如何注册NT内核事件的实时ETW使用者？

I have been able to use logman with some success to dump some kernel traces. However, I'd like to be able to programatically enable real-time consumption of kernel events (mainly thread/process creation/deletion and file I/O) in my application. What is the best approach to this task?I have been able to use logman with some succes