/EVENTS: Control ETW event collection. , ,flags[,level , ,flags[,level Where guid is the provider control GUID, and flags ...

/EVENTS:        Control ETW event collection.

                    , [,flags[,level]]
                    , [,flags[,level]]

                Where guid is the provider control GUID, and flags is a '0x'
                prefixed hexadecimal flags value.  Alternatively, a provider
                name may be specified in place of the guid if it is registered
                with WMI.

                Additionally, this option also understands common kernel
                options:

                    on, option[,option]

                Where option is one of

                    Process     Process events
                    Thread      Thread events
                    Image       Image load and unload events
                    Disk        Disk I/O events
                    File        File I/O events
                    Hardfault   Hard page faults
                    Pagefault   Soft page faults
                    Network     Network events
                    Registry    Registry access events

                Note that the Kernel Provider can only be enabled.  It is not
                disabled, nor can its flags be modified, until the monitor
                shuts down.