WSAT_TraceProvider

Event	Title	Channel	Sample	Rule
0	WSAT Trace Record	ETW Trace	N	N
1	WSAT Trace Record	ETW Trace	N	N
2	WSAT Trace Record	ETW Trace	N	N
5	Activity Transfer Event	ETW Trace	N	N
10	WSAT Trace Record	ETW Trace	N	N
11	WSAT Trace Record	ETW Trace	N	N

Event ID 0: WSAT Trace Record

Channel: ETW Trace
Opcode: Trace Start Stop Suspend Resume
Source: Trace

Fields #

Name	Description
`ActivityID` mof:Object
`TraceRecord` mof:String
`EventID` mof:SInt32

Event ID 1: WSAT Trace Record

Channel: ETW Trace
Opcode: Trace Start Stop Suspend Resume
Source: Trace

Fields #

Name	Description
`ActivityID` mof:Object
`TraceRecord` mof:String
`EventID` mof:SInt32

Event ID 2: WSAT Trace Record

Channel: ETW Trace
Opcode: Trace Start Stop Suspend Resume
Source: Trace

Fields #

Name	Description
`ActivityID` mof:Object
`TraceRecord` mof:String
`EventID` mof:SInt32

Event ID 5: Activity Transfer Event

Channel: ETW Trace
Opcode: Transfer
Source: Trace

Fields #

Name	Description
`ActivityID` mof:Object
`RelatedActivityID` mof:Object

Event ID 10: WSAT Trace Record

Channel: ETW Trace
Opcode: Trace Start Stop Suspend Resume
Source: Trace

Fields #

Name	Description
`ActivityID` mof:Object
`TraceRecord` mof:String
`EventID` mof:SInt32

Event ID 11: WSAT Trace Record

Channel: ETW Trace
Opcode: Trace Start Stop Suspend Resume
Source: Trace

Fields #

Name	Description
`ActivityID` mof:Object
`TraceRecord` mof:String
`EventID` mof:SInt32

Provenance

ETW provider GUID {7F3FE630-462B-47C5-AB07-67CA84934ABD}

WS2025-26100.0, schema read from the WMI MOF class, captured 2026-02-26
Taken from Windows installation media (build 26100.1), not a patched system, so the exact update level is unknown.
WS2022-20348.4893, schema read from the WMI MOF class, captured 2026-06-02
MOF class: WSAT_TraceProvider
Win11-26200.6584, schema read from the WMI MOF class, captured 2026-06-02
MOF class: WSAT_TraceProvider