I would like to collect the data from multiple Remote Desktop Host Servers as efficiently as possible. I know that PerfMon is a consumer of ETW events that are published via an ETW Provider.
My question is what ETW provider is providing the statistics that the PerMon consumes from the "RemoteFX Network" category of performance counters?
Thanks in advance for your time...
Performance counters do not, in general, use ETW as part of the implementation. It is possible that some component might raise an ETW event at the same time as it increments a performance counter, but in most cases there is no way to get a performance counter value via ETW. (Note that even if you could, I'm not sure how it would help, since there is no support for gathering ETW events from remote computers.)
There is a documentation error on an MSDN article where it appears that an editor translated the single word "event" into "Event Tracing for Windows". This translation was incorrect, because the word was intended to refer to the CreateEvent type of event. V2 performance counters use events (CreateEvent) as part of the underlying implementation when a collection is performed.
The PDH API is the primary API for accessing performance counters. If this is not sufficiently efficient, you might want to investigate some new APIs for low-level V2-only performance counter access. They bypass the PDH API for more direct access to V2 performance counters. They are somewhat harder to use, but if you think PDH is interfering with your performance, you can use them.
The low-level V2-access APIs are documented here: https://msdn.microsoft.com/en-us/library/windows/desktop/aa373078(v=vs.85).aspx, look at the functions that start with "Perf". They are new in the Windows 10.0.14393 SDK version of perflib.h, but they work all the way back to Vista (they were internal before, now they're public).
