add ETW command

Author: rboucher

articles/monitoring-and-diagnostics/azure-diagnostics.md

@@ -6,7 +6,7 @@ author: rboucher
 ms.service: azure-monitor
 ms.devlang: dotnet
 ms.topic: conceptual
-ms.date: 05/01/2018
+ms.date: 07/13/2018
 ms.author: robb
 ms.component: diagnostic-extension
 ---
@@ -26,11 +26,13 @@ The Azure Diagnostics extension can collect the following types of data:
 | Windows Event logs |Information sent to the Windows event logging system |
 | .NET Event Source |Code writing events using the .NET [EventSource](https://msdn.microsoft.com/library/system.diagnostics.tracing.eventsource.aspx) class |
 | IIS Logs |Information about IIS web sites |
-| Manifest based ETW |Event Tracing for Windows events generated by any process |
+| Manifest based ETW |Event Tracing for Windows events generated by any process.(1) |
 | Crash dumps |Information about the state of the process in the event of an application crash |
 | Custom error logs |Logs created by your application or service |
 | Azure Diagnostic infrastructure logs |Information about Diagnostics itself |
 
+(1) To get a list of ETW providers, run `c:\Windows\System32\logman.exe query providers` in a console window on the machine you'd like to gather information from. 
+
 ## Data storage
 The extension stores its data in an [Azure Storage account](azure-diagnostics-storage.md) that you specify.