title: How do I register as a real-time ETW consumer for NT Kernel Events?
body: <p>I have been able to use logman with some success to dump some kernel traces. However, I'd like to be able to programatically enable real-time consumption of kernel events (mainly thread/process creation/deletion and file I/O) in my application. What is the best approach to this task?</p>