The Event Tracing for Windows (ETW) must be used to achieve this. Described here: https://msdn.microsoft.com/en-us/library/windows/desktop/jj662752%28v=vs.85%29.aspx?f=255&MSPPError=-2147217396 Seems quite complex though.