title: Find current NT Kernel Logger
body: <p>I'm looking at the Event Tracing for Windows API and, according to the documentation and some tests I've ran, it seems like if there is already a kernel logger running, the API sends a <strong>ERROR_ALREADY_EXISTS</strong> when calling <a href="https://msdn.microsoft.com/en-us/library/windows/desktop/aa364117(v=vs.85).aspx" rel="nofollow">StartTrace</a>.</p>
  
  <p>If you call <a href="https://msdn.microsoft.com/en-us/library/windows/desktop/aa363696(v=vs.85).aspx" rel="nofollow">ControlTrace</a> with <strong>EVENT_TRACE_CONTROL_QUERY</strong>, you can get the thread id of the current logging session, but since the launching of a session is handled by the Windows kernel, I always get a thread id that belongs to System Process (PID=4).</p>
  
  <p>My question is: can you find who <em>really</em> launched that logging session?</p>
  
  <p>Thanks!</p>