest based ETW provider for PowerShell 7+ (Redirect ETW logging to Syslog on Linux #5144).
Minor updates to thePSDiagnostics module to make it work against PowerShell 7 -- enable/disable thePowerShellCore ETW provider instead ofMicrosoft-Windows-PowerShell, which is the ETW provider for Windows PowerShell.

PR Checklist

PR has a meaningful title
- Use the present tense and imperative mood when describing your changes
Summarized changes
Make sure all.h,.cpp,.cs,.ps1 and.psm1 files have the correct copyright header
This PR is ready to merge. If this PR is a work in progress, please open this as aDraft Pull Request and mark it as Ready to Review when it is ready to merge.
Breaking changes
- None
- OR
- Experimental feature(s) needed
  - Experimental feature name(s):
User-facing changes
- Not Applicable
- OR
- Documentation needed
  - Issue filed:ThePSDiagnostics module in PowerShell 7 will be updated to work with the "PowerShellCore" ETW provider MicrosoftDocs/PowerShell-Docs#12091
Testing - New and feature
- N/A or can only be tested interactively
- OR
- Make sure you've added a new test if existing tests do not effectively test the code changed

Remove the use of Windows PowerShell ETW provider id and update PSDia…

980166c

…gnostics to work for PS7+

daxian-dbw mentioned this pull request

May 21, 2025

ThePSDiagnostics module in PowerShell 7 will be updated to work with the "PowerShellCore" ETW providerMicrosoftDocs/PowerShell-Docs#12091

Closed

2 tasks

daxian-dbw added the CL-CodeCleanupIndicates that a PR should be marked as a Code Cleanup change in the Change Log label

May 21, 2025

Attempt to fix tests

be3bd60

daxian-dbw requested review fromSeeminglyScience,TravisEz13,adityapatwardhan andjborean93

May 21, 2025 21:10

jborean93 reviewed

May 22, 2025

View reviewed changes

Copy link

Collaborator

jborean93 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

I'm not really too familiar with the ETW side and thePSDiagnostics module but wouldn't this be a breaking change? Right now thePSDiagnostics module is importable in PS 7 and manages the WinPS provider. While I understand trying to keep the providers aligned with the PowerShell version used there could potentially be people using PS 7 to manage the WinPS provider in this module.

src/System.Management.Automation/utils/tracing/TracingGen.cs

		/// </summary>
		publicconstlongKeywordAll=0xFFFFFFFF;

		privatestaticreadonlyGuidproviderId=Guid.Parse("a0c1853b-5c40-4b15-8766-3cf1c58f985a");

Copy link

Collaborator

jborean93May 22, 2025•
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Is there a reason why this doesn't use thePowerShellCore Provider IDf90714a8-5509-434a-bf6d-b1624c8a19a2 rather than just removing it?

Copy link

Collaborator

iSazonovMay 22, 2025•
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

It is already there. It is inherited from EwtActivity.ProviderId (that is PSEtwLogProvider.ProviderGuid).
The (whole) code looks a bit confusing, though.

Copy link

MemberAuthor

daxian-dbwMay 22, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

This looks like an oversight when introducing thePowerShellCore provider initially in#5144.

TheTracer class is used in*-PSSessionConfiguration commands to write ETW logs likeEndpoint registered/unregistered/modified/enabled/disabled. Today, those events are writting to the Windows PowerShell provider. The class is only used inContainerParentJob.

daxian-dbw added the CL-BreakingChangeIndicates that a PR should be marked as a breaking change in the Change Log label

May 22, 2025

Copy link

MemberAuthor

daxian-dbw commentedMay 22, 2025

I'm not really too familiar with the ETW side and the PSDiagnostics module but wouldn't this be a breaking change? Right now the PSDiagnostics module is importable in PS 7 and manages the WinPS provider. While I understand trying to keep the providers aligned with the PowerShell version used there could potentially be people using PS 7 to manage the WinPS provider in this module.

The change toPSDiagnostics is a breaking change. It breaks the scenario where a user intentionally uses PowerShell 7+ to enable/disable Windows PowerShell ETW tracing. But is that a real-world scenario?

This module is shipped with PowerShell 7, so intuitively, runningEnable-PSTrace from this module should enable thePowerShellCore provider instead of the Windows PowerShell ETW provider.