Hi,
You should save the below text in a file named networkloadbalancing-core-diagnostic.events.man
Important: this is an unsupported script, please use this script at your own risk. Microsoft’s Customer Support Services (CSS/PSS) will not support issues associated with this script.
<?xml version='1.0' encoding='utf-8' standalone='yes'?>
<assembly
xmlns="urn:schemas-microsoft-com:asm.v3"
xmlns:win="http://manifests.microsoft.com/win/2004/08/windows/events"
xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
manifestVersion="1.0"
>
<assemblyIdentity
buildType="$(build.buildType)"
language="neutral"
name="Microsoft-Windows-NetworkLoadBalancing-Core-Diagnostic-Events"
processorArchitecture="$(build.processorArchitecture)"
publicKeyToken="$(Build.WindowsPublicKeyToken)"
version="$(build.version)"
versionScope="nonSxS"
/>
<instrumentation>
<events xmlns="http://schemas.microsoft.com/win/2004/08/events">
<provider
guid="{DEF02E30-3290-4b2d-BC28-D2B0EDADF411}"
message="$(string.NLB.Diagnostics.ProviderName)"
messageFileName="%SystemRoot%System32driversnlb.sys"
name="Microsoft-Windows-NLB-Diagnostic"
resourceFileName="%SystemRoot%System32driversnlb.sys"
symbol="MICROSOFT_NETWORK_LOAD_BALANCING_DIAGNOSTIC_PUBLISHER"
>
<channels>
<channel
chid="NlbTrace"
enabled="false"
isolation="System"
message="$(string.NLB.Diagnostics.DiagnosticChannel)"
name="Microsoft-Windows-NLB/Diagnostic"
symbol="NLB_TRACE_CHANNEL"
type="Analytic"
>
<logging>
<retention>false</retention>
<maxSize>104857600</maxSize>
</logging>
<publishing>
<clockType>QPC</clockType>
</publishing>
</channel>
</channels>
<tasks>
<task
message="$(string.FilteringTaskMsg.1)"
name="Task.Filtering.SendAccept"
symbol="TaskFilteringSendAccept"
value="101"
/>
<task
message="$(string.FilteringTaskMsg.2)"
name="Task.Filtering.SendDrop"
symbol="TaskFilteringSendDrop"
value="102"
/>
<task
message="$(string.FilteringTaskMsg.3)"
name="Task.Filtering.ReceiveAccept"
symbol="TaskFilteringReceiveAccept"
value="103"
/>
<task
message="$(string.FilteringTaskMsg.4)"
name="Task.Filtering.ReceiveDrop"
symbol="TaskFilteringReceiveDrop"
value="104"
/>
</tasks>
<opcodes/>
<keywords>
<keyword
mask="0x0000000000000001"
message="$(string.Keyword.NLB)"
name="NLB"
/>
<keyword
mask="0x0000000000000002"
message="$(string.Keyword.Filtering)"
name="Filtering"
/>
<keyword
mask="0x0000000000000004"
message="$(string.Keyword.Hook)"
name="Hook"
/>
<keyword
mask="0x0000000000000008"
message="$(string.Keyword.Send)"
name="Send"
/>
<keyword
mask="0x0000000000000010"
message="$(string.Keyword.Receive)"
name="Receive"
/>
<keyword
mask="0x0000000000000020"
message="$(string.Keyword.Accept)"
name="Accept"
/>
<keyword
mask="0x0000000000000040"
message="$(string.Keyword.Drop)"
name="Drop"
/>
</keywords>
<maps>
<valueMap name="NLB_ACCEPT_DROP_REASON">
<map
message="$(string.NLB_ACCEPT_DROP_REASON.0)"
value="0"
/>
<map
message="$(string.NLB_ACCEPT_DROP_REASON.1)"
value="1"
&nb
Microsoft
