The NT Kernel Logger trace session generates a trace of Windows kernel events. It is a reserved trace session that is built into Windows. ... By default, when Tracelog starts an NT Kernel Logger session, it enables tracing of process, thread, physical disk I/O, and TCP/IP events.