typedef struct _WMI_LOGGER_CONTEXT
{
     LARGE_INTEGER StartTime;
     PVOID LogFileHandle;
     PETHREAD LoggerThread;
     LONG LoggerStatus;
     ULONG LoggerId;
     PVOID NBQHead;
     PVOID OverflowNBQHead;
     SLIST_HEADER QueueBlockFreeList;
     SLIST_HEADER GlobalList;
     UNICODE_STRING LoggerName;
     UNICODE_STRING LogFileName;
     UNICODE_STRING LogFilePattern;
     UNICODE_STRING NewLogFileName;
     ULONG ClockType;
     LONG CollectionOn;
     ULONG MaximumFileSize;
     ULONG LoggerMode;
     ULONG LastFlushedBuffer;
     ULONG FlushTimer;
     LARGE_INTEGER ByteOffset;
     LARGE_INTEGER FlushTimeStamp;
     ULONG MinimumBuffers;
     LONG BuffersAvailable;
     LONG NumberOfBuffers;
     ULONG MaximumBuffers;
     ULONG EventsLost;
     ULONG BuffersWritten;
     ULONG LogBuffersLost;
     ULONG RealTimeBuffersDelivered;
     ULONG RealTimeBuffersLost;
     ULONG BufferSize;
     ULONG MaximumEventSize;
     LONG * SequencePtr;
     ULONG LocalSequence;
     GUID InstanceGuid;
     int64 * GetCpuClock;
     LONG FileCounter;
     PVOID BufferCallback;
     POOL_TYPE PoolType;
     ETW_REF_CLOCK ReferenceTime;
     UCHAR RealtimeLoggerContextFreed;
     LIST_ENTRY Consumers;
     ULONG NumConsumers;
     LIST_ENTRY Connecting;
     UCHAR NewConsumer;
     PVOID RealtimeLogfileHandle;
     UNICODE_STRING RealtimeLogfileName;
     LARGE_INTEGER RealtimeWriteOffset;
     LARGE_INTEGER RealtimeReadOffset;
     LARGE_INTEGER RealtimeLogfileSize;
     UINT64 RealtimeLogfileUsage;
     ULONG RealtimeBuffersSaved;
     ETW_REF_CLOCK RealtimeReferenceTime;
     ULONG RealtimeDisconnectProcessId;
     ULONG RealtimeDisconnectConsumerId;
     ETW_RT_EVENT_LOSS NewRTEventsLost;
     KEVENT LoggerEvent;
     KEVENT FlushEvent;
     KDPC FlushDpc;
     KMUTANT LoggerMutex;
     SECURITY_CLIENT_CONTEXT ClientSecurityContext;
     EX_FAST_REF SecurityDescriptor;
     WMI_BUFFER_HEADER DummyBufferForMarker;
     INT64 BufferSequenceNumber;
     LONG AcceptNewEvents;
     ULONG Flags;
     ULONG Persistent: 1;
     ULONG AutoLogger: 1;
     ULONG FsReady: 1;
     ULONG RealTime: 1;
     ULONG Wow: 1;
     ULONG KernelTrace: 1;
     ULONG NoMoreEnable: 1;
     ULONG RequestFlag;
     ULONG RequestNewFie: 1;
     ULONG RequestUpdateFile: 1;
     ULONG RequestFlush: 1;
     ULONG RequestDisableRealtime: 1;
     ULONG RequestDisconnectConsumer: 1;
     WORD StackTraceFilterHookCount;
     WORD StackTraceFilter[16];
} WMI_LOGGER_CONTEXT, *PWMI_LOGGER_CONTEXT;

Windows Vista Kernel Structures