HelpCache/MSFT_NetEventProvider.cdxml-help.xml
|
<?xml version="1.0" encoding="utf-8"?>
<helpItems xmlns="http://msh" schema="maml"> <!-- Updatable Help Version 4.0.4.0 --> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details> <command:name>Add-NetEventNetworkAdapter</command:name> <maml:description> <maml:para>Adds a network adapter as a filter on a provider.</maml:para> </maml:description> <maml:copyright> <maml:para /> </maml:copyright> <command:verb>Add</command:verb> <command:noun>NetEventNetworkAdapter</command:noun> <dev:version /> </command:details> <maml:description> <maml:para>The Add-NetEventNetworkAdapter cmdlet adds a network adapter as a filter on a Remote Packet Capture provider. The protocol stack uses multiple layers to transmit, receive, and process network traffic, or packets. The provider logs network traffic as Event Tracing for Windows (ETW) events.</maml:para> <maml:para>Use this cmdlet multiple times to add several adapters. To see which adapters currently belong to a provider, use the Get-NetEventNetworkAdapter cmdlet.</maml:para> <maml:para>When you add an adapter to provider in a session that is currently running, stop and start the session for your changes to take effect. Use the Stop-NetEventSession cmdlet to stop a session and the Start-NetEventSession cmdlet to restart it.</maml:para> </maml:description> <command:syntax> <command:syntaxItem> <maml:name>Add-NetEventNetworkAdapter</maml:name> <command:parameter required="true" variableLength="false" globbing="false" pipelineInput="True (ByPropertyName)" position="1" aliases="none"> <maml:name>Name</maml:name> <maml:description> <maml:para>Specifies the name of a network adapter to add. </maml:para> </maml:description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="2" aliases="none"> <maml:name>PromiscuousMode</maml:name> <maml:description> <maml:para>Specifies whether the network adapter uses promiscuous mode. Promiscuous mode starts when the packet capture session starts. When the packet capture session stops, the network adapter is restored to its original setting for promiscuous mode.</maml:para> <maml:para>This cmdlet supports this parameter for the Windows 8.1 operating system and the Windows Server 2012 R2 operating system only. You must install the hotfix in the topic <maml:navigationLink><maml:linkText>Promiscuous mode is not set on network adapter to monitor network traffic in Windows Server 2012 R2</maml:linkText><maml:uri></maml:uri></maml:navigationLink> (http://support.microsoft.com/en-us/kb/3047154) in the Microsoft Support library.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">System.Boolean</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell� calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>Confirm</maml:name> <maml:description> <maml:para>Prompts you for confirmation before running the cmdlet.Prompts you for confirmation before running the cmdlet.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>WhatIf</maml:name> <maml:description> <maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run.Shows what would happen if the cmdlet runs. The cmdlet is not run.</maml:para> </maml:description> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> <dev:type> <maml:name>CimSession[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="true" variableLength="false" globbing="false" pipelineInput="True (ByPropertyName)" position="1" aliases="none"> <maml:name>Name</maml:name> <maml:description> <maml:para>Specifies the name of a network adapter to add. </maml:para> </maml:description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="2" aliases="none"> <maml:name>PromiscuousMode</maml:name> <maml:description> <maml:para>Specifies whether the network adapter uses promiscuous mode. Promiscuous mode starts when the packet capture session starts. When the packet capture session stops, the network adapter is restored to its original setting for promiscuous mode.</maml:para> <maml:para>This cmdlet supports this parameter for the Windows 8.1 operating system and the Windows Server 2012 R2 operating system only. You must install the hotfix in the topic <maml:navigationLink><maml:linkText>Promiscuous mode is not set on network adapter to monitor network traffic in Windows Server 2012 R2</maml:linkText><maml:uri></maml:uri></maml:navigationLink> (http://support.microsoft.com/en-us/kb/3047154) in the Microsoft Support library.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">System.Boolean</command:parameterValue> <dev:type> <maml:name>System.Boolean</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell� calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> <dev:type> <maml:name>Int32</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>Confirm</maml:name> <maml:description> <maml:para>Prompts you for confirmation before running the cmdlet.Prompts you for confirmation before running the cmdlet.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>false</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>WhatIf</maml:name> <maml:description> <maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run.Shows what would happen if the cmdlet runs. The cmdlet is not run.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>false</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes> <command:inputType> <dev:type> <maml:name> </maml:name> <maml:uri> </maml:uri> <maml:description> <maml:para /> </maml:description> </dev:type> <maml:description> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues> <command:returnValue> <dev:type> <maml:name> </maml:name> <maml:uri> </maml:uri> <maml:description> <maml:para /> </maml:description> </dev:type> <maml:description> </maml:description> </command:returnValue> </command:returnValues> <command:terminatingErrors /> <command:nonTerminatingErrors /> <command:examples> <command:example> <maml:title>Example 1: Add a network adapter</maml:title> <maml:introduction> <maml:para> </maml:para> </maml:introduction> <dev:code>PS C:\>New-NetEventSession -Name "Session38" PS C:\> Add-NetEventPacketCaptureProvider -SessionName "Session38" PS C:\> Add-NetEventNetworkAdapter -Name "Ethernet01" </dev:code> <dev:remarks> <maml:para>This example creates a network event session, adds a provider, and then adds a network adapter.</maml:para> <maml:para>The first command uses the New-NetEventSession cmdlet to create a network event session named Session38.</maml:para> <maml:para>The second command adds a provider to the session named Session38 by using the Add-NetEventPacketCaptureProvider cmdlet. A session must have a provider in order to capture packets.</maml:para> <maml:para>The third command adds a network adapter. After you create and configure the session, use the Start-NetEventSession cmdlet to start capturing packets. </maml:para> <maml:para /> <maml:para /> </dev:remarks> <command:commandLines> <command:commandLine> <command:commandText /> </command:commandLine> </command:commandLines> </command:example> </command:examples> <maml:relatedLinks> <maml:navigationLink> <maml:linkText>Online Version:</maml:linkText> <maml:uri>http://go.microsoft.com/fwlink/?LinkID=294381</maml:uri> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Get-NetEventNetworkAdapter</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Remove-NetEventNetworkAdapter</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>New-NetEventSession</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Add-NetEventPacketCaptureProvider</maml:linkText> <maml:uri /> </maml:navigationLink> </maml:relatedLinks> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details> <command:name>Add-NetEventPacketCaptureProvider</command:name> <maml:description> <maml:para>Adds a Remote Packet Capture provider.</maml:para> </maml:description> <maml:copyright> <maml:para /> </maml:copyright> <command:verb>Add</command:verb> <command:noun>NetEventPacketCaptureProvider</command:noun> <dev:version /> </command:details> <maml:description> <maml:para>The Add-NetEventPacketCaptureProvider cmdlet adds a Remote Packet Capture provider. You can only use one packet capture provider at a time and you must remove an existing provider before you use this cmdlet to add a new provider. To remove an existing Remote Packet Capture provider, use the Remove-NetEventPacketCaptureProvider cmdlet.</maml:para> </maml:description> <command:syntax> <command:syntaxItem> <maml:name>Add-NetEventPacketCaptureProvider</maml:name> <command:parameter required="true" variableLength="false" globbing="false" pipelineInput="false" position="1" aliases="none"> <maml:name>SessionName</maml:name> <maml:description> <maml:para>Specifies the name of the session associated with the packet capture provider. </maml:para> </maml:description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="10" aliases="none"> <maml:name>IpProtocols</maml:name> <maml:description> <maml:para>Specifies an array of one or more IP protocols, such as TCP or UDP, on which to filter. The packet capture provider logs network traffic that matches this filter.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">Byte[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="11" aliases="none"> <maml:name>TruncationLength</maml:name> <maml:description> <maml:para>Specifies the display length of each captured packet. The default size is 128 bytes. </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">UInt16</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="12" aliases="none"> <maml:name>VmCaptureDirection</maml:name> <maml:description> <maml:para>Specifies the direction of network traffic for a Virtual Machine (VM) capture. The acceptable values for this parameter are: -- Ingress. Network traffic from a VM to a virtual switch. -- Egress. Network traffic from a virtual switch to a VM.</maml:para> </maml:description> <command:parameterValueGroup> <command:parameterValue required="false" variableLength="false">Ingress</command:parameterValue> <command:parameterValue required="false" variableLength="false">Egress</command:parameterValue> <command:parameterValue required="false" variableLength="false">IngressAndEgress</command:parameterValue> </command:parameterValueGroup> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="2" aliases="none"> <maml:name>Level</maml:name> <maml:description> <maml:para>Specifies the level of Event Tracing for Windows (ETW) events for the provider. Use the level of detail for the event to filter the events that are logged. The default value for this parameter is 0x4. Acceptable values for this parameter are: -- 0x5. Verbose -- 0x4. Informational -- 0x3. Warning -- 0x2. Error -- 0x1. Critical -- 0x0. LogAlways </maml:para> <maml:para>The provider must log the event if the value of the event is less than or equal to the value of this parameter.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Byte</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="3" aliases="none"> <maml:name>MatchAnyKeyword</maml:name> <maml:description> <maml:para>Specifies keywords as a set of hexadecimal values. Keywords are flags that you can combine to generate values. Use a set of hexadecimal values of the keywords instead of the keyword names, and apply a filter to write ETW events for keyword matches. For more information, see <maml:navigationLink><maml:linkText>http://msdn.microsoft.com/en-us/library/windows/desktop/dd392305(v=vs.85).aspx</maml:linkText><maml:uri></maml:uri></maml:navigationLink> in the Microsoft Developer Library.</maml:para> <maml:para> </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">UInt64</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4" aliases="none"> <maml:name>MatchAllKeyword</maml:name> <maml:description> <maml:para>Specifies a bitmask that restricts the events that the provider logs. Set the MatchAnyKeyword parameter value to 0 (zero) to match all keywords.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">UInt64</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="5" aliases="none"> <maml:name>CaptureType</maml:name> <maml:description> <maml:para>Specifies a capture type. Acceptable values for this parameter are: -- SaveToFile. Writes events to a local .etl file. -- RealtimeRPC. Creates a real-time capture session and forwards the events to a remote host as they are recorded. -- RealtimeLocal. Creates a real-time capture session and forwards the events to a local Event Tracing for Windows (ETW) listener as they are recorded. </maml:para> </maml:description> <command:parameterValueGroup> <command:parameterValue required="false" variableLength="false">Physical</command:parameterValue> <command:parameterValue required="false" variableLength="false">Switch</command:parameterValue> <command:parameterValue required="false" variableLength="false">BothPhysicalAndSwitch</command:parameterValue> </command:parameterValueGroup> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="6" aliases="none"> <maml:name>MultiLayer</maml:name> <maml:description> <maml:para>Indicates whether the capture occurs at various layers of the stack. This setting has a value of $False by default. </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Boolean</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="7" aliases="none"> <maml:name>LinkLayerAddress</maml:name> <maml:description> <maml:para>Specifies an array of link layer, or Media Access Control (MAC), addresses. The packet capture provider logs network traffic that matches this filter.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">String[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="8" aliases="none"> <maml:name>EtherType</maml:name> <maml:description> <maml:para>Specifies an array of ether types. The most common ether types and their values are IPv4 (0800), IPv6 (86DD) and ARP (0806).</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">UInt16[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="9" aliases="none"> <maml:name>IpAddresses</maml:name> <maml:description> <maml:para>Specifies an array of IP addresses on which to filter. The packet capture provider logs network traffic that matches this filter. </maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">String[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell� calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>Confirm</maml:name> <maml:description> <maml:para>Prompts you for confirmation before running the cmdlet.Prompts you for confirmation before running the cmdlet.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>WhatIf</maml:name> <maml:description> <maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run.Shows what would happen if the cmdlet runs. The cmdlet is not run.</maml:para> </maml:description> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="5" aliases="none"> <maml:name>CaptureType</maml:name> <maml:description> <maml:para>Specifies a capture type. Acceptable values for this parameter are: -- SaveToFile. Writes events to a local .etl file. -- RealtimeRPC. Creates a real-time capture session and forwards the events to a remote host as they are recorded. -- RealtimeLocal. Creates a real-time capture session and forwards the events to a local Event Tracing for Windows (ETW) listener as they are recorded. </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">CaptureType</command:parameterValue> <dev:type> <maml:name>CaptureType</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> <dev:type> <maml:name>CimSession[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="8" aliases="none"> <maml:name>EtherType</maml:name> <maml:description> <maml:para>Specifies an array of ether types. The most common ether types and their values are IPv4 (0800), IPv6 (86DD) and ARP (0806).</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">UInt16[]</command:parameterValue> <dev:type> <maml:name>UInt16[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="9" aliases="none"> <maml:name>IpAddresses</maml:name> <maml:description> <maml:para>Specifies an array of IP addresses on which to filter. The packet capture provider logs network traffic that matches this filter. </maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">String[]</command:parameterValue> <dev:type> <maml:name>String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="10" aliases="none"> <maml:name>IpProtocols</maml:name> <maml:description> <maml:para>Specifies an array of one or more IP protocols, such as TCP or UDP, on which to filter. The packet capture provider logs network traffic that matches this filter.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">Byte[]</command:parameterValue> <dev:type> <maml:name>Byte[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="2" aliases="none"> <maml:name>Level</maml:name> <maml:description> <maml:para>Specifies the level of Event Tracing for Windows (ETW) events for the provider. Use the level of detail for the event to filter the events that are logged. The default value for this parameter is 0x4. Acceptable values for this parameter are: -- 0x5. Verbose -- 0x4. Informational -- 0x3. Warning -- 0x2. Error -- 0x1. Critical -- 0x0. LogAlways </maml:para> <maml:para>The provider must log the event if the value of the event is less than or equal to the value of this parameter.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Byte</command:parameterValue> <dev:type> <maml:name>Byte</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="7" aliases="none"> <maml:name>LinkLayerAddress</maml:name> <maml:description> <maml:para>Specifies an array of link layer, or Media Access Control (MAC), addresses. The packet capture provider logs network traffic that matches this filter.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">String[]</command:parameterValue> <dev:type> <maml:name>String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4" aliases="none"> <maml:name>MatchAllKeyword</maml:name> <maml:description> <maml:para>Specifies a bitmask that restricts the events that the provider logs. Set the MatchAnyKeyword parameter value to 0 (zero) to match all keywords.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">UInt64</command:parameterValue> <dev:type> <maml:name>UInt64</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="3" aliases="none"> <maml:name>MatchAnyKeyword</maml:name> <maml:description> <maml:para>Specifies keywords as a set of hexadecimal values. Keywords are flags that you can combine to generate values. Use a set of hexadecimal values of the keywords instead of the keyword names, and apply a filter to write ETW events for keyword matches. For more information, see <maml:navigationLink><maml:linkText>http://msdn.microsoft.com/en-us/library/windows/desktop/dd392305(v=vs.85).aspx</maml:linkText><maml:uri></maml:uri></maml:navigationLink> in the Microsoft Developer Library.</maml:para> <maml:para> </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">UInt64</command:parameterValue> <dev:type> <maml:name>UInt64</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="6" aliases="none"> <maml:name>MultiLayer</maml:name> <maml:description> <maml:para>Indicates whether the capture occurs at various layers of the stack. This setting has a value of $False by default. </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Boolean</command:parameterValue> <dev:type> <maml:name>Boolean</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="true" variableLength="false" globbing="false" pipelineInput="false" position="1" aliases="none"> <maml:name>SessionName</maml:name> <maml:description> <maml:para>Specifies the name of the session associated with the packet capture provider. </maml:para> </maml:description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell� calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> <dev:type> <maml:name>Int32</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="11" aliases="none"> <maml:name>TruncationLength</maml:name> <maml:description> <maml:para>Specifies the display length of each captured packet. The default size is 128 bytes. </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">UInt16</command:parameterValue> <dev:type> <maml:name>UInt16</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="12" aliases="none"> <maml:name>VmCaptureDirection</maml:name> <maml:description> <maml:para>Specifies the direction of network traffic for a Virtual Machine (VM) capture. The acceptable values for this parameter are: -- Ingress. Network traffic from a VM to a virtual switch. -- Egress. Network traffic from a virtual switch to a VM.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">VmCaptureDirection</command:parameterValue> <dev:type> <maml:name>VmCaptureDirection</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>Confirm</maml:name> <maml:description> <maml:para>Prompts you for confirmation before running the cmdlet.Prompts you for confirmation before running the cmdlet.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>false</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>WhatIf</maml:name> <maml:description> <maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run.Shows what would happen if the cmdlet runs. The cmdlet is not run.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>false</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes> <command:inputType> <dev:type> <maml:name> </maml:name> <maml:uri> </maml:uri> <maml:description> <maml:para /> </maml:description> </dev:type> <maml:description> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues> <command:returnValue> <dev:type> <maml:name> </maml:name> <maml:uri> </maml:uri> <maml:description> <maml:para /> </maml:description> </dev:type> <maml:description> </maml:description> </command:returnValue> </command:returnValues> <command:terminatingErrors /> <command:nonTerminatingErrors /> <command:examples> <command:example> <maml:title>Example 1: Add a packet capture provider</maml:title> <maml:introduction> <maml:para> </maml:para> </maml:introduction> <dev:code>PS C:\>New-NetEventSession -SessionName "Session01" PS C:\> Add-NetEventProvider -Name "Microsoft-Windows-TCPIP" -SessionName "Session01" PS C:\> Add-NetEventPacketCaptureProvider -SessionName "Session01" </dev:code> <dev:remarks> <maml:para>This example adds a Remote Packet Capture provider to a session.</maml:para> <maml:para>The first command uses the New-NetEventSession cmdlet to create a new session named Session01.</maml:para> <maml:para>The second command adds a provider named Microsoft-Windows-TCPIP to the session named Session01 by using the Add-NetEventProvider cmdlet.</maml:para> <maml:para>The third command adds a packet capture provider to the session.</maml:para> <maml:para /> <maml:para /> </dev:remarks> <command:commandLines> <command:commandLine> <command:commandText /> </command:commandLine> </command:commandLines> </command:example> </command:examples> <maml:relatedLinks> <maml:navigationLink> <maml:linkText>Online Version:</maml:linkText> <maml:uri>http://go.microsoft.com/fwlink/?LinkID=294382</maml:uri> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Add-NetEventProvider</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Get-NetEventPacketCaptureProvider</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>New-NetEventSession</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Remove-NetEventPacketCaptureProvider</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Set-NetEventPacketCaptureProvider</maml:linkText> <maml:uri /> </maml:navigationLink> </maml:relatedLinks> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details> <command:name>Add-NetEventProvider</command:name> <maml:description> <maml:para>Adds an ETW provider to a session. </maml:para> </maml:description> <maml:copyright> <maml:para /> </maml:copyright> <command:verb>Add</command:verb> <command:noun>NetEventProvider</command:noun> <dev:version /> </command:details> <maml:description> <maml:para>The Add-NetEventProvider cmdlet adds an Event Tracing for Windows (ETW) provider to a session.</maml:para> </maml:description> <command:syntax> <command:syntaxItem> <maml:name>Add-NetEventProvider</maml:name> <command:parameter required="true" variableLength="false" globbing="false" pipelineInput="false" position="1" aliases="none"> <maml:name>Name</maml:name> <maml:description> <maml:para>Specifies a name that identifies an ETW provider. </maml:para> </maml:description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> </command:parameter> <command:parameter required="true" variableLength="false" globbing="false" pipelineInput="false" position="2" aliases="none"> <maml:name>SessionName</maml:name> <maml:description> <maml:para>Specifies the name of the session associated with the packet capture provider.</maml:para> </maml:description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="3" aliases="none"> <maml:name>Level</maml:name> <maml:description> <maml:para>Specifies the level of Event Tracing for Windows (ETW) events for the provider. Use the level of detail for the event to filter the events that are logged. The default value for this parameter is 0x4. Acceptable values for this parameter are: -- 0x5. Verbose -- 0x4. Informational -- 0x3. Warning -- 0x2. Error -- 0x1. Critical -- 0x0. LogAlways </maml:para> <maml:para>The provider must log the event if the value of the event is less than or equal to the value of this parameter.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Byte</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4" aliases="none"> <maml:name>MatchAnyKeyword</maml:name> <maml:description> <maml:para> </maml:para> <maml:para>Specifies keywords as a set of hexadecimal values. Keywords are flags that you can combine to generate values. Use a set of hexadecimal values of the keywords instead of the keyword names, and apply a filter to write ETW events for keyword matches. </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">UInt64</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="5" aliases="none"> <maml:name>MatchAllKeyword</maml:name> <maml:description> <maml:para>Specifies a bitmask that restricts the events that the provider logs.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">UInt64</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell� calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>Confirm</maml:name> <maml:description> <maml:para>Prompts you for confirmation before running the cmdlet.Prompts you for confirmation before running the cmdlet.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>WhatIf</maml:name> <maml:description> <maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run.Shows what would happen if the cmdlet runs. The cmdlet is not run.</maml:para> </maml:description> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> <dev:type> <maml:name>CimSession[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="3" aliases="none"> <maml:name>Level</maml:name> <maml:description> <maml:para>Specifies the level of Event Tracing for Windows (ETW) events for the provider. Use the level of detail for the event to filter the events that are logged. The default value for this parameter is 0x4. Acceptable values for this parameter are: -- 0x5. Verbose -- 0x4. Informational -- 0x3. Warning -- 0x2. Error -- 0x1. Critical -- 0x0. LogAlways </maml:para> <maml:para>The provider must log the event if the value of the event is less than or equal to the value of this parameter.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Byte</command:parameterValue> <dev:type> <maml:name>Byte</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="5" aliases="none"> <maml:name>MatchAllKeyword</maml:name> <maml:description> <maml:para>Specifies a bitmask that restricts the events that the provider logs.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">UInt64</command:parameterValue> <dev:type> <maml:name>UInt64</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4" aliases="none"> <maml:name>MatchAnyKeyword</maml:name> <maml:description> <maml:para> </maml:para> <maml:para>Specifies keywords as a set of hexadecimal values. Keywords are flags that you can combine to generate values. Use a set of hexadecimal values of the keywords instead of the keyword names, and apply a filter to write ETW events for keyword matches. </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">UInt64</command:parameterValue> <dev:type> <maml:name>UInt64</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="true" variableLength="false" globbing="false" pipelineInput="false" position="1" aliases="none"> <maml:name>Name</maml:name> <maml:description> <maml:para>Specifies a name that identifies an ETW provider. </maml:para> </maml:description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="true" variableLength="false" globbing="false" pipelineInput="false" position="2" aliases="none"> <maml:name>SessionName</maml:name> <maml:description> <maml:para>Specifies the name of the session associated with the packet capture provider.</maml:para> </maml:description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell� calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> <dev:type> <maml:name>Int32</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>Confirm</maml:name> <maml:description> <maml:para>Prompts you for confirmation before running the cmdlet.Prompts you for confirmation before running the cmdlet.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>false</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>WhatIf</maml:name> <maml:description> <maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run.Shows what would happen if the cmdlet runs. The cmdlet is not run.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>false</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes> <command:inputType> <dev:type> <maml:name> </maml:name> <maml:uri> </maml:uri> <maml:description> <maml:para /> </maml:description> </dev:type> <maml:description> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues> <command:returnValue> <dev:type> <maml:name> </maml:name> <maml:uri> </maml:uri> <maml:description> <maml:para /> </maml:description> </dev:type> <maml:description> </maml:description> </command:returnValue> </command:returnValues> <command:terminatingErrors /> <command:nonTerminatingErrors /> <command:examples> <command:example> <maml:title>Example 1: Add an ETW provider to a session</maml:title> <maml:introduction> <maml:para> </maml:para> </maml:introduction> <dev:code>PS C:\>New-NetEventSession -SessionName "Session01" PS C:\> Add-NetEventProvider -Name "Microsoft-Windows-TCPIP" -SessionName "Session01" </dev:code> <dev:remarks> <maml:para>This example adds an ETW provider to a session.</maml:para> <maml:para>The first command uses the New-NetEventSession cmdlet to create a new session named Session01.</maml:para> <maml:para>The second command adds an ETW provider named Microsoft-Windows-TCPIP to the session named Session01.</maml:para> <maml:para /> <maml:para /> </dev:remarks> <command:commandLines> <command:commandLine> <command:commandText /> </command:commandLine> </command:commandLines> </command:example> </command:examples> <maml:relatedLinks> <maml:navigationLink> <maml:linkText>Online Version:</maml:linkText> <maml:uri>http://go.microsoft.com/fwlink/?LinkID=294383</maml:uri> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Get-NetEventProvider</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>New-NetEventSession</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Remove-NetEventProvider</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Set-NetEventProvider</maml:linkText> <maml:uri /> </maml:navigationLink> </maml:relatedLinks> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details> <command:name>Add-NetEventVmNetworkAdapter</command:name> <maml:description> <maml:para>Adds a virtual network adapter as a filter on the provider.</maml:para> </maml:description> <maml:copyright> <maml:para /> </maml:copyright> <command:verb>Add</command:verb> <command:noun>NetEventVmNetworkAdapter</command:noun> <dev:version /> </command:details> <maml:description> <maml:para>The Add-NetEventVmNetworkAdapter cmdlet adds a network adapter of a virtual machine as a filter on a Remote Packet Capture provider. Specify the name of the virtual network adapter. The protocol stack uses multiple layers to transmit, receive, and process network traffic as packets. The provider logs network traffic as Event Tracing for Windows (ETW) events. </maml:para> <maml:para>Use this cmdlet multiple times to add multiple adapters. To see which virtual adapters belong to the provider, use the Get-NetEventVmNetworkAdapter cmdlet.</maml:para> </maml:description> <command:syntax> <command:syntaxItem> <maml:name>Add-NetEventVmNetworkAdapter</maml:name> <command:parameter required="true" variableLength="false" globbing="false" pipelineInput="True (ByPropertyName)" position="1" aliases="none"> <maml:name>Name</maml:name> <maml:description> <maml:para>Specifies a name for the virtual network adapter.</maml:para> </maml:description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell� calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>Confirm</maml:name> <maml:description> <maml:para>Prompts you for confirmation before running the cmdlet.Prompts you for confirmation before running the cmdlet.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>WhatIf</maml:name> <maml:description> <maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run.Shows what would happen if the cmdlet runs. The cmdlet is not run.</maml:para> </maml:description> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> <dev:type> <maml:name>CimSession[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="true" variableLength="false" globbing="false" pipelineInput="True (ByPropertyName)" position="1" aliases="none"> <maml:name>Name</maml:name> <maml:description> <maml:para>Specifies a name for the virtual network adapter.</maml:para> </maml:description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell� calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> <dev:type> <maml:name>Int32</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>Confirm</maml:name> <maml:description> <maml:para>Prompts you for confirmation before running the cmdlet.Prompts you for confirmation before running the cmdlet.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>false</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>WhatIf</maml:name> <maml:description> <maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run.Shows what would happen if the cmdlet runs. The cmdlet is not run.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>false</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes> <command:inputType> <dev:type> <maml:name> </maml:name> <maml:uri> </maml:uri> <maml:description> <maml:para /> </maml:description> </dev:type> <maml:description> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues> <command:returnValue> <dev:type> <maml:name> </maml:name> <maml:uri> </maml:uri> <maml:description> <maml:para /> </maml:description> </dev:type> <maml:description> </maml:description> </command:returnValue> </command:returnValues> <command:terminatingErrors /> <command:nonTerminatingErrors /> <command:examples> <command:example> <maml:title>Example 1: Add a virtual network adapter to the provider</maml:title> <maml:introduction> <maml:para> </maml:para> </maml:introduction> <dev:code>PS C:\>New-NetEventSession -Name "NESession01" PS C:\> Add-NetEventPacketCaptureProvider -SessionName "NESession01" PS C:\> Add-NetEventVMNetworkAdapter -Name "LargeGuid" </dev:code> <dev:remarks> <maml:para>This example adds a virtual network adapter as a filter on the Remote Packet Capture provider for a network session. After you complete these commands to configure the network session, you can start and stop the event and packet capture for the network session by using the Start-NetEventSession and Stop-NetEventSession cmdlets.</maml:para> <maml:para>The first command uses the New-NetEventSession cmdlet to create a network session named NESession01.</maml:para> <maml:para>The second command uses the Add-NetEventPacketCaptureProvider cmdlet to add a Remote Packet Capture provider for the session named NESession01.</maml:para> <maml:para>The third command adds a virtual network adapter named LargeGuid as a filter on the Remote Packet Capture provider.</maml:para> <maml:para /> <maml:para /> </dev:remarks> <command:commandLines> <command:commandLine> <command:commandText /> </command:commandLine> </command:commandLines> </command:example> </command:examples> <maml:relatedLinks> <maml:navigationLink> <maml:linkText>Online Version:</maml:linkText> <maml:uri>http://go.microsoft.com/fwlink/?LinkId=294385</maml:uri> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Get-NetEventVmNetworkAdapter</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Remove-NetEventVmNetworkAdapter</maml:linkText> <maml:uri /> </maml:navigationLink> </maml:relatedLinks> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details> <command:name>Add-NetEventVmSwitch</command:name> <maml:description> <maml:para>Adds a Hyper-V virtual switch as a filter on a provider.</maml:para> </maml:description> <maml:copyright> <maml:para /> </maml:copyright> <command:verb>Add</command:verb> <command:noun>NetEventVmSwitch</command:noun> <dev:version /> </command:details> <maml:description> <maml:para>The Add-NetEventVmSwitch cmdlet adds a Hyper-V virtual switch as a filter on a Remote Packet Capture provider. Use this cmdlet multiple times to add multiple Hyper-V virtual switches. To get existing Hyper-V virtual switches, use the Get-NetEventVmSwitch cmdlet.</maml:para> <maml:para>The protocol stack uses multiple layers to transmit, receive, and process network traffic as packets. The provider logs network traffic as Event Tracing for Windows (ETW) events.</maml:para> </maml:description> <command:syntax> <command:syntaxItem> <maml:name>Add-NetEventVmSwitch</maml:name> <command:parameter required="true" variableLength="false" globbing="false" pipelineInput="True (ByPropertyName)" position="1" aliases="none"> <maml:name>Name</maml:name> <maml:description> <maml:para>Specifies a name for the Hyper-V virtual switch.</maml:para> </maml:description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell� calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>Confirm</maml:name> <maml:description> <maml:para>Prompts you for confirmation before running the cmdlet.Prompts you for confirmation before running the cmdlet.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>WhatIf</maml:name> <maml:description> <maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run.Shows what would happen if the cmdlet runs. The cmdlet is not run.</maml:para> </maml:description> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> <dev:type> <maml:name>CimSession[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="true" variableLength="false" globbing="false" pipelineInput="True (ByPropertyName)" position="1" aliases="none"> <maml:name>Name</maml:name> <maml:description> <maml:para>Specifies a name for the Hyper-V virtual switch.</maml:para> </maml:description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell� calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> <dev:type> <maml:name>Int32</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>Confirm</maml:name> <maml:description> <maml:para>Prompts you for confirmation before running the cmdlet.Prompts you for confirmation before running the cmdlet.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>false</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>WhatIf</maml:name> <maml:description> <maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run.Shows what would happen if the cmdlet runs. The cmdlet is not run.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>false</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes> <command:inputType> <dev:type> <maml:name> </maml:name> <maml:uri> </maml:uri> <maml:description> <maml:para /> </maml:description> </dev:type> <maml:description> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues> <command:returnValue> <dev:type> <maml:name> </maml:name> <maml:uri> </maml:uri> <maml:description> <maml:para /> </maml:description> </dev:type> <maml:description> </maml:description> </command:returnValue> </command:returnValues> <command:terminatingErrors /> <command:nonTerminatingErrors /> <command:examples> <command:example> <maml:title>Example 1: Add a Hyper-V virtual switch on a provider</maml:title> <maml:introduction> <maml:para> </maml:para> </maml:introduction> <dev:code>PS C:\>New-NetEventSession -Name "NESession01" PS C:\> Add-NetEventPacketCaptureProvider -SessionName "NESession01" PS C:\> Add-NetEventVMSwitch -Name �Network Adapter 2 - Virtual Switch" </dev:code> <dev:remarks> <maml:para>This example adds a Hyper-V virtual switch as a filter on the Remote Packet Capture provider for a network session. After you complete these commands to configure the network session, you can start and stop the event and packet capture for the network session by using the Start-NetEventSession and Stop-NetEventSession cmdlets.</maml:para> <maml:para>The first command uses the New-NetEventSession cmdlet to create a network session named NESession01.</maml:para> <maml:para>The second command uses the Add-NetEventPacketCaptureProvider cmdlet to add a Remote Packet Capture provider for the session named NESession01.</maml:para> <maml:para>The third command adds a Hyper-V virtual switch as a filter on the Remote Packet Capture provider.</maml:para> <maml:para /> <maml:para /> </dev:remarks> <command:commandLines> <command:commandLine> <command:commandText /> </command:commandLine> </command:commandLines> </command:example> </command:examples> <maml:relatedLinks> <maml:navigationLink> <maml:linkText>Online Version:</maml:linkText> <maml:uri>http://go.microsoft.com/fwlink/?LinkId=294386</maml:uri> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Get-NetEventVmSwitch</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Remove-NetEventVmSwitch</maml:linkText> <maml:uri /> </maml:navigationLink> </maml:relatedLinks> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details> <command:name>Get-NetEventNetworkAdapter</command:name> <maml:description> <maml:para>Gets the network adapters associated with a Remote Packet Capture provider.</maml:para> </maml:description> <maml:copyright> <maml:para /> </maml:copyright> <command:verb>Get</command:verb> <command:noun>NetEventNetworkAdapter</command:noun> <dev:version /> </command:details> <maml:description> <maml:para>The Get-NetEventNetworkAdapter cmdlet gets the network adapters associated with a Remote Packet Capture provider for a network event session. The protocol stack uses multiple layers to transmit, receive, and process network traffic, or packets. The provider logs network traffic as Event Tracing for Windows (ETW) events.</maml:para> <maml:para>Use the Add-NetEventNetworkAdapter cmdlet to add an adapter or the Remove-NetEventNetworkAdapter cmdlet to remove an adapter.</maml:para> </maml:description> <command:syntax> <command:syntaxItem> <maml:name>Get-NetEventNetworkAdapter</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName)" position="1" aliases="none"> <maml:name>Name</maml:name> <maml:description> <maml:para>Specifies an array of names of network adapters to get. If you do not specify this parameter, the cmdlet gets all the network adapters for the session.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">String[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ShowInstalled</maml:name> <maml:description> <maml:para>Indicates that the cmdlet displays all network adapters that are installed on the computer.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell� calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> </command:parameter> </command:syntaxItem> <command:syntaxItem> <maml:name>Get-NetEventNetworkAdapter</maml:name> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="True (ByValue)" position="named" aliases="none"> <maml:name>AssociatedPacketCaptureProvider</maml:name> <maml:description> <maml:para>Specifies the associated packet capture provider as a CIM object. To obtain the packet capture provider, use the Get-NetEventPacketCaptureProvider cmdlet.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">CimInstance</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ShowInstalled</maml:name> <maml:description> <maml:para>Indicates that the cmdlet displays all network adapters that are installed on the computer.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell� calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="True (ByValue)" position="named" aliases="none"> <maml:name>AssociatedPacketCaptureProvider</maml:name> <maml:description> <maml:para>Specifies the associated packet capture provider as a CIM object. To obtain the packet capture provider, use the Get-NetEventPacketCaptureProvider cmdlet.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">CimInstance</command:parameterValue> <dev:type> <maml:name>CimInstance</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> <dev:type> <maml:name>CimSession[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName)" position="1" aliases="none"> <maml:name>Name</maml:name> <maml:description> <maml:para>Specifies an array of names of network adapters to get. If you do not specify this parameter, the cmdlet gets all the network adapters for the session.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">String[]</command:parameterValue> <dev:type> <maml:name>String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ShowInstalled</maml:name> <maml:description> <maml:para>Indicates that the cmdlet displays all network adapters that are installed on the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell� calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> <dev:type> <maml:name>Int32</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes> <command:inputType> <dev:type> <maml:name> </maml:name> <maml:uri> </maml:uri> <maml:description> <maml:para /> </maml:description> </dev:type> <maml:description> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues> <command:returnValue> <dev:type> <maml:name> </maml:name> <maml:uri> </maml:uri> <maml:description> <maml:para /> </maml:description> </dev:type> <maml:description> </maml:description> </command:returnValue> </command:returnValues> <command:terminatingErrors /> <command:nonTerminatingErrors /> <command:examples> <command:example> <maml:title>Example 1: Get all network adapters</maml:title> <maml:introduction> <maml:para> </maml:para> </maml:introduction> <dev:code>PS C:\>Get-NetEventNetworkAdapter </dev:code> <dev:remarks> <maml:para>This command gets all the network adapters for the Remote Packet Capture provider for the current session.</maml:para> <maml:para /> <maml:para /> </dev:remarks> <command:commandLines> <command:commandLine> <command:commandText /> </command:commandLine> </command:commandLines> </command:example> </command:examples> <maml:relatedLinks> <maml:navigationLink> <maml:linkText>Online Version:</maml:linkText> <maml:uri>http://go.microsoft.com/fwlink/?LinkID=294387</maml:uri> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Add-NetEventNetworkAdapter</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Remove-NetEventNetworkAdapter</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Get-NetEventPacketCaptureProvider</maml:linkText> <maml:uri /> </maml:navigationLink> </maml:relatedLinks> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details> <command:name>Get-NetEventPacketCaptureProvider</command:name> <maml:description> <maml:para>Displays a Remote Packet Capture provider.</maml:para> </maml:description> <maml:copyright> <maml:para /> </maml:copyright> <command:verb>Get</command:verb> <command:noun>NetEventPacketCaptureProvider</command:noun> <dev:version /> </command:details> <maml:description> <maml:para>The Get-NetEventPacketCaptureProvider cmdlet displays a Remote Packet Capture provider.</maml:para> </maml:description> <command:syntax> <command:syntaxItem> <maml:name>Get-NetEventPacketCaptureProvider</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName)" position="1" aliases="none"> <maml:name>SessionName</maml:name> <maml:description> <maml:para>Specifies the name of the session associated with the packet capture provider.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">String[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell� calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> </command:parameter> </command:syntaxItem> <command:syntaxItem> <maml:name>Get-NetEventPacketCaptureProvider</maml:name> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="True (ByValue)" position="named" aliases="none"> <maml:name>AssociatedCaptureTarget</maml:name> <maml:description> <maml:para>Specifies the associated capture target as a CIM object. The capture target is one of the three following objects: -- MSFT_NetEventNetworkAdapter -- MSFT_NetEventVmNetworkAdapter -- MSFT_NetEventVmSwitch To obtain a capture target, use the Get-NetEventNetworkAdapter cmdlet, the Get-NetEventVmNetworkAdapter cmdlet, or the Get-NetEventVmSwitch cmdlet.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">CimInstance</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell� calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> </command:parameter> </command:syntaxItem> <command:syntaxItem> <maml:name>Get-NetEventPacketCaptureProvider</maml:name> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="True (ByValue)" position="named" aliases="none"> <maml:name>AssociatedEventSession</maml:name> <maml:description> <maml:para>Specifies the associated network event session, as a CIM object. To obtain the network event session, use the Get-NetEventSession cmdlet.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">CimInstance</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell� calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="True (ByValue)" position="named" aliases="none"> <maml:name>AssociatedCaptureTarget</maml:name> <maml:description> <maml:para>Specifies the associated capture target as a CIM object. The capture target is one of the three following objects: -- MSFT_NetEventNetworkAdapter -- MSFT_NetEventVmNetworkAdapter -- MSFT_NetEventVmSwitch To obtain a capture target, use the Get-NetEventNetworkAdapter cmdlet, the Get-NetEventVmNetworkAdapter cmdlet, or the Get-NetEventVmSwitch cmdlet.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">CimInstance</command:parameterValue> <dev:type> <maml:name>CimInstance</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="True (ByValue)" position="named" aliases="none"> <maml:name>AssociatedEventSession</maml:name> <maml:description> <maml:para>Specifies the associated network event session, as a CIM object. To obtain the network event session, use the Get-NetEventSession cmdlet.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">CimInstance</command:parameterValue> <dev:type> <maml:name>CimInstance</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> <dev:type> <maml:name>CimSession[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName)" position="1" aliases="none"> <maml:name>SessionName</maml:name> <maml:description> <maml:para>Specifies the name of the session associated with the packet capture provider.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">String[]</command:parameterValue> <dev:type> <maml:name>String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell� calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> <dev:type> <maml:name>Int32</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes> <command:inputType> <dev:type> <maml:name> </maml:name> <maml:uri> </maml:uri> <maml:description> <maml:para /> </maml:description> </dev:type> <maml:description> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues> <command:returnValue> <dev:type> <maml:name> </maml:name> <maml:uri> </maml:uri> <maml:description> <maml:para /> </maml:description> </dev:type> <maml:description> </maml:description> </command:returnValue> </command:returnValues> <command:terminatingErrors /> <command:nonTerminatingErrors /> <command:examples> <command:example> <maml:title>Example 1: Display a packet capture provider</maml:title> <maml:introduction> <maml:para> </maml:para> </maml:introduction> <dev:code>PS C:\>Get-NetEventPacketCaptureProvider -SessionName "Session01" </dev:code> <dev:remarks> <maml:para>This command displays a packet capture provider for a session named Session01</maml:para> <maml:para /> <maml:para /> </dev:remarks> <command:commandLines> <command:commandLine> <command:commandText /> </command:commandLine> </command:commandLines> </command:example> </command:examples> <maml:relatedLinks> <maml:navigationLink> <maml:linkText>Online Version:</maml:linkText> <maml:uri>http://go.microsoft.com/fwlink/?LinkID=294388</maml:uri> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Add-NetEventPacketCaptureProvider</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Remove-NetEventPacketCaptureProvider</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Set-NetEventPacketCaptureProvider</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Get-NetEventNetworkAdapter</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Get-NetEventVmNetworkAdapter</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Get-NetEventVmSwitch</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Get-NetEventSession</maml:linkText> <maml:uri /> </maml:navigationLink> </maml:relatedLinks> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details> <command:name>Get-NetEventProvider</command:name> <maml:description> <maml:para>Displays the ETW providers that are present on the computer or associated with an event and packet capture session. </maml:para> </maml:description> <maml:copyright> <maml:para /> </maml:copyright> <command:verb>Get</command:verb> <command:noun>NetEventProvider</command:noun> <dev:version /> </command:details> <maml:description> <maml:para>The Get-NetEventProvider cmdlet displays the Event Tracing for Windows (ETW) providers that are present on the computer, or associated with an event and packet capture session.</maml:para> </maml:description> <command:syntax> <command:syntaxItem> <maml:name>Get-NetEventProvider</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName)" position="1" aliases="none"> <maml:name>Name</maml:name> <maml:description> <maml:para>Specifies an array of names that identify ETW providers. </maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">String[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ShowInstalled</maml:name> <maml:description> <maml:para>Indicates that the cmdlet displays all ETW providers that are installed on the computer. </maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell� calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> </command:parameter> </command:syntaxItem> <command:syntaxItem> <maml:name>Get-NetEventProvider</maml:name> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="True (ByValue)" position="named" aliases="none"> <maml:name>AssociatedCaptureTarget</maml:name> <maml:description> <maml:para>Specifies the associated capture target as a CIM object. The capture target is one of the three following objects: -- MSFT_NetEventNetworkAdapter -- MSFT_NetEventVmNetworkAdapter -- MSFT_NetEventVmSwitch To obtain a capture target, use the Get-NetEventNetworkAdapter cmdlet, the Get-NetEventVmNetworkAdapter cmdlet, or the Get-NetEventVmSwitch cmdlet.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">CimInstance</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ShowInstalled</maml:name> <maml:description> <maml:para>Indicates that the cmdlet displays all ETW providers that are installed on the computer. </maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell� calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> </command:parameter> </command:syntaxItem> <command:syntaxItem> <maml:name>Get-NetEventProvider</maml:name> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="True (ByValue)" position="named" aliases="none"> <maml:name>AssociatedEventSession</maml:name> <maml:description> <maml:para>Specifies the associated network event session, as a CIM object. To obtain the network event session, use the Get-NetEventSession cmdlet.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">CimInstance</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ShowInstalled</maml:name> <maml:description> <maml:para>Indicates that the cmdlet displays all ETW providers that are installed on the computer. </maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell� calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="True (ByValue)" position="named" aliases="none"> <maml:name>AssociatedCaptureTarget</maml:name> <maml:description> <maml:para>Specifies the associated capture target as a CIM object. The capture target is one of the three following objects: -- MSFT_NetEventNetworkAdapter -- MSFT_NetEventVmNetworkAdapter -- MSFT_NetEventVmSwitch To obtain a capture target, use the Get-NetEventNetworkAdapter cmdlet, the Get-NetEventVmNetworkAdapter cmdlet, or the Get-NetEventVmSwitch cmdlet.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">CimInstance</command:parameterValue> <dev:type> <maml:name>CimInstance</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="True (ByValue)" position="named" aliases="none"> <maml:name>AssociatedEventSession</maml:name> <maml:description> <maml:para>Specifies the associated network event session, as a CIM object. To obtain the network event session, use the Get-NetEventSession cmdlet.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">CimInstance</command:parameterValue> <dev:type> <maml:name>CimInstance</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> <dev:type> <maml:name>CimSession[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName)" position="1" aliases="none"> <maml:name>Name</maml:name> <maml:description> <maml:para>Specifies an array of names that identify ETW providers. </maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">String[]</command:parameterValue> <dev:type> <maml:name>String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ShowInstalled</maml:name> <maml:description> <maml:para>Indicates that the cmdlet displays all ETW providers that are installed on the computer. </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell� calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> <dev:type> <maml:name>Int32</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes> <command:inputType> <dev:type> <maml:name> </maml:name> <maml:uri> </maml:uri> <maml:description> <maml:para /> </maml:description> </dev:type> <maml:description> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues> <command:returnValue> <dev:type> <maml:name> </maml:name> <maml:uri> </maml:uri> <maml:description> <maml:para /> </maml:description> </dev:type> <maml:description> </maml:description> </command:returnValue> </command:returnValues> <command:terminatingErrors /> <command:nonTerminatingErrors /> <command:examples> <command:example> <maml:title>Example 1: Display ETW providers</maml:title> <maml:introduction> <maml:para> </maml:para> </maml:introduction> <dev:code>PS C:\>Get-NetEventProvider </dev:code> <dev:remarks> <maml:para>This command displays the ETW providers on the computer.</maml:para> <maml:para /> <maml:para /> </dev:remarks> <command:commandLines> <command:commandLine> <command:commandText /> </command:commandLine> </command:commandLines> </command:example> </command:examples> <maml:relatedLinks> <maml:navigationLink> <maml:linkText>Online Version:</maml:linkText> <maml:uri>http://go.microsoft.com/fwlink/?LinkID=294389</maml:uri> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Add-NetEventProvider</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Remove-NetEventProvider</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Set-NetEventProvider</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Get-NetEventNetworkAdapter</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Get-NetEventVmNetworkAdapter</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Get-NetEventVmSwitch</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Get-NetEventSession</maml:linkText> <maml:uri /> </maml:navigationLink> </maml:relatedLinks> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details> <command:name>Get-NetEventSession</command:name> <maml:description> <maml:para>Gets network event sessions. </maml:para> </maml:description> <maml:copyright> <maml:para /> </maml:copyright> <command:verb>Get</command:verb> <command:noun>NetEventSession</command:noun> <dev:version /> </command:details> <maml:description> <maml:para>The Get-NetEventSession cmdlet gets network event sessions. A session controls how the computer logs events and, optionally, network traffic, or packets. </maml:para> <maml:para>Use this cmdlet to display configuration settings for the session. The configuration settings include the following: -- Whether the session writes logs to a local file or sends events to live display. -- For local file logging, the maximum size and location of the .etl file. -- The maximum number of buffers and size of a buffer.</maml:para> <maml:para>You can also use this cmdlet to see if the session is running, such as after you run the Start-NetEventSession cmdlet.</maml:para> </maml:description> <command:syntax> <command:syntaxItem> <maml:name>Get-NetEventSession</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName)" position="1" aliases="none"> <maml:name>Name</maml:name> <maml:description> <maml:para>Specifies an array of names of sessions to get. </maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">String[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell� calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> </command:parameter> </command:syntaxItem> <command:syntaxItem> <maml:name>Get-NetEventSession</maml:name> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="True (ByValue)" position="named" aliases="none"> <maml:name>AssociatedEventProvider</maml:name> <maml:description> <maml:para>Specifies the associated network event provider as a CIM object. To obtain the network event provider, use the Get-NetEventProvider cmdlet.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">CimInstance</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell� calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="True (ByValue)" position="named" aliases="none"> <maml:name>AssociatedEventProvider</maml:name> <maml:description> <maml:para>Specifies the associated network event provider as a CIM object. To obtain the network event provider, use the Get-NetEventProvider cmdlet.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">CimInstance</command:parameterValue> <dev:type> <maml:name>CimInstance</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> <dev:type> <maml:name>CimSession[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName)" position="1" aliases="none"> <maml:name>Name</maml:name> <maml:description> <maml:para>Specifies an array of names of sessions to get. </maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">String[]</command:parameterValue> <dev:type> <maml:name>String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell� calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> <dev:type> <maml:name>Int32</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes> <command:inputType> <dev:type> <maml:name> </maml:name> <maml:uri> </maml:uri> <maml:description> <maml:para /> </maml:description> </dev:type> <maml:description> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues> <command:returnValue> <dev:type> <maml:name> </maml:name> <maml:uri> </maml:uri> <maml:description> <maml:para /> </maml:description> </dev:type> <maml:description> </maml:description> </command:returnValue> </command:returnValues> <command:terminatingErrors /> <command:nonTerminatingErrors /> <command:examples> <command:example> <maml:title>Example 1: Display settings for a session</maml:title> <maml:introduction> <maml:para> </maml:para> </maml:introduction> <dev:code>PS C:\>Get-NetEventSession -Name "Session38" </dev:code> <dev:remarks> <maml:para>This command displays the settings of the session named Session38.</maml:para> <maml:para /> <maml:para /> </dev:remarks> <command:commandLines> <command:commandLine> <command:commandText /> </command:commandLine> </command:commandLines> </command:example> </command:examples> <maml:relatedLinks> <maml:navigationLink> <maml:linkText>Online Version:</maml:linkText> <maml:uri>http://go.microsoft.com/fwlink/?LinkID=294390</maml:uri> </maml:navigationLink> <maml:navigationLink> <maml:linkText>New-NetEventSession</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Remove-NetEventSession</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Set-NetEventSession</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Start-NetEventSession</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Stop-NetEventSession</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Get-NetEventProvider</maml:linkText> <maml:uri /> </maml:navigationLink> </maml:relatedLinks> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details> <command:name>Get-NetEventVmNetworkAdapter</command:name> <maml:description> <maml:para>Gets virtual network adapters from a provider.</maml:para> </maml:description> <maml:copyright> <maml:para /> </maml:copyright> <command:verb>Get</command:verb> <command:noun>NetEventVmNetworkAdapter</command:noun> <dev:version /> </command:details> <maml:description> <maml:para>The Get-NetEventVmNetworkAdapter cmdlet gets network adapters of a virtual machine from a Remote Packet Capture provider. Specify the names of the virtual network adapters.</maml:para> <maml:para>The protocol stack uses multiple layers to transmit, receive, and process network traffic as packets. The provider logs network traffic as Event Tracing for Windows (ETW) events.</maml:para> </maml:description> <command:syntax> <command:syntaxItem> <maml:name>Get-NetEventVmNetworkAdapter</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName)" position="1" aliases="none"> <maml:name>Name</maml:name> <maml:description> <maml:para>Specifies an array of names of virtual network adapters.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">String[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ShowInstalled</maml:name> <maml:description> <maml:para>Indicates that the cmdlet displays all network adapters that are installed on the computer.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell� calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> </command:parameter> </command:syntaxItem> <command:syntaxItem> <maml:name>Get-NetEventVmNetworkAdapter</maml:name> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="True (ByValue)" position="named" aliases="none"> <maml:name>AssociatedPacketCaptureProvider</maml:name> <maml:description> <maml:para>Specifies the associated packet capture provider as a CIM object. To obtain the packet capture provider, use the Get-NetEventPacketCaptureProvider cmdlet.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">CimInstance</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ShowInstalled</maml:name> <maml:description> <maml:para>Indicates that the cmdlet displays all network adapters that are installed on the computer.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell� calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="True (ByValue)" position="named" aliases="none"> <maml:name>AssociatedPacketCaptureProvider</maml:name> <maml:description> <maml:para>Specifies the associated packet capture provider as a CIM object. To obtain the packet capture provider, use the Get-NetEventPacketCaptureProvider cmdlet.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">CimInstance</command:parameterValue> <dev:type> <maml:name>CimInstance</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> <dev:type> <maml:name>CimSession[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName)" position="1" aliases="none"> <maml:name>Name</maml:name> <maml:description> <maml:para>Specifies an array of names of virtual network adapters.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">String[]</command:parameterValue> <dev:type> <maml:name>String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ShowInstalled</maml:name> <maml:description> <maml:para>Indicates that the cmdlet displays all network adapters that are installed on the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell� calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> <dev:type> <maml:name>Int32</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes> <command:inputType> <dev:type> <maml:name> </maml:name> <maml:uri> </maml:uri> <maml:description> <maml:para /> </maml:description> </dev:type> <maml:description> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues> <command:returnValue> <dev:type> <maml:name> </maml:name> <maml:uri> </maml:uri> <maml:description> <maml:para /> </maml:description> </dev:type> <maml:description> </maml:description> </command:returnValue> </command:returnValues> <command:terminatingErrors /> <command:nonTerminatingErrors /> <command:examples> <command:example> <maml:title>Example 1: Get a virtual network adapter from the provider</maml:title> <maml:introduction> <maml:para> </maml:para> </maml:introduction> <dev:code>PS C:\>New-NetEventSession -Name "NESession01" PS C:\> Add-NetEventPacketCaptureProvider -SessionName "NESession01" PS C:\> Add-NetEventVMNetworkAdapter -Name "LargeGuid" PS C:\> Add-NetEventVMNetworkAdapter -Name "LargeGuid02" PS C:\> Get-NetEventVMNetworkAdapter </dev:code> <dev:remarks> <maml:para>This example gets a virtual network adapter from the Remote Packet Capture provider for a network session. After you complete these commands to configure the network session, you can start and stop the event and packet capture for the network session by using the Start-NetEventSession and Stop-NetEventSession cmdlets.</maml:para> <maml:para>The first command uses the New-NetEventSession cmdlet to create a network session named NESession01.</maml:para> <maml:para>The second command uses the Add-NetEventPacketCaptureProvider cmdlet to add a Remote Packet Capture provider for the session named NESession01.</maml:para> <maml:para>The third command uses the Add-NetEventVmNetworkAdapter cmdlet to add the virtual network adapter named LargeGuid as a filter on the Remote Packet Capture provider.</maml:para> <maml:para>The fourth command uses the Add-NetEventVmNetworkAdapter cmdlet to add the virtual network adapter named LargeGuid02 as a filter on the Remote Packet Capture provider.</maml:para> <maml:para>The fifth command gets the virtual network adapters from the Remote Packet Capture provider.</maml:para> <maml:para /> <maml:para /> </dev:remarks> <command:commandLines> <command:commandLine> <command:commandText /> </command:commandLine> </command:commandLines> </command:example> </command:examples> <maml:relatedLinks> <maml:navigationLink> <maml:linkText>Online Version:</maml:linkText> <maml:uri>http://go.microsoft.com/fwlink/?LinkId=294392</maml:uri> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Add-NetEventVmNetworkAdapter</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Remove-NetEventVmNetworkAdapter</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Get-NetEventPacketCaptureProvider</maml:linkText> <maml:uri /> </maml:navigationLink> </maml:relatedLinks> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details> <command:name>Get-NetEventVmSwitch</command:name> <maml:description> <maml:para>Gets Hyper-V virtual switches from a provider.</maml:para> </maml:description> <maml:copyright> <maml:para /> </maml:copyright> <command:verb>Get</command:verb> <command:noun>NetEventVmSwitch</command:noun> <dev:version /> </command:details> <maml:description> <maml:para>The Get-NetEventVmSwitch cmdlet gets Hyper-V virtual switches from a Remote Packet Capture provider. This cmdlet returns a list of Hyper-V virtual switches that you configured as filters on a Remote Packet Capture provider.</maml:para> <maml:para>The protocol stack uses multiple layers to transmit, receive, and process network traffic as packets. The provider logs network traffic as Event Tracing for Windows (ETW) events.</maml:para> </maml:description> <command:syntax> <command:syntaxItem> <maml:name>Get-NetEventVmSwitch</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName)" position="1" aliases="none"> <maml:name>Name</maml:name> <maml:description> <maml:para>Specifies an array of Hyper-V virtual switches.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">String[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ShowInstalled</maml:name> <maml:description> <maml:para>Indicates that the cmdlet displays all network adapters that are installed on the computer.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell� calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> </command:parameter> </command:syntaxItem> <command:syntaxItem> <maml:name>Get-NetEventVmSwitch</maml:name> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="True (ByValue)" position="named" aliases="none"> <maml:name>AssociatedPacketCaptureProvider</maml:name> <maml:description> <maml:para>Specifies the associated packet capture provider as a CIM object. To obtain the packet capture provider, use the Get-NetEventPacketCaptureProvider cmdlet.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">CimInstance</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ShowInstalled</maml:name> <maml:description> <maml:para>Indicates that the cmdlet displays all network adapters that are installed on the computer.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell� calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="True (ByValue)" position="named" aliases="none"> <maml:name>AssociatedPacketCaptureProvider</maml:name> <maml:description> <maml:para>Specifies the associated packet capture provider as a CIM object. To obtain the packet capture provider, use the Get-NetEventPacketCaptureProvider cmdlet.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">CimInstance</command:parameterValue> <dev:type> <maml:name>CimInstance</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> <dev:type> <maml:name>CimSession[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName)" position="1" aliases="none"> <maml:name>Name</maml:name> <maml:description> <maml:para>Specifies an array of Hyper-V virtual switches.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">String[]</command:parameterValue> <dev:type> <maml:name>String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ShowInstalled</maml:name> <maml:description> <maml:para>Indicates that the cmdlet displays all network adapters that are installed on the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell� calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> <dev:type> <maml:name>Int32</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes> <command:inputType> <dev:type> <maml:name> </maml:name> <maml:uri> </maml:uri> <maml:description> <maml:para /> </maml:description> </dev:type> <maml:description> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues> <command:returnValue> <dev:type> <maml:name> </maml:name> <maml:uri> </maml:uri> <maml:description> <maml:para /> </maml:description> </dev:type> <maml:description> </maml:description> </command:returnValue> </command:returnValues> <command:terminatingErrors /> <command:nonTerminatingErrors /> <command:examples> <command:example> <maml:title>Example 1: Get a Hyper-V virtual switch from a provider</maml:title> <maml:introduction> <maml:para> </maml:para> </maml:introduction> <dev:code>PS C:\>New-NetEventSession -Name "NESession01" PS C:\> Add-NetEventPacketCaptureProvider -SessionName "NESession01" PS C:\> Add-NetEventVMSwitch -Name "Network Adapter 2 - Virtual Switch" PS C:\> Add-NetEventVMSwitch -Name "Network Adapter 4 - Virtual Switch" PS C:\> Get-NetEventVMSwitch -Name "Network Adapter 2 - Virtual Switch" </dev:code> <dev:remarks> <maml:para>This example gets a Hyper-V virtual switch from the Remote Packet Capture provider for a network session. After you complete these commands to configure the network session, you can start and stop the event and packet capture for the network session by using the Start-NetEventSession and Stop-NetEventSession cmdlets.</maml:para> <maml:para>The first command uses the New-NetEventSession cmdlet to create a network session named NESession01.</maml:para> <maml:para>The second command uses the Add-NetEventPacketCaptureProvider cmdlet to add a Remote Packet Capture provider for the session named NESession01.</maml:para> <maml:para>The third command uses the Add-NetEventVmSwitch cmdlet to add the Hyper-V virtual switch named Network Adapter 2 - Virtual Switch as a filter on the Remote Packet Capture provider.</maml:para> <maml:para>The fourth command uses the Add-NetEventVmSwitch cmdlet to add the Hyper-V virtual switch named Network Adapter 4 - Virtual Switch as a filter on the Remote Packet Capture provider.</maml:para> <maml:para>The fifth command gets the Hyper-V virtual switch named Network Adapter 2 - Virtual Switch from the provider.</maml:para> <maml:para /> <maml:para /> </dev:remarks> <command:commandLines> <command:commandLine> <command:commandText /> </command:commandLine> </command:commandLines> </command:example> </command:examples> <maml:relatedLinks> <maml:navigationLink> <maml:linkText>Online Version:</maml:linkText> <maml:uri>http://go.microsoft.com/fwlink/?LinkId=294393</maml:uri> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Add-NetEventVmSwitch</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Remove-NetEventVmSwitch</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Get-NetEventPacketCaptureProvider</maml:linkText> <maml:uri /> </maml:navigationLink> </maml:relatedLinks> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details> <command:name>New-NetEventSession</command:name> <maml:description> <maml:para>Creates a network event session.</maml:para> </maml:description> <maml:copyright> <maml:para /> </maml:copyright> <command:verb>New</command:verb> <command:noun>NetEventSession</command:noun> <dev:version /> </command:details> <maml:description> <maml:para>The New-NetEventSession cmdlet creates a network event session. A session controls how the computer logs events and, optionally, network traffic, or packets. Add network event providers to a session. A network event provider logs events and network traffic as Event Tracing for Windows (ETW) events. The session stores these events in an .etl file or provides them to an application that displays them.</maml:para> <maml:para>Assign a name for the session. Only one session can exist at a time. Remove an existing session by using the Remove-NetEventSession cmdlet. You can specify the maximum number of buffers in a session and the size of the trace buffer. </maml:para> <maml:para>You can also specify whether to use an.etl file and, if you do, specify its location and maximum size. Instead of an .etl file, you can select a type of live display.</maml:para> <maml:para>After you create a session, you can use the Set-NetEventSession cmdlet to modify the session settings. After you create a session, add one or more providers to it by using the Add-NetEventProvider cmdlet. Use the Start-NetEventSession and Stop-NetEventSession cmdlets to start and stop logging.</maml:para> </maml:description> <command:syntax> <command:syntaxItem> <maml:name>New-NetEventSession</maml:name> <command:parameter required="true" variableLength="false" globbing="false" pipelineInput="false" position="1" aliases="none"> <maml:name>Name</maml:name> <maml:description> <maml:para>Specifies a name to assign to the session for event and packet capture.</maml:para> </maml:description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="cm"> <maml:name>CaptureMode</maml:name> <maml:description> <maml:para>Specifies a capture mode. The acceptable values for this parameter are: -- SaveToFile. Saves the capture to an .etl file. -- RealtimeRPC. Connects remotely for a live event and packet capture. -- RealtimeLocal. Connects locally for a live event and packet capture. If you specify a value of SaveToFile, you can specify a location for the file by using the LocalFilePath parameter and specify a maximum file size by using the MaxFileSize parameter.</maml:para> <maml:para>If you specify a value of RealtimeRPC or RealtimeLocal, the capture requires additional software, such as Microsoft Message Analyzer..</maml:para> </maml:description> <command:parameterValueGroup> <command:parameterValue required="false" variableLength="false">RealtimeRPC</command:parameterValue> <command:parameterValue required="false" variableLength="false">SaveToFile</command:parameterValue> <command:parameterValue required="false" variableLength="false">RealtimeLocal</command:parameterValue> </command:parameterValueGroup> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="lfp"> <maml:name>LocalFilePath</maml:name> <maml:description> <maml:para>Specifies a file path. If you specify a value of SaveToFile for the CaptureMode parameter, the cmdlet saves the file to this location. Be sure that you can write to this location. If you do not specify this parameter, the cmdlet uses the default value of %LocalAppData%\Temp\NetTrace.etl.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">String</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>MaxFileSize</maml:name> <maml:description> <maml:para>Specifies a maximum file size, in megabytes. If you specify a value of SaveToFile for the CaptureMode parameter, this value is the maximum size for the .etl file. Once the file reaches the maximum, the session continues to save events, and discards the oldest events to make room. A value of 0 means that there is no maximum. If you do not specify this parameter, the cmdlet uses a default value of 250. </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">UInt32</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>MaxNumberOfBuffers</maml:name> <maml:description> <maml:para>Specifies the maximum number of buffers used in a session. If the computer determines that the value restricts performance or the value is 0, the computer overrides the configuration to optimize trace performance. For more information, see <maml:navigationLink><maml:linkText>EVENT_TRACE_PROPERTIES structure</maml:linkText><maml:uri></maml:uri></maml:navigationLink> (http://msdn.microsoft.com/en-us/library/windows/desktop/aa363784(v=vs.85).aspx) In the Microsoft Developer Network library.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Byte</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell� calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>TraceBufferSize</maml:name> <maml:description> <maml:para>Specifies the amount of memory, in kilobytes, for a buffer for event tracing. The maximum value is 1024. If the computer determines that the value restricts performance or the value is 0, the computer overrides the configuration to optimize trace performance. The ETW logger uses the size of physical memory to calculate the default value.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">UInt32</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>Confirm</maml:name> <maml:description> <maml:para>Prompts you for confirmation before running the cmdlet.Prompts you for confirmation before running the cmdlet.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>WhatIf</maml:name> <maml:description> <maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run.Shows what would happen if the cmdlet runs. The cmdlet is not run.</maml:para> </maml:description> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="cm"> <maml:name>CaptureMode</maml:name> <maml:description> <maml:para>Specifies a capture mode. The acceptable values for this parameter are: -- SaveToFile. Saves the capture to an .etl file. -- RealtimeRPC. Connects remotely for a live event and packet capture. -- RealtimeLocal. Connects locally for a live event and packet capture. If you specify a value of SaveToFile, you can specify a location for the file by using the LocalFilePath parameter and specify a maximum file size by using the MaxFileSize parameter.</maml:para> <maml:para>If you specify a value of RealtimeRPC or RealtimeLocal, the capture requires additional software, such as Microsoft Message Analyzer..</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">CaptureModes</command:parameterValue> <dev:type> <maml:name>CaptureModes</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> <dev:type> <maml:name>CimSession[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="lfp"> <maml:name>LocalFilePath</maml:name> <maml:description> <maml:para>Specifies a file path. If you specify a value of SaveToFile for the CaptureMode parameter, the cmdlet saves the file to this location. Be sure that you can write to this location. If you do not specify this parameter, the cmdlet uses the default value of %LocalAppData%\Temp\NetTrace.etl.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>MaxFileSize</maml:name> <maml:description> <maml:para>Specifies a maximum file size, in megabytes. If you specify a value of SaveToFile for the CaptureMode parameter, this value is the maximum size for the .etl file. Once the file reaches the maximum, the session continues to save events, and discards the oldest events to make room. A value of 0 means that there is no maximum. If you do not specify this parameter, the cmdlet uses a default value of 250. </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">UInt32</command:parameterValue> <dev:type> <maml:name>UInt32</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>MaxNumberOfBuffers</maml:name> <maml:description> <maml:para>Specifies the maximum number of buffers used in a session. If the computer determines that the value restricts performance or the value is 0, the computer overrides the configuration to optimize trace performance. For more information, see <maml:navigationLink><maml:linkText>EVENT_TRACE_PROPERTIES structure</maml:linkText><maml:uri></maml:uri></maml:navigationLink> (http://msdn.microsoft.com/en-us/library/windows/desktop/aa363784(v=vs.85).aspx) In the Microsoft Developer Network library.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Byte</command:parameterValue> <dev:type> <maml:name>Byte</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="true" variableLength="false" globbing="false" pipelineInput="false" position="1" aliases="none"> <maml:name>Name</maml:name> <maml:description> <maml:para>Specifies a name to assign to the session for event and packet capture.</maml:para> </maml:description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell� calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> <dev:type> <maml:name>Int32</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>TraceBufferSize</maml:name> <maml:description> <maml:para>Specifies the amount of memory, in kilobytes, for a buffer for event tracing. The maximum value is 1024. If the computer determines that the value restricts performance or the value is 0, the computer overrides the configuration to optimize trace performance. The ETW logger uses the size of physical memory to calculate the default value.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">UInt32</command:parameterValue> <dev:type> <maml:name>UInt32</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>Confirm</maml:name> <maml:description> <maml:para>Prompts you for confirmation before running the cmdlet.Prompts you for confirmation before running the cmdlet.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>false</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>WhatIf</maml:name> <maml:description> <maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run.Shows what would happen if the cmdlet runs. The cmdlet is not run.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>false</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes> <command:inputType> <dev:type> <maml:name> </maml:name> <maml:uri> </maml:uri> <maml:description> <maml:para /> </maml:description> </dev:type> <maml:description> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues> <command:returnValue> <dev:type> <maml:name> </maml:name> <maml:uri> </maml:uri> <maml:description> <maml:para /> </maml:description> </dev:type> <maml:description> </maml:description> </command:returnValue> </command:returnValues> <command:terminatingErrors /> <command:nonTerminatingErrors /> <command:examples> <command:example> <maml:title>Example 1: Create a session</maml:title> <maml:introduction> <maml:para> </maml:para> </maml:introduction> <dev:code>PS C:\>New-NetEventSession -Name "Session38" </dev:code> <dev:remarks> <maml:para>This command creates session named Session38. Use the Add-NetEventProvider cmdlet to add a provider for the session.</maml:para> <maml:para /> <maml:para /> </dev:remarks> <command:commandLines> <command:commandLine> <command:commandText /> </command:commandLine> </command:commandLines> </command:example> </command:examples> <maml:relatedLinks> <maml:navigationLink> <maml:linkText>Online Version:</maml:linkText> <maml:uri>http://go.microsoft.com/fwlink/?LinkID=294394</maml:uri> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Get-NetEventSession</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Remove-NetEventSession</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Set-NetEventSession</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Start-NetEventSession</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Stop-NetEventSession</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Add-NetEventProvider</maml:linkText> <maml:uri /> </maml:navigationLink> </maml:relatedLinks> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details> <command:name>Remove-NetEventNetworkAdapter</command:name> <maml:description> <maml:para>Removes network adapters associated with a provider.</maml:para> </maml:description> <maml:copyright> <maml:para /> </maml:copyright> <command:verb>Remove</command:verb> <command:noun>NetEventNetworkAdapter</command:noun> <dev:version /> </command:details> <maml:description> <maml:para>The Remove-NetEventNetworkAdapter cmdlet removes network adapters associated with a Remote Packet Capture provider. The protocol stack uses multiple layers to transmit, receive, and process network traffic, also known as packets. The provider logs network traffic as Event Tracing for Windows (ETW) events.</maml:para> <maml:para>Specify which adapter to remove by using the network adapter name. Use this cmdlet multiple times to remove several adapters. To see which adapters currently belong to a provider, use the Get-NetEventNetworkAdapter cmdlet.</maml:para> <maml:para>To remove all the adapters, specify the name of the provider or get a provider to modify by using the Get-NetEventPacketCaptureProvider cmdlet.</maml:para> </maml:description> <command:syntax> <command:syntaxItem> <maml:name>Remove-NetEventNetworkAdapter</maml:name> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName)" position="1" aliases="none"> <maml:name>ProviderName</maml:name> <maml:description> <maml:para>Specifies an array of names of NetEventPacketCapture providers.</maml:para> </maml:description> <command:parameterValue required="true" variableLength="true">String[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>PassThru</maml:name> <maml:description> <maml:para>Returns an object representing the item with which you are working. By default, this cmdlet does not generate any output.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell� calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>Confirm</maml:name> <maml:description> <maml:para>Prompts you for confirmation before running the cmdlet.Prompts you for confirmation before running the cmdlet.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>WhatIf</maml:name> <maml:description> <maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run.Shows what would happen if the cmdlet runs. The cmdlet is not run.</maml:para> </maml:description> </command:parameter> </command:syntaxItem> <command:syntaxItem> <maml:name>Remove-NetEventNetworkAdapter</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>PassThru</maml:name> <maml:description> <maml:para>Returns an object representing the item with which you are working. By default, this cmdlet does not generate any output.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell� calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>Confirm</maml:name> <maml:description> <maml:para>Prompts you for confirmation before running the cmdlet.Prompts you for confirmation before running the cmdlet.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>WhatIf</maml:name> <maml:description> <maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run.Shows what would happen if the cmdlet runs. The cmdlet is not run.</maml:para> </maml:description> </command:parameter> </command:syntaxItem> <command:syntaxItem> <maml:name>Remove-NetEventNetworkAdapter</maml:name> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName)" position="1" aliases="none"> <maml:name>Name</maml:name> <maml:description> <maml:para>Specifies an array of names of network adapters to remove. </maml:para> </maml:description> <command:parameterValue required="true" variableLength="true">String[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>PassThru</maml:name> <maml:description> <maml:para>Returns an object representing the item with which you are working. By default, this cmdlet does not generate any output.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell� calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>Confirm</maml:name> <maml:description> <maml:para>Prompts you for confirmation before running the cmdlet.Prompts you for confirmation before running the cmdlet.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>WhatIf</maml:name> <maml:description> <maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run.Shows what would happen if the cmdlet runs. The cmdlet is not run.</maml:para> </maml:description> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> <dev:type> <maml:name>CimSession[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName)" position="1" aliases="none"> <maml:name>Name</maml:name> <maml:description> <maml:para>Specifies an array of names of network adapters to remove. </maml:para> </maml:description> <command:parameterValue required="true" variableLength="true">String[]</command:parameterValue> <dev:type> <maml:name>String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>PassThru</maml:name> <maml:description> <maml:para>Returns an object representing the item with which you are working. By default, this cmdlet does not generate any output.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName)" position="1" aliases="none"> <maml:name>ProviderName</maml:name> <maml:description> <maml:para>Specifies an array of names of NetEventPacketCapture providers.</maml:para> </maml:description> <command:parameterValue required="true" variableLength="true">String[]</command:parameterValue> <dev:type> <maml:name>String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell� calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> <dev:type> <maml:name>Int32</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>Confirm</maml:name> <maml:description> <maml:para>Prompts you for confirmation before running the cmdlet.Prompts you for confirmation before running the cmdlet.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>false</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>WhatIf</maml:name> <maml:description> <maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run.Shows what would happen if the cmdlet runs. The cmdlet is not run.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>false</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes> <command:inputType> <dev:type> <maml:name> </maml:name> <maml:uri> </maml:uri> <maml:description> <maml:para /> </maml:description> </dev:type> <maml:description> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues> <command:returnValue> <dev:type> <maml:name> </maml:name> <maml:uri> </maml:uri> <maml:description> <maml:para /> </maml:description> </dev:type> <maml:description> </maml:description> </command:returnValue> </command:returnValues> <command:terminatingErrors /> <command:nonTerminatingErrors /> <command:examples> <command:example> <maml:title>Example 1: Remove a network adapter </maml:title> <maml:introduction> <maml:para> </maml:para> </maml:introduction> <dev:code>PS C:\>Remove-NetEventNetworkAdapter -Name "Ethernet01" </dev:code> <dev:remarks> <maml:para>This command removes a network adapter named Ethernet01. </maml:para> <maml:para /> <maml:para /> </dev:remarks> <command:commandLines> <command:commandLine> <command:commandText /> </command:commandLine> </command:commandLines> </command:example> </command:examples> <maml:relatedLinks> <maml:navigationLink> <maml:linkText>Online Version:</maml:linkText> <maml:uri>http://go.microsoft.com/fwlink/?LinkID=294395</maml:uri> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Add-NetEventNetworkAdapter</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Get-NetEventNetworkAdapter</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Get-NetEventPacketCaptureProvider</maml:linkText> <maml:uri /> </maml:navigationLink> </maml:relatedLinks> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details> <command:name>Remove-NetEventPacketCaptureProvider</command:name> <maml:description> <maml:para>Removes the Remote Packet Capture provider and deletes the settings. </maml:para> </maml:description> <maml:copyright> <maml:para /> </maml:copyright> <command:verb>Remove</command:verb> <command:noun>NetEventPacketCaptureProvider</command:noun> <dev:version /> </command:details> <maml:description> <maml:para>The Remove-NetEventPacketCaptureProvider cmdlet removes a Remote Packet Capture provider and deletes the settings.</maml:para> </maml:description> <command:syntax> <command:syntaxItem> <maml:name>Remove-NetEventPacketCaptureProvider</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>PassThru</maml:name> <maml:description> <maml:para>Returns an object representing the item with which you are working. By default, this cmdlet does not generate any output.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell� calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>Confirm</maml:name> <maml:description> <maml:para>Prompts you for confirmation before running the cmdlet.Prompts you for confirmation before running the cmdlet.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>WhatIf</maml:name> <maml:description> <maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run.Shows what would happen if the cmdlet runs. The cmdlet is not run.</maml:para> </maml:description> </command:parameter> </command:syntaxItem> <command:syntaxItem> <maml:name>Remove-NetEventPacketCaptureProvider</maml:name> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName)" position="1" aliases="none"> <maml:name>SessionName</maml:name> <maml:description> <maml:para>Specifies the name of the session associated with the packet capture provider.</maml:para> </maml:description> <command:parameterValue required="true" variableLength="true">String[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>PassThru</maml:name> <maml:description> <maml:para>Returns an object representing the item with which you are working. By default, this cmdlet does not generate any output.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell� calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>Confirm</maml:name> <maml:description> <maml:para>Prompts you for confirmation before running the cmdlet.Prompts you for confirmation before running the cmdlet.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>WhatIf</maml:name> <maml:description> <maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run.Shows what would happen if the cmdlet runs. The cmdlet is not run.</maml:para> </maml:description> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> <dev:type> <maml:name>CimSession[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>PassThru</maml:name> <maml:description> <maml:para>Returns an object representing the item with which you are working. By default, this cmdlet does not generate any output.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName)" position="1" aliases="none"> <maml:name>SessionName</maml:name> <maml:description> <maml:para>Specifies the name of the session associated with the packet capture provider.</maml:para> </maml:description> <command:parameterValue required="true" variableLength="true">String[]</command:parameterValue> <dev:type> <maml:name>String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell� calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> <dev:type> <maml:name>Int32</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>Confirm</maml:name> <maml:description> <maml:para>Prompts you for confirmation before running the cmdlet.Prompts you for confirmation before running the cmdlet.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>false</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>WhatIf</maml:name> <maml:description> <maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run.Shows what would happen if the cmdlet runs. The cmdlet is not run.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>false</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes> <command:inputType> <dev:type> <maml:name> </maml:name> <maml:uri> </maml:uri> <maml:description> <maml:para /> </maml:description> </dev:type> <maml:description> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues> <command:returnValue> <dev:type> <maml:name> </maml:name> <maml:uri> </maml:uri> <maml:description> <maml:para /> </maml:description> </dev:type> <maml:description> </maml:description> </command:returnValue> </command:returnValues> <command:terminatingErrors /> <command:nonTerminatingErrors /> <command:examples> <command:example> <maml:title>Example 1: Remove a packet capture provider</maml:title> <maml:introduction> <maml:para> </maml:para> </maml:introduction> <dev:code>PS C:\>Remove-NetEventPacketCaptureProvider -SessionName "Session01" </dev:code> <dev:remarks> <maml:para>This command removes a packet capture provider named Session01.</maml:para> <maml:para /> <maml:para /> </dev:remarks> <command:commandLines> <command:commandLine> <command:commandText /> </command:commandLine> </command:commandLines> </command:example> </command:examples> <maml:relatedLinks> <maml:navigationLink> <maml:linkText>Online Version:</maml:linkText> <maml:uri>http://go.microsoft.com/fwlink/?LinkID=294396</maml:uri> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Add-NetEventPacketCaptureProvider</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Get-NetEventPacketCaptureProvider</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Set-NetEventPacketCaptureProvider</maml:linkText> <maml:uri /> </maml:navigationLink> </maml:relatedLinks> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details> <command:name>Remove-NetEventProvider</command:name> <maml:description> <maml:para>Removes an ETW provider from a session. </maml:para> </maml:description> <maml:copyright> <maml:para /> </maml:copyright> <command:verb>Remove</command:verb> <command:noun>NetEventProvider</command:noun> <dev:version /> </command:details> <maml:description> <maml:para>The Remove-NetEventProvider cmdlet removes an Event Tracing for Windows (ETW) provider from a session.</maml:para> </maml:description> <command:syntax> <command:syntaxItem> <maml:name>Remove-NetEventProvider</maml:name> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName)" position="1" aliases="none"> <maml:name>Name</maml:name> <maml:description> <maml:para>Specifies an array of names that identify ETW providers. </maml:para> <maml:para> </maml:para> </maml:description> <command:parameterValue required="true" variableLength="true">String[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>PassThru</maml:name> <maml:description> <maml:para>Returns an object representing the item with which you are working. By default, this cmdlet does not generate any output.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell� calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>Confirm</maml:name> <maml:description> <maml:para>Prompts you for confirmation before running the cmdlet.Prompts you for confirmation before running the cmdlet.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>WhatIf</maml:name> <maml:description> <maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run.Shows what would happen if the cmdlet runs. The cmdlet is not run.</maml:para> </maml:description> </command:parameter> </command:syntaxItem> <command:syntaxItem> <maml:name>Remove-NetEventProvider</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>PassThru</maml:name> <maml:description> <maml:para>Returns an object representing the item with which you are working. By default, this cmdlet does not generate any output.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell� calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>Confirm</maml:name> <maml:description> <maml:para>Prompts you for confirmation before running the cmdlet.Prompts you for confirmation before running the cmdlet.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>WhatIf</maml:name> <maml:description> <maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run.Shows what would happen if the cmdlet runs. The cmdlet is not run.</maml:para> </maml:description> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> <dev:type> <maml:name>CimSession[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName)" position="1" aliases="none"> <maml:name>Name</maml:name> <maml:description> <maml:para>Specifies an array of names that identify ETW providers. </maml:para> <maml:para> </maml:para> </maml:description> <command:parameterValue required="true" variableLength="true">String[]</command:parameterValue> <dev:type> <maml:name>String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>PassThru</maml:name> <maml:description> <maml:para>Returns an object representing the item with which you are working. By default, this cmdlet does not generate any output.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell� calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> <dev:type> <maml:name>Int32</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>Confirm</maml:name> <maml:description> <maml:para>Prompts you for confirmation before running the cmdlet.Prompts you for confirmation before running the cmdlet.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>false</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>WhatIf</maml:name> <maml:description> <maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run.Shows what would happen if the cmdlet runs. The cmdlet is not run.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>false</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes> <command:inputType> <dev:type> <maml:name> </maml:name> <maml:uri> </maml:uri> <maml:description> <maml:para /> </maml:description> </dev:type> <maml:description> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues> <command:returnValue> <dev:type> <maml:name> </maml:name> <maml:uri> </maml:uri> <maml:description> <maml:para /> </maml:description> </dev:type> <maml:description> </maml:description> </command:returnValue> </command:returnValues> <command:terminatingErrors /> <command:nonTerminatingErrors /> <command:examples> <command:example> <maml:title>Example 1: Remove an ETW provider</maml:title> <maml:introduction> <maml:para> </maml:para> </maml:introduction> <dev:code>PS C:\>Remove-NetEventProvider -Name "Microsoft-Windows-TCPIP" </dev:code> <dev:remarks> <maml:para>This command removes an ETW provider named Microsoft-Windows-TCPIP.</maml:para> <maml:para /> <maml:para /> </dev:remarks> <command:commandLines> <command:commandLine> <command:commandText /> </command:commandLine> </command:commandLines> </command:example> </command:examples> <maml:relatedLinks> <maml:navigationLink> <maml:linkText>Online Version:</maml:linkText> <maml:uri>http://go.microsoft.com/fwlink/?LinkID=294397</maml:uri> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Add-NetEventProvider</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Set-NetEventProvider</maml:linkText> <maml:uri /> </maml:navigationLink> </maml:relatedLinks> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details> <command:name>Remove-NetEventSession</command:name> <maml:description> <maml:para>Removes a network event session. </maml:para> </maml:description> <maml:copyright> <maml:para /> </maml:copyright> <command:verb>Remove</command:verb> <command:noun>NetEventSession</command:noun> <dev:version /> </command:details> <maml:description> <maml:para>The Remove-NetEventSession cmdlet removes a network event session. The cmdlet also deletes all properties and objects associated with the session. A session controls how the computer logs events and, optionally, network traffic, or packets.</maml:para> <maml:para>You can have only one session at a time. Before you can add a network event session by using the New-NetEventSession cmdlet, remove an existing session.</maml:para> </maml:description> <command:syntax> <command:syntaxItem> <maml:name>Remove-NetEventSession</maml:name> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="True (ByValue)" position="named" aliases="none"> <maml:name>AssociatedEventProvider</maml:name> <maml:description> <maml:para>Specifies the associated network event provider as a CIM object. To obtain the network event provider, use the Get-NetEventProvider cmdlet.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">CimInstance</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>PassThru</maml:name> <maml:description> <maml:para>Returns an object representing the item with which you are working. By default, this cmdlet does not generate any output.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell� calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>Confirm</maml:name> <maml:description> <maml:para>Prompts you for confirmation before running the cmdlet.Prompts you for confirmation before running the cmdlet.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>WhatIf</maml:name> <maml:description> <maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run.Shows what would happen if the cmdlet runs. The cmdlet is not run.</maml:para> </maml:description> </command:parameter> </command:syntaxItem> <command:syntaxItem> <maml:name>Remove-NetEventSession</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>PassThru</maml:name> <maml:description> <maml:para>Returns an object representing the item with which you are working. By default, this cmdlet does not generate any output.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell� calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>Confirm</maml:name> <maml:description> <maml:para>Prompts you for confirmation before running the cmdlet.Prompts you for confirmation before running the cmdlet.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>WhatIf</maml:name> <maml:description> <maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run.Shows what would happen if the cmdlet runs. The cmdlet is not run.</maml:para> </maml:description> </command:parameter> </command:syntaxItem> <command:syntaxItem> <maml:name>Remove-NetEventSession</maml:name> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName)" position="1" aliases="none"> <maml:name>Name</maml:name> <maml:description> <maml:para>Specifies an array of names of sessions to remove. </maml:para> </maml:description> <command:parameterValue required="true" variableLength="true">String[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>PassThru</maml:name> <maml:description> <maml:para>Returns an object representing the item with which you are working. By default, this cmdlet does not generate any output.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell� calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>Confirm</maml:name> <maml:description> <maml:para>Prompts you for confirmation before running the cmdlet.Prompts you for confirmation before running the cmdlet.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>WhatIf</maml:name> <maml:description> <maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run.Shows what would happen if the cmdlet runs. The cmdlet is not run.</maml:para> </maml:description> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="True (ByValue)" position="named" aliases="none"> <maml:name>AssociatedEventProvider</maml:name> <maml:description> <maml:para>Specifies the associated network event provider as a CIM object. To obtain the network event provider, use the Get-NetEventProvider cmdlet.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">CimInstance</command:parameterValue> <dev:type> <maml:name>CimInstance</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> <dev:type> <maml:name>CimSession[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName)" position="1" aliases="none"> <maml:name>Name</maml:name> <maml:description> <maml:para>Specifies an array of names of sessions to remove. </maml:para> </maml:description> <command:parameterValue required="true" variableLength="true">String[]</command:parameterValue> <dev:type> <maml:name>String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>PassThru</maml:name> <maml:description> <maml:para>Returns an object representing the item with which you are working. By default, this cmdlet does not generate any output.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell� calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> <dev:type> <maml:name>Int32</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>Confirm</maml:name> <maml:description> <maml:para>Prompts you for confirmation before running the cmdlet.Prompts you for confirmation before running the cmdlet.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>false</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>WhatIf</maml:name> <maml:description> <maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run.Shows what would happen if the cmdlet runs. The cmdlet is not run.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>false</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes> <command:inputType> <dev:type> <maml:name> </maml:name> <maml:uri> </maml:uri> <maml:description> <maml:para /> </maml:description> </dev:type> <maml:description> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues> <command:returnValue> <dev:type> <maml:name> </maml:name> <maml:uri> </maml:uri> <maml:description> <maml:para /> </maml:description> </dev:type> <maml:description> </maml:description> </command:returnValue> </command:returnValues> <command:terminatingErrors /> <command:nonTerminatingErrors /> <command:examples> <command:example> <maml:title>Example 1: Remove a session</maml:title> <maml:introduction> <maml:para> </maml:para> </maml:introduction> <dev:code>PS C:\>Remove-NetEventSession -Name "Session38" </dev:code> <dev:remarks> <maml:para>This command removes the session named Session38. The command removes all the configuration information associated with the session.</maml:para> <maml:para /> <maml:para /> </dev:remarks> <command:commandLines> <command:commandLine> <command:commandText /> </command:commandLine> </command:commandLines> </command:example> </command:examples> <maml:relatedLinks> <maml:navigationLink> <maml:linkText>Online Version:</maml:linkText> <maml:uri>http://go.microsoft.com/fwlink/?LinkID=294398</maml:uri> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Get-NetEventSession</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>New-NetEventSession</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Set-NetEventSession</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Start-NetEventSession</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Stop-NetEventSession</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Get-NetEventProvider</maml:linkText> <maml:uri /> </maml:navigationLink> </maml:relatedLinks> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details> <command:name>Remove-NetEventVmNetworkAdapter</command:name> <maml:description> <maml:para>Removes virtual network adapters from a provider.</maml:para> </maml:description> <maml:copyright> <maml:para /> </maml:copyright> <command:verb>Remove</command:verb> <command:noun>NetEventVmNetworkAdapter</command:noun> <dev:version /> </command:details> <maml:description> <maml:para>The Remove-NetEventVmNetworkAdapter cmdlet removes network adapters of a virtual machine and the settings for the adapters from a Remote Packet Capture provider. Specify the names of the virtual network adapters, or use the InputObject parameter to specify a NetEventVmNetworkAdapter object to remove. When you remove a virtual network adapter, the Remote Packet Capture provider no longer uses the adapter to capture event packets.</maml:para> <maml:para>The protocol stack uses multiple layers to transmit, receive, and process network traffic as packets. The provider logs network traffic as Event Tracing for Windows (ETW) events.</maml:para> </maml:description> <command:syntax> <command:syntaxItem> <maml:name>Remove-NetEventVmNetworkAdapter</maml:name> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName)" position="1" aliases="none"> <maml:name>Name</maml:name> <maml:description> <maml:para>Specifies an array of names of virtual network adapters to remove.</maml:para> </maml:description> <command:parameterValue required="true" variableLength="true">String[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>PassThru</maml:name> <maml:description> <maml:para>Returns an object representing the item with which you are working. By default, this cmdlet does not generate any output.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell� calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>Confirm</maml:name> <maml:description> <maml:para>Prompts you for confirmation before running the cmdlet.Prompts you for confirmation before running the cmdlet.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>WhatIf</maml:name> <maml:description> <maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run.Shows what would happen if the cmdlet runs. The cmdlet is not run.</maml:para> </maml:description> </command:parameter> </command:syntaxItem> <command:syntaxItem> <maml:name>Remove-NetEventVmNetworkAdapter</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>PassThru</maml:name> <maml:description> <maml:para>Returns an object representing the item with which you are working. By default, this cmdlet does not generate any output.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell� calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>Confirm</maml:name> <maml:description> <maml:para>Prompts you for confirmation before running the cmdlet.Prompts you for confirmation before running the cmdlet.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>WhatIf</maml:name> <maml:description> <maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run.Shows what would happen if the cmdlet runs. The cmdlet is not run.</maml:para> </maml:description> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> <dev:type> <maml:name>CimSession[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName)" position="1" aliases="none"> <maml:name>Name</maml:name> <maml:description> <maml:para>Specifies an array of names of virtual network adapters to remove.</maml:para> </maml:description> <command:parameterValue required="true" variableLength="true">String[]</command:parameterValue> <dev:type> <maml:name>String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>PassThru</maml:name> <maml:description> <maml:para>Returns an object representing the item with which you are working. By default, this cmdlet does not generate any output.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell� calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> <dev:type> <maml:name>Int32</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>Confirm</maml:name> <maml:description> <maml:para>Prompts you for confirmation before running the cmdlet.Prompts you for confirmation before running the cmdlet.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>false</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>WhatIf</maml:name> <maml:description> <maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run.Shows what would happen if the cmdlet runs. The cmdlet is not run.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>false</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes> <command:inputType> <dev:type> <maml:name> </maml:name> <maml:uri> </maml:uri> <maml:description> <maml:para /> </maml:description> </dev:type> <maml:description> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues> <command:returnValue> <dev:type> <maml:name> </maml:name> <maml:uri> </maml:uri> <maml:description> <maml:para /> </maml:description> </dev:type> <maml:description> </maml:description> </command:returnValue> </command:returnValues> <command:terminatingErrors /> <command:nonTerminatingErrors /> <command:examples> <command:example> <maml:title>Example 1: Remove a virtual network adapter from the provider</maml:title> <maml:introduction> <maml:para> </maml:para> </maml:introduction> <dev:code>PS C:\>New-NetEventSession -Name "NESession01" PS C:\> Add-NetEventPacketCaptureProvider -SessionName "NESession01" PS C:\> Add-NetEventVMNetworkAdapter -Name "LargeGuid" PS C:\> Add-NetEventVMNetworkAdapter -Name "LargeGuid02" PS C:\> Get-NetEventVMNetworkAdapter </dev:code> <dev:remarks> <maml:para>This example removes a virtual network adapter from the Remote Packet Capture provider for a network session. After you complete these commands to configure the network session, you can start and stop the event and packet capture for the network session by using the Start-NetEventSession and Stop-NetEventSession cmdlets.</maml:para> <maml:para>The first command uses the New-NetEventSession cmdlet to create a network session named NESession01.</maml:para> <maml:para>The second command uses the Add-NetEventPacketCaptureProvider cmdlet to add a Remote Packet Capture provider for the session named NESession01.</maml:para> <maml:para>The third command uses the Add-NetEventVmSwitch cmdlet to add the virtual network adapter named LargeGuid as a filter on the Remote Packet Capture provider.</maml:para> <maml:para>The fourth command uses the Add-NetEventVmSwitch cmdlet to add the virtual network adapter named LargeGuid02 as a filter on the Remote Packet Capture provider.</maml:para> <maml:para>The fifth command removes the virtual network adapter named LargeGuid from the Remote Packet Capture provider.</maml:para> <maml:para /> <maml:para /> </dev:remarks> <command:commandLines> <command:commandLine> <command:commandText /> </command:commandLine> </command:commandLines> </command:example> </command:examples> <maml:relatedLinks> <maml:navigationLink> <maml:linkText>Online Version:</maml:linkText> <maml:uri>http://go.microsoft.com/fwlink/?LinkId=294400</maml:uri> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Get-NetEventVmNetworkAdapter</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Add-NetEventVmNetworkAdapter</maml:linkText> <maml:uri /> </maml:navigationLink> </maml:relatedLinks> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details> <command:name>Remove-NetEventVmSwitch</command:name> <maml:description> <maml:para>Removes Hyper-V virtual switches from a provider.</maml:para> </maml:description> <maml:copyright> <maml:para /> </maml:copyright> <command:verb>Remove</command:verb> <command:noun>NetEventVmSwitch</command:noun> <dev:version /> </command:details> <maml:description> <maml:para>The Remove-NetEventVmSwitch cmdlet removes Hyper-V virtual switches and the settings for the virtual switches from a Remote Packet Capture provider. You can specify the names of the Hyper-V virtual switches, or use the InputObject parameter to specify a NetEventVmSwitch object to remove. To obtain a NetEventVmSwitch object, use the Get-NetEventVmSwitch cmdlet. When you remove a Hyper-V virtual switch, the Remote Packet Capture provider no longer uses the Hyper-V virtual switch to capture event packets.</maml:para> <maml:para>The protocol stack uses multiple layers to transmit, receive, and process network traffic as packets. The provider logs network traffic as Event Tracing for Windows (ETW) events.</maml:para> </maml:description> <command:syntax> <command:syntaxItem> <maml:name>Remove-NetEventVmSwitch</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>PassThru</maml:name> <maml:description> <maml:para>Returns an object representing the item with which you are working. By default, this cmdlet does not generate any output.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell� calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>Confirm</maml:name> <maml:description> <maml:para>Prompts you for confirmation before running the cmdlet.Prompts you for confirmation before running the cmdlet.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>WhatIf</maml:name> <maml:description> <maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run.Shows what would happen if the cmdlet runs. The cmdlet is not run.</maml:para> </maml:description> </command:parameter> </command:syntaxItem> <command:syntaxItem> <maml:name>Remove-NetEventVmSwitch</maml:name> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName)" position="1" aliases="none"> <maml:name>Name</maml:name> <maml:description> <maml:para>Specifies an array of names of Hyper-V virtual switches to remove.</maml:para> </maml:description> <command:parameterValue required="true" variableLength="true">String[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>PassThru</maml:name> <maml:description> <maml:para>Returns an object representing the item with which you are working. By default, this cmdlet does not generate any output.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell� calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>Confirm</maml:name> <maml:description> <maml:para>Prompts you for confirmation before running the cmdlet.Prompts you for confirmation before running the cmdlet.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>WhatIf</maml:name> <maml:description> <maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run.Shows what would happen if the cmdlet runs. The cmdlet is not run.</maml:para> </maml:description> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> <dev:type> <maml:name>CimSession[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName)" position="1" aliases="none"> <maml:name>Name</maml:name> <maml:description> <maml:para>Specifies an array of names of Hyper-V virtual switches to remove.</maml:para> </maml:description> <command:parameterValue required="true" variableLength="true">String[]</command:parameterValue> <dev:type> <maml:name>String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>PassThru</maml:name> <maml:description> <maml:para>Returns an object representing the item with which you are working. By default, this cmdlet does not generate any output.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell� calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> <dev:type> <maml:name>Int32</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>Confirm</maml:name> <maml:description> <maml:para>Prompts you for confirmation before running the cmdlet.Prompts you for confirmation before running the cmdlet.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>false</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>WhatIf</maml:name> <maml:description> <maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run.Shows what would happen if the cmdlet runs. The cmdlet is not run.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>false</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes> <command:inputType> <dev:type> <maml:name> </maml:name> <maml:uri> </maml:uri> <maml:description> <maml:para /> </maml:description> </dev:type> <maml:description> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues> <command:returnValue> <dev:type> <maml:name> </maml:name> <maml:uri> </maml:uri> <maml:description> <maml:para /> </maml:description> </dev:type> <maml:description> </maml:description> </command:returnValue> </command:returnValues> <command:terminatingErrors /> <command:nonTerminatingErrors /> <command:examples> <command:example> <maml:title>Example 1: Remove a Hyper-V virtual switch from a provider</maml:title> <maml:introduction> <maml:para> </maml:para> </maml:introduction> <dev:code>PS C:\>New-NetEventSession -Name "NESession01" PS C:\> Add-NetEventPacketCaptureProvider -SessionName "NESession01" PS C:\> Add-NetEventVMSwitch -Name "Network Adapter 2 - Virtual Switch" PS C:\> Remove-NetEventVMSwitch -Name "Network Adapter 2 - Virtual Switch" </dev:code> <dev:remarks> <maml:para>This example removes a Hyper-V virtual switch from the Remote Packet Capture for a network session.</maml:para> <maml:para>The first command uses New-NetEventSession the creates the network session named NESession01.</maml:para> <maml:para>The second command uses the Add-NetEventPacketCaptureProvider cmdlet to add a Remote Packet Capture provider for the session named NESession01.</maml:para> <maml:para>The third command uses the Add-NetEventVmSwitch cmdlet to add the Hyper-V virtual switch named Network Adapter 2 - Virtual Switch as a filter on the Remote Packet Capture provider.</maml:para> <maml:para>The fourth command removes the Hyper-V virtual switch named Network Adapter 2 - Virtual Switch from the provider.</maml:para> <maml:para /> <maml:para /> </dev:remarks> <command:commandLines> <command:commandLine> <command:commandText /> </command:commandLine> </command:commandLines> </command:example> </command:examples> <maml:relatedLinks> <maml:navigationLink> <maml:linkText>Online Version:</maml:linkText> <maml:uri>http://go.microsoft.com/fwlink/?LinkId=294401</maml:uri> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Get-NetEventVmSwitch</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Add-NetEventVmSwitch</maml:linkText> <maml:uri /> </maml:navigationLink> </maml:relatedLinks> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details> <command:name>Set-NetEventPacketCaptureProvider</command:name> <maml:description> <maml:para>Modifies the configuration for a Remote Packet Capture provider.</maml:para> </maml:description> <maml:copyright> <maml:para /> </maml:copyright> <command:verb>Set</command:verb> <command:noun>NetEventPacketCaptureProvider</command:noun> <dev:version /> </command:details> <maml:description> <maml:para>The Set-NetEventPacketCaptureProvider cmdlet modifies the configuration for a Remote Packet Capture provider.</maml:para> </maml:description> <command:syntax> <command:syntaxItem> <maml:name>Set-NetEventPacketCaptureProvider</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName)" position="1" aliases="none"> <maml:name>SessionName</maml:name> <maml:description> <maml:para>Specifies the name of the session associated with the packet capture provider.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">String[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4005" aliases="none"> <maml:name>Level</maml:name> <maml:description> <maml:para>Specifies the level of Event Tracing for Windows (ETW) events for the provider. Use the level of detail for the event to filter the events that are logged. The default value for this parameter is 0x4. Acceptable values for this parameter are: -- 0x5. Verbose -- 0x4. Informational -- 0x3. Warning -- 0x2. Error -- 0x1. Critical -- 0x0. LogAlways </maml:para> <maml:para>The provider must log the event if the value of the event is less than or equal to the value of this parameter.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Byte</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4006" aliases="none"> <maml:name>MatchAnyKeyword</maml:name> <maml:description> <maml:para>Specifies keywords as a set of hexadecimal values. Keywords are flags that you can combine to generate values. Use a set of hexadecimal values of the keywords instead of the keyword names, and apply a filter to write ETW events for keyword matches. </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">UInt64</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4007" aliases="none"> <maml:name>MatchAllKeyword</maml:name> <maml:description> <maml:para>Specifies a bitmask that restricts the events that the provider logs.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">UInt64</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4008" aliases="none"> <maml:name>CaptureType</maml:name> <maml:description> <maml:para>Specifies the capture type. Acceptable values for this parameter are: -- SaveToFile. Writes events to a local .etl file. -- RealtimeRPC. Creates a real-time capture session and forwards the events to a remote host as they are recorded. -- RealtimeLocal. Creates a real-time capture session and forwards the events to a local Event Tracing for Windows (ETW) listener as they are recorded.</maml:para> </maml:description> <command:parameterValueGroup> <command:parameterValue required="false" variableLength="false">Physical</command:parameterValue> <command:parameterValue required="false" variableLength="false">Switch</command:parameterValue> <command:parameterValue required="false" variableLength="false">BothPhysicalAndSwitch</command:parameterValue> </command:parameterValueGroup> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4009" aliases="none"> <maml:name>MultiLayer</maml:name> <maml:description> <maml:para>Indicates whether the capture should occur at various layers in the stack. This setting has a value of $False by default.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Boolean</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="4010" aliases="none"> <maml:name>LinkLayerAddress</maml:name> <maml:description> <maml:para>Specifies an array of link layer, or Media Access Control (MAC), addresses. The packet capture provider logs network traffic that matches this filter.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">String[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="4011" aliases="none"> <maml:name>EtherType</maml:name> <maml:description> <maml:para>Specifies an array of ether types. The most common ether types and their values are IPv4 (0800), IPv6 (86DD) and ARP (0806).</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">UInt16[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="4012" aliases="none"> <maml:name>IpAddresses</maml:name> <maml:description> <maml:para>Specifies an array of IP addresses on which to filter. The packet capture provider logs network traffic that matches this filter.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">String[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="4013" aliases="none"> <maml:name>IpProtocols</maml:name> <maml:description> <maml:para>Specifies an array of one or more IP protocols, such as TCP or UDP, on which to filter. The packet capture provider logs network traffic that matches this filter.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">Byte[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4014" aliases="none"> <maml:name>TruncationLength</maml:name> <maml:description> <maml:para>Specifies the display length of each captured packet. The default size is 128 bytes.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">UInt16</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4015" aliases="none"> <maml:name>VmCaptureDirection</maml:name> <maml:description> <maml:para>Specifies the direction of network traffic for a Virtual Machine (VM) capture. The acceptable values for this parameter are: -- Ingress. Network traffic from a VM to a virtual switch. -- Egress. Network traffic from a virtual switch to a VM.</maml:para> </maml:description> <command:parameterValueGroup> <command:parameterValue required="false" variableLength="false">Ingress</command:parameterValue> <command:parameterValue required="false" variableLength="false">Egress</command:parameterValue> <command:parameterValue required="false" variableLength="false">IngressAndEgress</command:parameterValue> </command:parameterValueGroup> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>PassThru</maml:name> <maml:description> <maml:para>Returns an object representing the item with which you are working. By default, this cmdlet does not generate any output.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell� calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>Confirm</maml:name> <maml:description> <maml:para>Prompts you for confirmation before running the cmdlet.Prompts you for confirmation before running the cmdlet.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>WhatIf</maml:name> <maml:description> <maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run.Shows what would happen if the cmdlet runs. The cmdlet is not run.</maml:para> </maml:description> </command:parameter> </command:syntaxItem> <command:syntaxItem> <maml:name>Set-NetEventPacketCaptureProvider</maml:name> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4005" aliases="none"> <maml:name>Level</maml:name> <maml:description> <maml:para>Specifies the level of Event Tracing for Windows (ETW) events for the provider. Use the level of detail for the event to filter the events that are logged. The default value for this parameter is 0x4. Acceptable values for this parameter are: -- 0x5. Verbose -- 0x4. Informational -- 0x3. Warning -- 0x2. Error -- 0x1. Critical -- 0x0. LogAlways </maml:para> <maml:para>The provider must log the event if the value of the event is less than or equal to the value of this parameter.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Byte</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4006" aliases="none"> <maml:name>MatchAnyKeyword</maml:name> <maml:description> <maml:para>Specifies keywords as a set of hexadecimal values. Keywords are flags that you can combine to generate values. Use a set of hexadecimal values of the keywords instead of the keyword names, and apply a filter to write ETW events for keyword matches. </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">UInt64</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4007" aliases="none"> <maml:name>MatchAllKeyword</maml:name> <maml:description> <maml:para>Specifies a bitmask that restricts the events that the provider logs.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">UInt64</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4008" aliases="none"> <maml:name>CaptureType</maml:name> <maml:description> <maml:para>Specifies the capture type. Acceptable values for this parameter are: -- SaveToFile. Writes events to a local .etl file. -- RealtimeRPC. Creates a real-time capture session and forwards the events to a remote host as they are recorded. -- RealtimeLocal. Creates a real-time capture session and forwards the events to a local Event Tracing for Windows (ETW) listener as they are recorded.</maml:para> </maml:description> <command:parameterValueGroup> <command:parameterValue required="false" variableLength="false">Physical</command:parameterValue> <command:parameterValue required="false" variableLength="false">Switch</command:parameterValue> <command:parameterValue required="false" variableLength="false">BothPhysicalAndSwitch</command:parameterValue> </command:parameterValueGroup> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4009" aliases="none"> <maml:name>MultiLayer</maml:name> <maml:description> <maml:para>Indicates whether the capture should occur at various layers in the stack. This setting has a value of $False by default.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Boolean</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="4010" aliases="none"> <maml:name>LinkLayerAddress</maml:name> <maml:description> <maml:para>Specifies an array of link layer, or Media Access Control (MAC), addresses. The packet capture provider logs network traffic that matches this filter.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">String[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="4011" aliases="none"> <maml:name>EtherType</maml:name> <maml:description> <maml:para>Specifies an array of ether types. The most common ether types and their values are IPv4 (0800), IPv6 (86DD) and ARP (0806).</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">UInt16[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="4012" aliases="none"> <maml:name>IpAddresses</maml:name> <maml:description> <maml:para>Specifies an array of IP addresses on which to filter. The packet capture provider logs network traffic that matches this filter.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">String[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="4013" aliases="none"> <maml:name>IpProtocols</maml:name> <maml:description> <maml:para>Specifies an array of one or more IP protocols, such as TCP or UDP, on which to filter. The packet capture provider logs network traffic that matches this filter.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">Byte[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4014" aliases="none"> <maml:name>TruncationLength</maml:name> <maml:description> <maml:para>Specifies the display length of each captured packet. The default size is 128 bytes.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">UInt16</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4015" aliases="none"> <maml:name>VmCaptureDirection</maml:name> <maml:description> <maml:para>Specifies the direction of network traffic for a Virtual Machine (VM) capture. The acceptable values for this parameter are: -- Ingress. Network traffic from a VM to a virtual switch. -- Egress. Network traffic from a virtual switch to a VM.</maml:para> </maml:description> <command:parameterValueGroup> <command:parameterValue required="false" variableLength="false">Ingress</command:parameterValue> <command:parameterValue required="false" variableLength="false">Egress</command:parameterValue> <command:parameterValue required="false" variableLength="false">IngressAndEgress</command:parameterValue> </command:parameterValueGroup> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="True (ByValue)" position="named" aliases="none"> <maml:name>AssociatedCaptureTarget</maml:name> <maml:description> <maml:para>Specifies the associated capture target as a CIM object. The capture target is one of the three following objects: -- MSFT_NetEventNetworkAdapter -- MSFT_NetEventVmNetworkAdapter -- MSFT_NetEventVmSwitch To obtain a capture target, use the Get-NetEventNetworkAdapter cmdlet, the Get-NetEventVmNetworkAdapter cmdlet, or the Get-NetEventVmSwitch cmdlet.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">CimInstance</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>PassThru</maml:name> <maml:description> <maml:para>Returns an object representing the item with which you are working. By default, this cmdlet does not generate any output.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell� calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>Confirm</maml:name> <maml:description> <maml:para>Prompts you for confirmation before running the cmdlet.Prompts you for confirmation before running the cmdlet.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>WhatIf</maml:name> <maml:description> <maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run.Shows what would happen if the cmdlet runs. The cmdlet is not run.</maml:para> </maml:description> </command:parameter> </command:syntaxItem> <command:syntaxItem> <maml:name>Set-NetEventPacketCaptureProvider</maml:name> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4005" aliases="none"> <maml:name>Level</maml:name> <maml:description> <maml:para>Specifies the level of Event Tracing for Windows (ETW) events for the provider. Use the level of detail for the event to filter the events that are logged. The default value for this parameter is 0x4. Acceptable values for this parameter are: -- 0x5. Verbose -- 0x4. Informational -- 0x3. Warning -- 0x2. Error -- 0x1. Critical -- 0x0. LogAlways </maml:para> <maml:para>The provider must log the event if the value of the event is less than or equal to the value of this parameter.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Byte</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4006" aliases="none"> <maml:name>MatchAnyKeyword</maml:name> <maml:description> <maml:para>Specifies keywords as a set of hexadecimal values. Keywords are flags that you can combine to generate values. Use a set of hexadecimal values of the keywords instead of the keyword names, and apply a filter to write ETW events for keyword matches. </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">UInt64</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4007" aliases="none"> <maml:name>MatchAllKeyword</maml:name> <maml:description> <maml:para>Specifies a bitmask that restricts the events that the provider logs.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">UInt64</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4008" aliases="none"> <maml:name>CaptureType</maml:name> <maml:description> <maml:para>Specifies the capture type. Acceptable values for this parameter are: -- SaveToFile. Writes events to a local .etl file. -- RealtimeRPC. Creates a real-time capture session and forwards the events to a remote host as they are recorded. -- RealtimeLocal. Creates a real-time capture session and forwards the events to a local Event Tracing for Windows (ETW) listener as they are recorded.</maml:para> </maml:description> <command:parameterValueGroup> <command:parameterValue required="false" variableLength="false">Physical</command:parameterValue> <command:parameterValue required="false" variableLength="false">Switch</command:parameterValue> <command:parameterValue required="false" variableLength="false">BothPhysicalAndSwitch</command:parameterValue> </command:parameterValueGroup> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4009" aliases="none"> <maml:name>MultiLayer</maml:name> <maml:description> <maml:para>Indicates whether the capture should occur at various layers in the stack. This setting has a value of $False by default.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Boolean</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="4010" aliases="none"> <maml:name>LinkLayerAddress</maml:name> <maml:description> <maml:para>Specifies an array of link layer, or Media Access Control (MAC), addresses. The packet capture provider logs network traffic that matches this filter.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">String[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="4011" aliases="none"> <maml:name>EtherType</maml:name> <maml:description> <maml:para>Specifies an array of ether types. The most common ether types and their values are IPv4 (0800), IPv6 (86DD) and ARP (0806).</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">UInt16[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="4012" aliases="none"> <maml:name>IpAddresses</maml:name> <maml:description> <maml:para>Specifies an array of IP addresses on which to filter. The packet capture provider logs network traffic that matches this filter.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">String[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="4013" aliases="none"> <maml:name>IpProtocols</maml:name> <maml:description> <maml:para>Specifies an array of one or more IP protocols, such as TCP or UDP, on which to filter. The packet capture provider logs network traffic that matches this filter.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">Byte[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4014" aliases="none"> <maml:name>TruncationLength</maml:name> <maml:description> <maml:para>Specifies the display length of each captured packet. The default size is 128 bytes.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">UInt16</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4015" aliases="none"> <maml:name>VmCaptureDirection</maml:name> <maml:description> <maml:para>Specifies the direction of network traffic for a Virtual Machine (VM) capture. The acceptable values for this parameter are: -- Ingress. Network traffic from a VM to a virtual switch. -- Egress. Network traffic from a virtual switch to a VM.</maml:para> </maml:description> <command:parameterValueGroup> <command:parameterValue required="false" variableLength="false">Ingress</command:parameterValue> <command:parameterValue required="false" variableLength="false">Egress</command:parameterValue> <command:parameterValue required="false" variableLength="false">IngressAndEgress</command:parameterValue> </command:parameterValueGroup> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="True (ByValue)" position="named" aliases="none"> <maml:name>AssociatedEventSession</maml:name> <maml:description> <maml:para>Specifies the associated network event session, as a CIM object. To obtain the network event session, use the Get-NetEventSession cmdlet.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">CimInstance</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>PassThru</maml:name> <maml:description> <maml:para>Returns an object representing the item with which you are working. By default, this cmdlet does not generate any output.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell� calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>Confirm</maml:name> <maml:description> <maml:para>Prompts you for confirmation before running the cmdlet.Prompts you for confirmation before running the cmdlet.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>WhatIf</maml:name> <maml:description> <maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run.Shows what would happen if the cmdlet runs. The cmdlet is not run.</maml:para> </maml:description> </command:parameter> </command:syntaxItem> <command:syntaxItem> <maml:name>Set-NetEventPacketCaptureProvider</maml:name> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4005" aliases="none"> <maml:name>Level</maml:name> <maml:description> <maml:para>Specifies the level of Event Tracing for Windows (ETW) events for the provider. Use the level of detail for the event to filter the events that are logged. The default value for this parameter is 0x4. Acceptable values for this parameter are: -- 0x5. Verbose -- 0x4. Informational -- 0x3. Warning -- 0x2. Error -- 0x1. Critical -- 0x0. LogAlways </maml:para> <maml:para>The provider must log the event if the value of the event is less than or equal to the value of this parameter.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Byte</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4006" aliases="none"> <maml:name>MatchAnyKeyword</maml:name> <maml:description> <maml:para>Specifies keywords as a set of hexadecimal values. Keywords are flags that you can combine to generate values. Use a set of hexadecimal values of the keywords instead of the keyword names, and apply a filter to write ETW events for keyword matches. </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">UInt64</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4007" aliases="none"> <maml:name>MatchAllKeyword</maml:name> <maml:description> <maml:para>Specifies a bitmask that restricts the events that the provider logs.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">UInt64</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4008" aliases="none"> <maml:name>CaptureType</maml:name> <maml:description> <maml:para>Specifies the capture type. Acceptable values for this parameter are: -- SaveToFile. Writes events to a local .etl file. -- RealtimeRPC. Creates a real-time capture session and forwards the events to a remote host as they are recorded. -- RealtimeLocal. Creates a real-time capture session and forwards the events to a local Event Tracing for Windows (ETW) listener as they are recorded.</maml:para> </maml:description> <command:parameterValueGroup> <command:parameterValue required="false" variableLength="false">Physical</command:parameterValue> <command:parameterValue required="false" variableLength="false">Switch</command:parameterValue> <command:parameterValue required="false" variableLength="false">BothPhysicalAndSwitch</command:parameterValue> </command:parameterValueGroup> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4009" aliases="none"> <maml:name>MultiLayer</maml:name> <maml:description> <maml:para>Indicates whether the capture should occur at various layers in the stack. This setting has a value of $False by default.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Boolean</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="4010" aliases="none"> <maml:name>LinkLayerAddress</maml:name> <maml:description> <maml:para>Specifies an array of link layer, or Media Access Control (MAC), addresses. The packet capture provider logs network traffic that matches this filter.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">String[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="4011" aliases="none"> <maml:name>EtherType</maml:name> <maml:description> <maml:para>Specifies an array of ether types. The most common ether types and their values are IPv4 (0800), IPv6 (86DD) and ARP (0806).</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">UInt16[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="4012" aliases="none"> <maml:name>IpAddresses</maml:name> <maml:description> <maml:para>Specifies an array of IP addresses on which to filter. The packet capture provider logs network traffic that matches this filter.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">String[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="4013" aliases="none"> <maml:name>IpProtocols</maml:name> <maml:description> <maml:para>Specifies an array of one or more IP protocols, such as TCP or UDP, on which to filter. The packet capture provider logs network traffic that matches this filter.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">Byte[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4014" aliases="none"> <maml:name>TruncationLength</maml:name> <maml:description> <maml:para>Specifies the display length of each captured packet. The default size is 128 bytes.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">UInt16</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4015" aliases="none"> <maml:name>VmCaptureDirection</maml:name> <maml:description> <maml:para>Specifies the direction of network traffic for a Virtual Machine (VM) capture. The acceptable values for this parameter are: -- Ingress. Network traffic from a VM to a virtual switch. -- Egress. Network traffic from a virtual switch to a VM.</maml:para> </maml:description> <command:parameterValueGroup> <command:parameterValue required="false" variableLength="false">Ingress</command:parameterValue> <command:parameterValue required="false" variableLength="false">Egress</command:parameterValue> <command:parameterValue required="false" variableLength="false">IngressAndEgress</command:parameterValue> </command:parameterValueGroup> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>PassThru</maml:name> <maml:description> <maml:para>Returns an object representing the item with which you are working. By default, this cmdlet does not generate any output.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell� calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>Confirm</maml:name> <maml:description> <maml:para>Prompts you for confirmation before running the cmdlet.Prompts you for confirmation before running the cmdlet.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>WhatIf</maml:name> <maml:description> <maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run.Shows what would happen if the cmdlet runs. The cmdlet is not run.</maml:para> </maml:description> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="True (ByValue)" position="named" aliases="none"> <maml:name>AssociatedCaptureTarget</maml:name> <maml:description> <maml:para>Specifies the associated capture target as a CIM object. The capture target is one of the three following objects: -- MSFT_NetEventNetworkAdapter -- MSFT_NetEventVmNetworkAdapter -- MSFT_NetEventVmSwitch To obtain a capture target, use the Get-NetEventNetworkAdapter cmdlet, the Get-NetEventVmNetworkAdapter cmdlet, or the Get-NetEventVmSwitch cmdlet.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">CimInstance</command:parameterValue> <dev:type> <maml:name>CimInstance</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="True (ByValue)" position="named" aliases="none"> <maml:name>AssociatedEventSession</maml:name> <maml:description> <maml:para>Specifies the associated network event session, as a CIM object. To obtain the network event session, use the Get-NetEventSession cmdlet.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">CimInstance</command:parameterValue> <dev:type> <maml:name>CimInstance</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4008" aliases="none"> <maml:name>CaptureType</maml:name> <maml:description> <maml:para>Specifies the capture type. Acceptable values for this parameter are: -- SaveToFile. Writes events to a local .etl file. -- RealtimeRPC. Creates a real-time capture session and forwards the events to a remote host as they are recorded. -- RealtimeLocal. Creates a real-time capture session and forwards the events to a local Event Tracing for Windows (ETW) listener as they are recorded.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">CaptureType</command:parameterValue> <dev:type> <maml:name>CaptureType</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> <dev:type> <maml:name>CimSession[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="4011" aliases="none"> <maml:name>EtherType</maml:name> <maml:description> <maml:para>Specifies an array of ether types. The most common ether types and their values are IPv4 (0800), IPv6 (86DD) and ARP (0806).</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">UInt16[]</command:parameterValue> <dev:type> <maml:name>UInt16[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="4012" aliases="none"> <maml:name>IpAddresses</maml:name> <maml:description> <maml:para>Specifies an array of IP addresses on which to filter. The packet capture provider logs network traffic that matches this filter.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">String[]</command:parameterValue> <dev:type> <maml:name>String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="4013" aliases="none"> <maml:name>IpProtocols</maml:name> <maml:description> <maml:para>Specifies an array of one or more IP protocols, such as TCP or UDP, on which to filter. The packet capture provider logs network traffic that matches this filter.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">Byte[]</command:parameterValue> <dev:type> <maml:name>Byte[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4005" aliases="none"> <maml:name>Level</maml:name> <maml:description> <maml:para>Specifies the level of Event Tracing for Windows (ETW) events for the provider. Use the level of detail for the event to filter the events that are logged. The default value for this parameter is 0x4. Acceptable values for this parameter are: -- 0x5. Verbose -- 0x4. Informational -- 0x3. Warning -- 0x2. Error -- 0x1. Critical -- 0x0. LogAlways </maml:para> <maml:para>The provider must log the event if the value of the event is less than or equal to the value of this parameter.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Byte</command:parameterValue> <dev:type> <maml:name>Byte</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="4010" aliases="none"> <maml:name>LinkLayerAddress</maml:name> <maml:description> <maml:para>Specifies an array of link layer, or Media Access Control (MAC), addresses. The packet capture provider logs network traffic that matches this filter.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">String[]</command:parameterValue> <dev:type> <maml:name>String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4007" aliases="none"> <maml:name>MatchAllKeyword</maml:name> <maml:description> <maml:para>Specifies a bitmask that restricts the events that the provider logs.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">UInt64</command:parameterValue> <dev:type> <maml:name>UInt64</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4006" aliases="none"> <maml:name>MatchAnyKeyword</maml:name> <maml:description> <maml:para>Specifies keywords as a set of hexadecimal values. Keywords are flags that you can combine to generate values. Use a set of hexadecimal values of the keywords instead of the keyword names, and apply a filter to write ETW events for keyword matches. </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">UInt64</command:parameterValue> <dev:type> <maml:name>UInt64</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4009" aliases="none"> <maml:name>MultiLayer</maml:name> <maml:description> <maml:para>Indicates whether the capture should occur at various layers in the stack. This setting has a value of $False by default.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Boolean</command:parameterValue> <dev:type> <maml:name>Boolean</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>PassThru</maml:name> <maml:description> <maml:para>Returns an object representing the item with which you are working. By default, this cmdlet does not generate any output.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName)" position="1" aliases="none"> <maml:name>SessionName</maml:name> <maml:description> <maml:para>Specifies the name of the session associated with the packet capture provider.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">String[]</command:parameterValue> <dev:type> <maml:name>String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell� calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> <dev:type> <maml:name>Int32</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4014" aliases="none"> <maml:name>TruncationLength</maml:name> <maml:description> <maml:para>Specifies the display length of each captured packet. The default size is 128 bytes.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">UInt16</command:parameterValue> <dev:type> <maml:name>UInt16</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4015" aliases="none"> <maml:name>VmCaptureDirection</maml:name> <maml:description> <maml:para>Specifies the direction of network traffic for a Virtual Machine (VM) capture. The acceptable values for this parameter are: -- Ingress. Network traffic from a VM to a virtual switch. -- Egress. Network traffic from a virtual switch to a VM.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">VmCaptureDirection</command:parameterValue> <dev:type> <maml:name>VmCaptureDirection</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>Confirm</maml:name> <maml:description> <maml:para>Prompts you for confirmation before running the cmdlet.Prompts you for confirmation before running the cmdlet.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>false</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>WhatIf</maml:name> <maml:description> <maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run.Shows what would happen if the cmdlet runs. The cmdlet is not run.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>false</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes> <command:inputType> <dev:type> <maml:name> </maml:name> <maml:uri> </maml:uri> <maml:description> <maml:para /> </maml:description> </dev:type> <maml:description> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues> <command:returnValue> <dev:type> <maml:name> </maml:name> <maml:uri> </maml:uri> <maml:description> <maml:para /> </maml:description> </dev:type> <maml:description> </maml:description> </command:returnValue> </command:returnValues> <command:terminatingErrors /> <command:nonTerminatingErrors /> <command:examples> <command:example> <maml:title>Example 1: Modify a packet capture provider</maml:title> <maml:introduction> <maml:para> </maml:para> </maml:introduction> <dev:code>PS C:\>New-NetEventSession -SessionName "Session01" PS C:\> Add-NetEventProvider -Name "Microsoft-Windows-TCPIP" -SessionName "Session01" PS C:\> Add-NetEventPacketCaptureProvider -SessionName "Session01" PS C:\> Set-NetEventPacketCaptureProvider -SessionName "Session01" -IpAddresses 182.168.0.1 -IpProtocol 6 </dev:code> <dev:code>PS C:\> </dev:code> <dev:code>PS C:\> </dev:code> <dev:code>PS C:\> </dev:code> <dev:remarks> <maml:para>This example modifies a packet capture provider.</maml:para> <maml:para>The first command uses the New-NetEventSession cmdlet to create a new session named Session01.</maml:para> <maml:para>The second command uses the Add-NetEventProvider cmdlet to add a TCP/IP Net provider to the session.</maml:para> <maml:para>The third command uses the Add-NetEventPacketCaptureProvider cmdlet to add a packet capture provider to a session named Session01.</maml:para> <maml:para>The fourth command modifies the packet capture provider settings.</maml:para> <maml:para /> <maml:para /> </dev:remarks> <command:commandLines> <command:commandLine> <command:commandText /> </command:commandLine> </command:commandLines> </command:example> </command:examples> <maml:relatedLinks> <maml:navigationLink> <maml:linkText>Online Version:</maml:linkText> <maml:uri>http://go.microsoft.com/fwlink/?LinkID=294402</maml:uri> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Add-NetEventPacketCaptureProvider</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Add-NetEventProvider</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Get-NetEventPacketCaptureProvider</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>New-NetEventSession</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Remove-NetEventPacketCaptureProvider</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Get-NetEventNetworkAdapter</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Get-NetEventVmNetworkAdapter</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Get-NetEventVmSwitch</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Get-NetEventSession</maml:linkText> <maml:uri /> </maml:navigationLink> </maml:relatedLinks> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details> <command:name>Set-NetEventProvider</command:name> <maml:description> <maml:para>Modifies settings for an ETW provider.</maml:para> </maml:description> <maml:copyright> <maml:para /> </maml:copyright> <command:verb>Set</command:verb> <command:noun>NetEventProvider</command:noun> <dev:version /> </command:details> <maml:description> <maml:para>The Set-NetEventProvider cmdlet modifies settings for an Event Tracing for Windows (ETW) provider.</maml:para> </maml:description> <command:syntax> <command:syntaxItem> <maml:name>Set-NetEventProvider</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName)" position="1" aliases="none"> <maml:name>Name</maml:name> <maml:description> <maml:para>Specifies an array of names that identify ETW providers. </maml:para> <maml:para> </maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">String[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="3" aliases="none"> <maml:name>Level</maml:name> <maml:description> <maml:para>Specifies the level of Event Tracing for Windows (ETW) events for the provider. Use the level of detail for the event to filter the events that are logged. The default value for this parameter is 0x4. The acceptable values for this parameter are: -- 0x5. Verbose -- 0x4. Informational -- 0x3. Warning -- 0x2. Error -- 0x1. Critical -- 0x0. LogAlways </maml:para> <maml:para>The provider must log the event if the value of the event is less than or equal to the value of this parameter.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Byte</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4" aliases="none"> <maml:name>MatchAnyKeyword</maml:name> <maml:description> <maml:para>Specifies keywords as a set of hexadecimal values. Keywords are flags that you can combine to generate values. Use a set of hexadecimal values of the keywords instead of the keyword names, and apply a filter to write ETW events for keyword matches. For more information, see <maml:navigationLink><maml:linkText> HYPERLINK "http://msdn.microsoft.com/en-us/library/ff357720.aspxhttp://msdn.microsoft.com/en-us/library/ff357720.aspx" http://msdn.microsoft.com/en-us/library/ff357720.aspx</maml:linkText><maml:uri></maml:uri></maml:navigationLink> in the Microsoft Developer Library.</maml:para> <maml:para> </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">UInt64</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="5" aliases="none"> <maml:name>MatchAllKeyword</maml:name> <maml:description> <maml:para>Specifies a bitmask that restricts the events that the provider logs. Set the MatchAnyKeyword parameter value to 0 (zero) to match all keywords.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">UInt64</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>PassThru</maml:name> <maml:description> <maml:para>Returns an object representing the item with which you are working. By default, this cmdlet does not generate any output.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell� calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>Confirm</maml:name> <maml:description> <maml:para>Prompts you for confirmation before running the cmdlet.Prompts you for confirmation before running the cmdlet.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>WhatIf</maml:name> <maml:description> <maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run.Shows what would happen if the cmdlet runs. The cmdlet is not run.</maml:para> </maml:description> </command:parameter> </command:syntaxItem> <command:syntaxItem> <maml:name>Set-NetEventProvider</maml:name> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="3" aliases="none"> <maml:name>Level</maml:name> <maml:description> <maml:para>Specifies the level of Event Tracing for Windows (ETW) events for the provider. Use the level of detail for the event to filter the events that are logged. The default value for this parameter is 0x4. The acceptable values for this parameter are: -- 0x5. Verbose -- 0x4. Informational -- 0x3. Warning -- 0x2. Error -- 0x1. Critical -- 0x0. LogAlways </maml:para> <maml:para>The provider must log the event if the value of the event is less than or equal to the value of this parameter.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Byte</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4" aliases="none"> <maml:name>MatchAnyKeyword</maml:name> <maml:description> <maml:para>Specifies keywords as a set of hexadecimal values. Keywords are flags that you can combine to generate values. Use a set of hexadecimal values of the keywords instead of the keyword names, and apply a filter to write ETW events for keyword matches. For more information, see <maml:navigationLink><maml:linkText> HYPERLINK "http://msdn.microsoft.com/en-us/library/ff357720.aspxhttp://msdn.microsoft.com/en-us/library/ff357720.aspx" http://msdn.microsoft.com/en-us/library/ff357720.aspx</maml:linkText><maml:uri></maml:uri></maml:navigationLink> in the Microsoft Developer Library.</maml:para> <maml:para> </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">UInt64</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="5" aliases="none"> <maml:name>MatchAllKeyword</maml:name> <maml:description> <maml:para>Specifies a bitmask that restricts the events that the provider logs. Set the MatchAnyKeyword parameter value to 0 (zero) to match all keywords.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">UInt64</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="True (ByValue)" position="named" aliases="none"> <maml:name>AssociatedCaptureTarget</maml:name> <maml:description> <maml:para>Specifies the associated capture target as a CIM object. The capture target is one of the three following objects: -- MSFT_NetEventNetworkAdapter -- MSFT_NetEventVmNetworkAdapter -- MSFT_NetEventVmSwitch To obtain a capture target, use the Get-NetEventNetworkAdapter cmdlet, the Get-NetEventVmNetworkAdapter cmdlet, or the Get-NetEventVmSwitch cmdlet.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">CimInstance</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>PassThru</maml:name> <maml:description> <maml:para>Returns an object representing the item with which you are working. By default, this cmdlet does not generate any output.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell� calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>Confirm</maml:name> <maml:description> <maml:para>Prompts you for confirmation before running the cmdlet.Prompts you for confirmation before running the cmdlet.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>WhatIf</maml:name> <maml:description> <maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run.Shows what would happen if the cmdlet runs. The cmdlet is not run.</maml:para> </maml:description> </command:parameter> </command:syntaxItem> <command:syntaxItem> <maml:name>Set-NetEventProvider</maml:name> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="3" aliases="none"> <maml:name>Level</maml:name> <maml:description> <maml:para>Specifies the level of Event Tracing for Windows (ETW) events for the provider. Use the level of detail for the event to filter the events that are logged. The default value for this parameter is 0x4. The acceptable values for this parameter are: -- 0x5. Verbose -- 0x4. Informational -- 0x3. Warning -- 0x2. Error -- 0x1. Critical -- 0x0. LogAlways </maml:para> <maml:para>The provider must log the event if the value of the event is less than or equal to the value of this parameter.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Byte</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4" aliases="none"> <maml:name>MatchAnyKeyword</maml:name> <maml:description> <maml:para>Specifies keywords as a set of hexadecimal values. Keywords are flags that you can combine to generate values. Use a set of hexadecimal values of the keywords instead of the keyword names, and apply a filter to write ETW events for keyword matches. For more information, see <maml:navigationLink><maml:linkText> HYPERLINK "http://msdn.microsoft.com/en-us/library/ff357720.aspxhttp://msdn.microsoft.com/en-us/library/ff357720.aspx" http://msdn.microsoft.com/en-us/library/ff357720.aspx</maml:linkText><maml:uri></maml:uri></maml:navigationLink> in the Microsoft Developer Library.</maml:para> <maml:para> </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">UInt64</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="5" aliases="none"> <maml:name>MatchAllKeyword</maml:name> <maml:description> <maml:para>Specifies a bitmask that restricts the events that the provider logs. Set the MatchAnyKeyword parameter value to 0 (zero) to match all keywords.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">UInt64</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="True (ByValue)" position="named" aliases="none"> <maml:name>AssociatedEventSession</maml:name> <maml:description> <maml:para>Specifies the associated network event session, as a CIM object. To obtain the network event session, use the Get-NetEventSession cmdlet.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">CimInstance</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>PassThru</maml:name> <maml:description> <maml:para>Returns an object representing the item with which you are working. By default, this cmdlet does not generate any output.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell� calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>Confirm</maml:name> <maml:description> <maml:para>Prompts you for confirmation before running the cmdlet.Prompts you for confirmation before running the cmdlet.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>WhatIf</maml:name> <maml:description> <maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run.Shows what would happen if the cmdlet runs. The cmdlet is not run.</maml:para> </maml:description> </command:parameter> </command:syntaxItem> <command:syntaxItem> <maml:name>Set-NetEventProvider</maml:name> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="3" aliases="none"> <maml:name>Level</maml:name> <maml:description> <maml:para>Specifies the level of Event Tracing for Windows (ETW) events for the provider. Use the level of detail for the event to filter the events that are logged. The default value for this parameter is 0x4. The acceptable values for this parameter are: -- 0x5. Verbose -- 0x4. Informational -- 0x3. Warning -- 0x2. Error -- 0x1. Critical -- 0x0. LogAlways </maml:para> <maml:para>The provider must log the event if the value of the event is less than or equal to the value of this parameter.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Byte</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4" aliases="none"> <maml:name>MatchAnyKeyword</maml:name> <maml:description> <maml:para>Specifies keywords as a set of hexadecimal values. Keywords are flags that you can combine to generate values. Use a set of hexadecimal values of the keywords instead of the keyword names, and apply a filter to write ETW events for keyword matches. For more information, see <maml:navigationLink><maml:linkText> HYPERLINK "http://msdn.microsoft.com/en-us/library/ff357720.aspxhttp://msdn.microsoft.com/en-us/library/ff357720.aspx" http://msdn.microsoft.com/en-us/library/ff357720.aspx</maml:linkText><maml:uri></maml:uri></maml:navigationLink> in the Microsoft Developer Library.</maml:para> <maml:para> </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">UInt64</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="5" aliases="none"> <maml:name>MatchAllKeyword</maml:name> <maml:description> <maml:para>Specifies a bitmask that restricts the events that the provider logs. Set the MatchAnyKeyword parameter value to 0 (zero) to match all keywords.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">UInt64</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>PassThru</maml:name> <maml:description> <maml:para>Returns an object representing the item with which you are working. By default, this cmdlet does not generate any output.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell� calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>Confirm</maml:name> <maml:description> <maml:para>Prompts you for confirmation before running the cmdlet.Prompts you for confirmation before running the cmdlet.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>WhatIf</maml:name> <maml:description> <maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run.Shows what would happen if the cmdlet runs. The cmdlet is not run.</maml:para> </maml:description> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="True (ByValue)" position="named" aliases="none"> <maml:name>AssociatedCaptureTarget</maml:name> <maml:description> <maml:para>Specifies the associated capture target as a CIM object. The capture target is one of the three following objects: -- MSFT_NetEventNetworkAdapter -- MSFT_NetEventVmNetworkAdapter -- MSFT_NetEventVmSwitch To obtain a capture target, use the Get-NetEventNetworkAdapter cmdlet, the Get-NetEventVmNetworkAdapter cmdlet, or the Get-NetEventVmSwitch cmdlet.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">CimInstance</command:parameterValue> <dev:type> <maml:name>CimInstance</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="True (ByValue)" position="named" aliases="none"> <maml:name>AssociatedEventSession</maml:name> <maml:description> <maml:para>Specifies the associated network event session, as a CIM object. To obtain the network event session, use the Get-NetEventSession cmdlet.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">CimInstance</command:parameterValue> <dev:type> <maml:name>CimInstance</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> <dev:type> <maml:name>CimSession[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="3" aliases="none"> <maml:name>Level</maml:name> <maml:description> <maml:para>Specifies the level of Event Tracing for Windows (ETW) events for the provider. Use the level of detail for the event to filter the events that are logged. The default value for this parameter is 0x4. The acceptable values for this parameter are: -- 0x5. Verbose -- 0x4. Informational -- 0x3. Warning -- 0x2. Error -- 0x1. Critical -- 0x0. LogAlways </maml:para> <maml:para>The provider must log the event if the value of the event is less than or equal to the value of this parameter.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Byte</command:parameterValue> <dev:type> <maml:name>Byte</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="5" aliases="none"> <maml:name>MatchAllKeyword</maml:name> <maml:description> <maml:para>Specifies a bitmask that restricts the events that the provider logs. Set the MatchAnyKeyword parameter value to 0 (zero) to match all keywords.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">UInt64</command:parameterValue> <dev:type> <maml:name>UInt64</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4" aliases="none"> <maml:name>MatchAnyKeyword</maml:name> <maml:description> <maml:para>Specifies keywords as a set of hexadecimal values. Keywords are flags that you can combine to generate values. Use a set of hexadecimal values of the keywords instead of the keyword names, and apply a filter to write ETW events for keyword matches. For more information, see <maml:navigationLink><maml:linkText> HYPERLINK "http://msdn.microsoft.com/en-us/library/ff357720.aspxhttp://msdn.microsoft.com/en-us/library/ff357720.aspx" http://msdn.microsoft.com/en-us/library/ff357720.aspx</maml:linkText><maml:uri></maml:uri></maml:navigationLink> in the Microsoft Developer Library.</maml:para> <maml:para> </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">UInt64</command:parameterValue> <dev:type> <maml:name>UInt64</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName)" position="1" aliases="none"> <maml:name>Name</maml:name> <maml:description> <maml:para>Specifies an array of names that identify ETW providers. </maml:para> <maml:para> </maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">String[]</command:parameterValue> <dev:type> <maml:name>String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>PassThru</maml:name> <maml:description> <maml:para>Returns an object representing the item with which you are working. By default, this cmdlet does not generate any output.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell� calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> <dev:type> <maml:name>Int32</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>Confirm</maml:name> <maml:description> <maml:para>Prompts you for confirmation before running the cmdlet.Prompts you for confirmation before running the cmdlet.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>false</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>WhatIf</maml:name> <maml:description> <maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run.Shows what would happen if the cmdlet runs. The cmdlet is not run.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>false</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes> <command:inputType> <dev:type> <maml:name> </maml:name> <maml:uri> </maml:uri> <maml:description> <maml:para /> </maml:description> </dev:type> <maml:description> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues> <command:returnValue> <dev:type> <maml:name> </maml:name> <maml:uri> </maml:uri> <maml:description> <maml:para /> </maml:description> </dev:type> <maml:description> </maml:description> </command:returnValue> </command:returnValues> <command:terminatingErrors /> <command:nonTerminatingErrors /> <command:examples> <command:example> <maml:title>Example 1: Modify an ETW provider</maml:title> <maml:introduction> <maml:para> </maml:para> </maml:introduction> <dev:code>PS C:\>New-NetEventSession -SessionName "Session01" PS C:\> Add-NetEventProvider -Name "Microsoft-Windows-TCPIP" -SessionName "Session01" PS C:\> Set-NetEventProvider -Name "Microsoft-Windows-TCPIP" -Level 3 </dev:code> <dev:remarks> <maml:para>This example modifies an ETW provider.</maml:para> <maml:para>The first command uses the New-NetEventSession cmdlet to create a new session named Session01.</maml:para> <maml:para>The second command uses the Add-NetEventProvider cmdlet to add a provider named Microsoft-Windows-TCPIP to the session named Session01.</maml:para> <maml:para>The third command modifies the logging level for the provider named Microsoft-Windows-TCPIP.</maml:para> <maml:para /> <maml:para /> </dev:remarks> <command:commandLines> <command:commandLine> <command:commandText /> </command:commandLine> </command:commandLines> </command:example> </command:examples> <maml:relatedLinks> <maml:navigationLink> <maml:linkText>Online Version:</maml:linkText> <maml:uri>http://go.microsoft.com/fwlink/?LinkID=294403</maml:uri> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Add-NetEventProvider</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Get-NetEventProvider</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>New-NetEventSession</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Remove-NetEventProvider</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Get-NetEventNetworkAdapter</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Get-NetEventVmNetworkAdapter</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Get-NetEventVmSwitch</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Get-NetEventSession</maml:linkText> <maml:uri /> </maml:navigationLink> </maml:relatedLinks> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details> <command:name>Set-NetEventSession</command:name> <maml:description> <maml:para>Modifies a network event session. </maml:para> </maml:description> <maml:copyright> <maml:para /> </maml:copyright> <command:verb>Set</command:verb> <command:noun>NetEventSession</command:noun> <dev:version /> </command:details> <maml:description> <maml:para>The Set-NetEventSession cmdlet modifies a network event session. A session controls how the computer logs events and, optionally, network traffic, or packets. A session requires at least one network event provider for logging. A network event provider logs events and network traffic as Event Tracing for Windows (ETW) events. The session stores these events in an .etl file or provides them to an application that displays them.</maml:para> <maml:para>Specify a session to modify by using its name, or get a session to modify by using the Get-NetEventSession cmdlet. You can remove a session by using the Remove-NetEventSession cmdlet. Use the New-NetEventSession cmdlet to create a session. Only one session can exist at a time.</maml:para> <maml:para>You can modify the maximum number of buffers in a session and the size of the trace buffer.</maml:para> <maml:para>You can also modify whether to use an.etl file and, if you do, specify its location and maximum size. Instead of an .etl file, you can select a type of live display.</maml:para> <maml:para>Use the Start-NetEventSession and Stop-NetEventSession cmdlets to start and stop logging. If you make changes to a session that is currently running, you must stop and restart the session for your changes to take effect. </maml:para> </maml:description> <command:syntax> <command:syntaxItem> <maml:name>Set-NetEventSession</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName)" position="1" aliases="none"> <maml:name>Name</maml:name> <maml:description> <maml:para>Specifies an array of names of sessions to modify. </maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">String[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="cm"> <maml:name>CaptureMode</maml:name> <maml:description> <maml:para>Specifies a capture mode. The acceptable values for this parameter are: -- SaveToFile. Saves the capture to an .etl file. -- RealtimeRPC. Connects remotely for a live event and packet capture. -- RealtimeLocal. Connects locally for a live event and packet capture. If you specify a value of SaveToFile, you can specify a location for the file by using the LocalFilePath parameter and specify a maximum file size by using the MaxFileSize parameter.</maml:para> <maml:para>If you specify a value of RealtimeRPC or RealtimeLocal, the capture requires additional software, such as Microsoft Message Analyzer.</maml:para> </maml:description> <command:parameterValueGroup> <command:parameterValue required="false" variableLength="false">RealtimeRPC</command:parameterValue> <command:parameterValue required="false" variableLength="false">SaveToFile</command:parameterValue> <command:parameterValue required="false" variableLength="false">RealtimeLocal</command:parameterValue> </command:parameterValueGroup> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="lfp"> <maml:name>LocalFilePath</maml:name> <maml:description> <maml:para>Specifies a file path. If you specify a value of SaveToFile for the CaptureMode parameter, the cmdlet saves the file to this location. Be sure that you can write to this location. If you do not specify this parameter, the cmdlet uses the default value of %LocalAppData%\Temp\NetTrace.etl.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">String</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>MaxFileSize</maml:name> <maml:description> <maml:para>Specifies a maximum file size, in megabytes. If you specify a value of SaveToFile for the CaptureMode parameter, this value is the maximum size for the .etl file. Once the file reaches the maximum, the session continues to save events, and discards the oldest events to make room. A value of 0 means that there is no maximum. If you do not specify this parameter, the cmdlet uses a default value of 250. </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">UInt32</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>MaxNumberOfBuffers</maml:name> <maml:description> <maml:para>Specifies the maximum number of buffers used in a session. If the computer determines that the value restricts performance or the value is 0, the computer overrides the configuration to optimize trace performance. For more information, see <maml:navigationLink><maml:linkText>EVENT_TRACE_PROPERTIES structure</maml:linkText><maml:uri></maml:uri></maml:navigationLink> (http://msdn.microsoft.com/en-us/library/windows/desktop/aa363784(v=vs.85).aspx) In the Microsoft Developer Network library.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Byte</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>PassThru</maml:name> <maml:description> <maml:para>Returns an object representing the item with which you are working. By default, this cmdlet does not generate any output.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell� calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>TraceBufferSize</maml:name> <maml:description> <maml:para>Specifies the amount of memory, in kilobytes, for a buffer for event tracing. The maximum value is 1024. If the computer determines that the value restricts performance or the value is 0, the computer overrides the configuration to optimize trace performance. The ETW logger uses the size of physical memory to calculate the default value.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">UInt32</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>Confirm</maml:name> <maml:description> <maml:para>Prompts you for confirmation before running the cmdlet.Prompts you for confirmation before running the cmdlet.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>WhatIf</maml:name> <maml:description> <maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run.Shows what would happen if the cmdlet runs. The cmdlet is not run.</maml:para> </maml:description> </command:parameter> </command:syntaxItem> <command:syntaxItem> <maml:name>Set-NetEventSession</maml:name> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="True (ByValue)" position="named" aliases="none"> <maml:name>AssociatedEventProvider</maml:name> <maml:description> <maml:para>Specifies the associated network event provider as a CIM object. To obtain the network event provider, use the Get-NetEventProvider cmdlet.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">CimInstance</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="cm"> <maml:name>CaptureMode</maml:name> <maml:description> <maml:para>Specifies a capture mode. The acceptable values for this parameter are: -- SaveToFile. Saves the capture to an .etl file. -- RealtimeRPC. Connects remotely for a live event and packet capture. -- RealtimeLocal. Connects locally for a live event and packet capture. If you specify a value of SaveToFile, you can specify a location for the file by using the LocalFilePath parameter and specify a maximum file size by using the MaxFileSize parameter.</maml:para> <maml:para>If you specify a value of RealtimeRPC or RealtimeLocal, the capture requires additional software, such as Microsoft Message Analyzer.</maml:para> </maml:description> <command:parameterValueGroup> <command:parameterValue required="false" variableLength="false">RealtimeRPC</command:parameterValue> <command:parameterValue required="false" variableLength="false">SaveToFile</command:parameterValue> <command:parameterValue required="false" variableLength="false">RealtimeLocal</command:parameterValue> </command:parameterValueGroup> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="lfp"> <maml:name>LocalFilePath</maml:name> <maml:description> <maml:para>Specifies a file path. If you specify a value of SaveToFile for the CaptureMode parameter, the cmdlet saves the file to this location. Be sure that you can write to this location. If you do not specify this parameter, the cmdlet uses the default value of %LocalAppData%\Temp\NetTrace.etl.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">String</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>MaxFileSize</maml:name> <maml:description> <maml:para>Specifies a maximum file size, in megabytes. If you specify a value of SaveToFile for the CaptureMode parameter, this value is the maximum size for the .etl file. Once the file reaches the maximum, the session continues to save events, and discards the oldest events to make room. A value of 0 means that there is no maximum. If you do not specify this parameter, the cmdlet uses a default value of 250. </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">UInt32</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>MaxNumberOfBuffers</maml:name> <maml:description> <maml:para>Specifies the maximum number of buffers used in a session. If the computer determines that the value restricts performance or the value is 0, the computer overrides the configuration to optimize trace performance. For more information, see <maml:navigationLink><maml:linkText>EVENT_TRACE_PROPERTIES structure</maml:linkText><maml:uri></maml:uri></maml:navigationLink> (http://msdn.microsoft.com/en-us/library/windows/desktop/aa363784(v=vs.85).aspx) In the Microsoft Developer Network library.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Byte</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>PassThru</maml:name> <maml:description> <maml:para>Returns an object representing the item with which you are working. By default, this cmdlet does not generate any output.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell� calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>TraceBufferSize</maml:name> <maml:description> <maml:para>Specifies the amount of memory, in kilobytes, for a buffer for event tracing. The maximum value is 1024. If the computer determines that the value restricts performance or the value is 0, the computer overrides the configuration to optimize trace performance. The ETW logger uses the size of physical memory to calculate the default value.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">UInt32</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>Confirm</maml:name> <maml:description> <maml:para>Prompts you for confirmation before running the cmdlet.Prompts you for confirmation before running the cmdlet.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>WhatIf</maml:name> <maml:description> <maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run.Shows what would happen if the cmdlet runs. The cmdlet is not run.</maml:para> </maml:description> </command:parameter> </command:syntaxItem> <command:syntaxItem> <maml:name>Set-NetEventSession</maml:name> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="cm"> <maml:name>CaptureMode</maml:name> <maml:description> <maml:para>Specifies a capture mode. The acceptable values for this parameter are: -- SaveToFile. Saves the capture to an .etl file. -- RealtimeRPC. Connects remotely for a live event and packet capture. -- RealtimeLocal. Connects locally for a live event and packet capture. If you specify a value of SaveToFile, you can specify a location for the file by using the LocalFilePath parameter and specify a maximum file size by using the MaxFileSize parameter.</maml:para> <maml:para>If you specify a value of RealtimeRPC or RealtimeLocal, the capture requires additional software, such as Microsoft Message Analyzer.</maml:para> </maml:description> <command:parameterValueGroup> <command:parameterValue required="false" variableLength="false">RealtimeRPC</command:parameterValue> <command:parameterValue required="false" variableLength="false">SaveToFile</command:parameterValue> <command:parameterValue required="false" variableLength="false">RealtimeLocal</command:parameterValue> </command:parameterValueGroup> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="lfp"> <maml:name>LocalFilePath</maml:name> <maml:description> <maml:para>Specifies a file path. If you specify a value of SaveToFile for the CaptureMode parameter, the cmdlet saves the file to this location. Be sure that you can write to this location. If you do not specify this parameter, the cmdlet uses the default value of %LocalAppData%\Temp\NetTrace.etl.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">String</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>MaxFileSize</maml:name> <maml:description> <maml:para>Specifies a maximum file size, in megabytes. If you specify a value of SaveToFile for the CaptureMode parameter, this value is the maximum size for the .etl file. Once the file reaches the maximum, the session continues to save events, and discards the oldest events to make room. A value of 0 means that there is no maximum. If you do not specify this parameter, the cmdlet uses a default value of 250. </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">UInt32</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>MaxNumberOfBuffers</maml:name> <maml:description> <maml:para>Specifies the maximum number of buffers used in a session. If the computer determines that the value restricts performance or the value is 0, the computer overrides the configuration to optimize trace performance. For more information, see <maml:navigationLink><maml:linkText>EVENT_TRACE_PROPERTIES structure</maml:linkText><maml:uri></maml:uri></maml:navigationLink> (http://msdn.microsoft.com/en-us/library/windows/desktop/aa363784(v=vs.85).aspx) In the Microsoft Developer Network library.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Byte</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>PassThru</maml:name> <maml:description> <maml:para>Returns an object representing the item with which you are working. By default, this cmdlet does not generate any output.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell� calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>TraceBufferSize</maml:name> <maml:description> <maml:para>Specifies the amount of memory, in kilobytes, for a buffer for event tracing. The maximum value is 1024. If the computer determines that the value restricts performance or the value is 0, the computer overrides the configuration to optimize trace performance. The ETW logger uses the size of physical memory to calculate the default value.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">UInt32</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>Confirm</maml:name> <maml:description> <maml:para>Prompts you for confirmation before running the cmdlet.Prompts you for confirmation before running the cmdlet.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>WhatIf</maml:name> <maml:description> <maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run.Shows what would happen if the cmdlet runs. The cmdlet is not run.</maml:para> </maml:description> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="True (ByValue)" position="named" aliases="none"> <maml:name>AssociatedEventProvider</maml:name> <maml:description> <maml:para>Specifies the associated network event provider as a CIM object. To obtain the network event provider, use the Get-NetEventProvider cmdlet.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">CimInstance</command:parameterValue> <dev:type> <maml:name>CimInstance</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="cm"> <maml:name>CaptureMode</maml:name> <maml:description> <maml:para>Specifies a capture mode. The acceptable values for this parameter are: -- SaveToFile. Saves the capture to an .etl file. -- RealtimeRPC. Connects remotely for a live event and packet capture. -- RealtimeLocal. Connects locally for a live event and packet capture. If you specify a value of SaveToFile, you can specify a location for the file by using the LocalFilePath parameter and specify a maximum file size by using the MaxFileSize parameter.</maml:para> <maml:para>If you specify a value of RealtimeRPC or RealtimeLocal, the capture requires additional software, such as Microsoft Message Analyzer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">CaptureModes</command:parameterValue> <dev:type> <maml:name>CaptureModes</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> <dev:type> <maml:name>CimSession[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="lfp"> <maml:name>LocalFilePath</maml:name> <maml:description> <maml:para>Specifies a file path. If you specify a value of SaveToFile for the CaptureMode parameter, the cmdlet saves the file to this location. Be sure that you can write to this location. If you do not specify this parameter, the cmdlet uses the default value of %LocalAppData%\Temp\NetTrace.etl.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>MaxFileSize</maml:name> <maml:description> <maml:para>Specifies a maximum file size, in megabytes. If you specify a value of SaveToFile for the CaptureMode parameter, this value is the maximum size for the .etl file. Once the file reaches the maximum, the session continues to save events, and discards the oldest events to make room. A value of 0 means that there is no maximum. If you do not specify this parameter, the cmdlet uses a default value of 250. </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">UInt32</command:parameterValue> <dev:type> <maml:name>UInt32</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>MaxNumberOfBuffers</maml:name> <maml:description> <maml:para>Specifies the maximum number of buffers used in a session. If the computer determines that the value restricts performance or the value is 0, the computer overrides the configuration to optimize trace performance. For more information, see <maml:navigationLink><maml:linkText>EVENT_TRACE_PROPERTIES structure</maml:linkText><maml:uri></maml:uri></maml:navigationLink> (http://msdn.microsoft.com/en-us/library/windows/desktop/aa363784(v=vs.85).aspx) In the Microsoft Developer Network library.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Byte</command:parameterValue> <dev:type> <maml:name>Byte</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName)" position="1" aliases="none"> <maml:name>Name</maml:name> <maml:description> <maml:para>Specifies an array of names of sessions to modify. </maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">String[]</command:parameterValue> <dev:type> <maml:name>String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>PassThru</maml:name> <maml:description> <maml:para>Returns an object representing the item with which you are working. By default, this cmdlet does not generate any output.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell� calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> <dev:type> <maml:name>Int32</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>TraceBufferSize</maml:name> <maml:description> <maml:para>Specifies the amount of memory, in kilobytes, for a buffer for event tracing. The maximum value is 1024. If the computer determines that the value restricts performance or the value is 0, the computer overrides the configuration to optimize trace performance. The ETW logger uses the size of physical memory to calculate the default value.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">UInt32</command:parameterValue> <dev:type> <maml:name>UInt32</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>Confirm</maml:name> <maml:description> <maml:para>Prompts you for confirmation before running the cmdlet.Prompts you for confirmation before running the cmdlet.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>false</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>WhatIf</maml:name> <maml:description> <maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run.Shows what would happen if the cmdlet runs. The cmdlet is not run.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>false</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes> <command:inputType> <dev:type> <maml:name> </maml:name> <maml:uri> </maml:uri> <maml:description> <maml:para /> </maml:description> </dev:type> <maml:description> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues> <command:returnValue> <dev:type> <maml:name> </maml:name> <maml:uri> </maml:uri> <maml:description> <maml:para /> </maml:description> </dev:type> <maml:description> </maml:description> </command:returnValue> </command:returnValues> <command:terminatingErrors /> <command:nonTerminatingErrors /> <command:examples> <command:example> <maml:title>Example 1: Modify the file path for a session</maml:title> <maml:introduction> <maml:para> </maml:para> </maml:introduction> <dev:code>PS C:\>Set-NetEventSession -LocalFilePath 'C:\WINDOWS\Temp\Trace.etl' </dev:code> <dev:remarks> <maml:para>This command modifies the file path for the network event session on the current computer. The new path is C:\WINDOWS\Temp\Trace.etl. If you make changes to a session that is currently running, use the Stop-NetEventSession and Start-NetEventSession cmdlets to stop and restart logging.</maml:para> <maml:para /> <maml:para /> </dev:remarks> <command:commandLines> <command:commandLine> <command:commandText /> </command:commandLine> </command:commandLines> </command:example> </command:examples> <maml:relatedLinks> <maml:navigationLink> <maml:linkText>Online Version:</maml:linkText> <maml:uri>http://go.microsoft.com/fwlink/?LinkID=294404</maml:uri> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Get-NetEventSession</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>New-NetEventSession</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Remove-NetEventSession</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Start-NetEventSession</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Stop-NetEventSession</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Get-NetEventProvider</maml:linkText> <maml:uri /> </maml:navigationLink> </maml:relatedLinks> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details> <command:name>Start-NetEventSession</command:name> <maml:description> <maml:para>Starts event and packet capture for a network event session. </maml:para> </maml:description> <maml:copyright> <maml:para /> </maml:copyright> <command:verb>Start</command:verb> <command:noun>NetEventSession</command:noun> <dev:version /> </command:details> <maml:description> <maml:para>The Start-NetEventSession cmdlet starts event and packet capture for a network event session. A session controls how the computer logs events and, optionally, network traffic, or packets. Use the New-NetEventSession cmdlet to create a session. Before you can start logging, add network event providers to a session. A network event provider logs events and network traffic as Event Tracing for Windows (ETW) events.</maml:para> <maml:para>If a session is currently running, you cannot start it. Use the Get-NetEventSession cmdlet to see session status. </maml:para> </maml:description> <command:syntax> <command:syntaxItem> <maml:name>Start-NetEventSession</maml:name> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName)" position="1" aliases="none"> <maml:name>Name</maml:name> <maml:description> <maml:para>Specifies an array of names of sessions to start. </maml:para> </maml:description> <command:parameterValue required="true" variableLength="true">String[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>PassThru</maml:name> <maml:description> <maml:para>Returns an object representing the item with which you are working. By default, this cmdlet does not generate any output.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell� calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>Confirm</maml:name> <maml:description> <maml:para>Prompts you for confirmation before running the cmdlet.Prompts you for confirmation before running the cmdlet.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>WhatIf</maml:name> <maml:description> <maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run.Shows what would happen if the cmdlet runs. The cmdlet is not run.</maml:para> </maml:description> </command:parameter> </command:syntaxItem> <command:syntaxItem> <maml:name>Start-NetEventSession</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>PassThru</maml:name> <maml:description> <maml:para>Returns an object representing the item with which you are working. By default, this cmdlet does not generate any output.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell� calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>Confirm</maml:name> <maml:description> <maml:para>Prompts you for confirmation before running the cmdlet.Prompts you for confirmation before running the cmdlet.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>WhatIf</maml:name> <maml:description> <maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run.Shows what would happen if the cmdlet runs. The cmdlet is not run.</maml:para> </maml:description> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> <dev:type> <maml:name>CimSession[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName)" position="1" aliases="none"> <maml:name>Name</maml:name> <maml:description> <maml:para>Specifies an array of names of sessions to start. </maml:para> </maml:description> <command:parameterValue required="true" variableLength="true">String[]</command:parameterValue> <dev:type> <maml:name>String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>PassThru</maml:name> <maml:description> <maml:para>Returns an object representing the item with which you are working. By default, this cmdlet does not generate any output.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell� calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> <dev:type> <maml:name>Int32</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>Confirm</maml:name> <maml:description> <maml:para>Prompts you for confirmation before running the cmdlet.Prompts you for confirmation before running the cmdlet.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>false</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>WhatIf</maml:name> <maml:description> <maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run.Shows what would happen if the cmdlet runs. The cmdlet is not run.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>false</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes> <command:inputType> <dev:type> <maml:name> </maml:name> <maml:uri> </maml:uri> <maml:description> <maml:para /> </maml:description> </dev:type> <maml:description> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues> <command:returnValue> <dev:type> <maml:name> </maml:name> <maml:uri> </maml:uri> <maml:description> <maml:para /> </maml:description> </dev:type> <maml:description> </maml:description> </command:returnValue> </command:returnValues> <command:terminatingErrors /> <command:nonTerminatingErrors /> <command:examples> <command:example> <maml:title>Example 1: Start a session</maml:title> <maml:introduction> <maml:para> </maml:para> </maml:introduction> <dev:code>PS C:\>New-NetEventSession -Name "Session38" PS C:\> Add-NetEventProvider -Name "Microsoft-Windows-TCPIP" -SessionName "Session38" PS C:\> Start-NetEventSession -Name "Session38" </dev:code> <dev:remarks> <maml:para>This example creates a session, adds a provider to it, and then starts the session. </maml:para> <maml:para>The first command creates a session named Session38 by using the New-NetEventSession cmdlet.</maml:para> <maml:para>The second command adds a provider to the session by using the Add-NetEventProvider cmdlet. A session must have a provider in order to log events.</maml:para> <maml:para>The third command starts the session named Session38. </maml:para> <maml:para /> <maml:para /> </dev:remarks> <command:commandLines> <command:commandLine> <command:commandText /> </command:commandLine> </command:commandLines> </command:example> </command:examples> <maml:relatedLinks> <maml:navigationLink> <maml:linkText>Online Version:</maml:linkText> <maml:uri>http://go.microsoft.com/fwlink/?LinkID=294405</maml:uri> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Get-NetEventSession</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>New-NetEventSession</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Remove-NetEventSession</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Set-NetEventSession</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Stop-NetEventSession</maml:linkText> <maml:uri /> </maml:navigationLink> </maml:relatedLinks> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details> <command:name>Stop-NetEventSession</command:name> <maml:description> <maml:para>Stops event and packet capture for a network event session. </maml:para> </maml:description> <maml:copyright> <maml:para /> </maml:copyright> <command:verb>Stop</command:verb> <command:noun>NetEventSession</command:noun> <dev:version /> </command:details> <maml:description> <maml:para>The Stop-NetEventSession cmdlet stops event and packet capture for network event session. A session controls how the computer logs events and, optionally, network traffic, or packets. Use the New-NetEventSession cmdlet to create a session. A network event provider logs events and network traffic as Event Tracing for Windows (ETW) events.</maml:para> <maml:para>Use the Start-NetEventSession to start a session. You cannot stop a session unless it is currently running.</maml:para> </maml:description> <command:syntax> <command:syntaxItem> <maml:name>Stop-NetEventSession</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>PassThru</maml:name> <maml:description> <maml:para>Returns an object representing the item with which you are working. By default, this cmdlet does not generate any output.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell� calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>Confirm</maml:name> <maml:description> <maml:para>Prompts you for confirmation before running the cmdlet.Prompts you for confirmation before running the cmdlet.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>WhatIf</maml:name> <maml:description> <maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run.Shows what would happen if the cmdlet runs. The cmdlet is not run.</maml:para> </maml:description> </command:parameter> </command:syntaxItem> <command:syntaxItem> <maml:name>Stop-NetEventSession</maml:name> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName)" position="1" aliases="none"> <maml:name>Name</maml:name> <maml:description> <maml:para>Specifies an array of names of sessions to stop. </maml:para> </maml:description> <command:parameterValue required="true" variableLength="true">String[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>PassThru</maml:name> <maml:description> <maml:para>Returns an object representing the item with which you are working. By default, this cmdlet does not generate any output.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell� calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>Confirm</maml:name> <maml:description> <maml:para>Prompts you for confirmation before running the cmdlet.Prompts you for confirmation before running the cmdlet.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>WhatIf</maml:name> <maml:description> <maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run.Shows what would happen if the cmdlet runs. The cmdlet is not run.</maml:para> </maml:description> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> <dev:type> <maml:name>CimSession[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName)" position="1" aliases="none"> <maml:name>Name</maml:name> <maml:description> <maml:para>Specifies an array of names of sessions to stop. </maml:para> </maml:description> <command:parameterValue required="true" variableLength="true">String[]</command:parameterValue> <dev:type> <maml:name>String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>PassThru</maml:name> <maml:description> <maml:para>Returns an object representing the item with which you are working. By default, this cmdlet does not generate any output.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell� calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> <dev:type> <maml:name>Int32</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>Confirm</maml:name> <maml:description> <maml:para>Prompts you for confirmation before running the cmdlet.Prompts you for confirmation before running the cmdlet.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>false</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"> <maml:name>WhatIf</maml:name> <maml:description> <maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run.Shows what would happen if the cmdlet runs. The cmdlet is not run.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>false</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes> <command:inputType> <dev:type> <maml:name> </maml:name> <maml:uri> </maml:uri> <maml:description> <maml:para /> </maml:description> </dev:type> <maml:description> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues> <command:returnValue> <dev:type> <maml:name> </maml:name> <maml:uri> </maml:uri> <maml:description> <maml:para /> </maml:description> </dev:type> <maml:description> </maml:description> </command:returnValue> </command:returnValues> <command:terminatingErrors /> <command:nonTerminatingErrors /> <command:examples> <command:example> <maml:title>Example 1: Stop a session</maml:title> <maml:introduction> <maml:para> </maml:para> </maml:introduction> <dev:code>PS C:\>New-NetEventSession -Name "Session38" PS C:\> Add-NetEventProvider -Name "Microsoft-Windows-TCPIP" -SessionName "Session38" PS C:\> Start-NetEventSession -Name "Session38" PS C:\> Stop-NetEventSession -Name "Session38" </dev:code> <dev:remarks> <maml:para>This example creates a session, adds a provider to it, and then starts and stops the session. </maml:para> <maml:para>The first command creates a session named Session38 by using the New-NetEventSession cmdlet.</maml:para> <maml:para>The second command adds a provider to the session by using the Add-NetEventProvider cmdlet. A session must have a provider in order to log events.</maml:para> <maml:para>The third command starts the session named Session38 by using the Start-NetEventSession cmdlet. </maml:para> <maml:para>The fourth command stops the session named Session38. </maml:para> <maml:para /> <maml:para /> </dev:remarks> <command:commandLines> <command:commandLine> <command:commandText /> </command:commandLine> </command:commandLines> </command:example> </command:examples> <maml:relatedLinks> <maml:navigationLink> <maml:linkText>Online Version:</maml:linkText> <maml:uri>http://go.microsoft.com/fwlink/?LinkID=294406</maml:uri> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Get-NetEventSession</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>New-NetEventSession</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Remove-NetEventSession</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Set-NetEventSession</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Start-NetEventSession</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Add-NetEventProvider</maml:linkText> <maml:uri /> </maml:navigationLink> </maml:relatedLinks> </command:command> </helpItems> |