title: How to force ETW to send previously missed events
body: <p>I want to capture file reads using ETW <code>Microsoft-Windows-Kernel-File</code> provider. It appears that I need to correlate 2 types of events using <code>FileObject</code> (or <code>FileKey</code>) property:</p>
  
  <p><strong>Name create</strong></p>
  
  <pre><code>{
      "Type": "name create",
      "FileObject": 123,
      "FileName": "\\Device\\HarddiskVolume3\\file.txt"
  }
  </code></pre>
  
  <p><strong>Read</strong></p>
  
  <pre><code>{
      "Type": "read",
      "FileObject": 123,
      ...
  }
  </code></pre>
  
  <p>Which I can combine into a <code>file read</code> event</p>
  
  <pre><code>{
      "Type": "file read",
      "FileObject": 123,
      "FileName": "\\Device\\HarddiskVolume3\\file.txt",
      ...
  }
  </code></pre>
  
  <p>The problem is that I only receive <code>name create</code> events for newly opened files. If a file has not been closed I will not get a <code>name create</code> event and it is impossible to corelate <code>read</code> event to get a file name. That information has been provided with <code>name create</code> before my subscriber was attached.</p>
  
  <p><strong>Question:</strong> Is it possible to force ETW to send all the events required for such correlation?  In other words, how can my subscriber retrieved cached <code>name create</code> events from the past?</p>
  
  <p>I am using C++, <a href="https://github.com/Microsoft/krabsetw/tree/master/krabs/krabs" rel="nofollow noreferrer">krabs</a>, <code>Microsoft-Windows-Kernel-File {EDD08927-9CC4-4E65-B970-C2560FB5C289}</code> provider (which is undocumented). I've experimented with kernel providers: <a href="https://msdn.microsoft.com/en-us/library/windows/desktop/aa363703(v=vs.85).aspx" rel="nofollow noreferrer">disk</a> and <a href="https://msdn.microsoft.com/en-us/library/windows/desktop/aa363884(v=vs.85).aspx" rel="nofollow noreferrer">file</a> and it seems the correlation problem is there as well.</p>