philippkratzer

RegistryKCBRundownEnd Event is not raised in realtime TraceEventSession

6

No RegistryKCBRundownEnd Events are raised in TraceEventSessions. When I start a TraceEventSession using the following code snippet: ```c# using (var session = new TraceEventSession("MonitorKernelAndClrEventsSession")) { session.EnableKernelProvider(KernelTraceEventParser.Keywords.Process | KernelTraceEventParser.Keywords.Registry); session.Source.Kernel.RegistryKCBRundownEnd +=...