I am using Event Trace Window(e.i. ETW) on Windows 2003 to process events in real time mode. When an event provider is not running, the function ProcessTrace returns the error code 0x1069, which means âThe instance name passed was not recognized as valid by a WMI data providerâ. Subsequent call to CloseTrace returns the error code 0xaa, which is âThe requested resource is in useâ, and the handle lefts open. If I ignore this error and try to call OpenTrace again, the number of process handles is constantly growing. Snip of my code: OpenTrace while (!End){ rc = ProcessTrace if (rc) { CloseTrace OpenTrace } } CloseTrace Any suggestions are greatly appreciated