From 4b28b234ce2ac8ed6cce14fbe7853dcccffbd4eb Mon Sep 17 00:00:00 2001
From: Kyle Sabo <Robo210@users.noreply.github.com>
Date: Wed, 30 May 2018 00:03:51 -0700
Subject: [PATCH 1/3] Update PowerShell.Core.Instrumentation.man

Remove isolation attribute from Analytic and Debug channels. These channel types always have an isolation of Custom.

The Admin channel was enabled by default, but the comments for the channel indicated that it should be off by default and thus it is OK to use a huge file size and have it stop collecting events when the size is reached. This looks like a copy/paste error where the logging element was copied from a channel with a different isolation type, so fix it by duplicating the Operational channel's logging element instead.

Since no events are being written to the Admin channel currently, set it to disabled by default.
---
 .../PowerShell.Core.Instrumentation.man       | 31 +++++++++----------
 1 file changed, 14 insertions(+), 17 deletions(-)

diff --git a/src/PowerShell.Core.Instrumentation/PowerShell.Core.Instrumentation.man b/src/PowerShell.Core.Instrumentation/PowerShell.Core.Instrumentation.man
index 350323f519c..46a38bc65f4 100644
--- a/src/PowerShell.Core.Instrumentation/PowerShell.Core.Instrumentation.man
+++ b/src/PowerShell.Core.Instrumentation/PowerShell.Core.Instrumentation.man
@@ -26,9 +26,10 @@
       >
     <events xmlns="http://schemas.microsoft.com/win/2004/08/events">
       <!--Defines an event provider for PowerShell Core
-          The Guid for this provider should not be changed. If its
-          changed for any reason, then the manifest needs to be
-          first uninstalled and then installed again (using wevtutil)-->
+          The Guid for this provider should not be changed. If it's
+          changed for any reason, then the old manifest needs to be
+          first uninstalled and then the changed manifest installed
+          (using wevtutil)-->
       <provider
           guid="{f90714a8-5509-434a-bf6d-b1624c8a19a2}"
           messageFileName="PowerShell.Core.Instrumentation.dll"
@@ -2186,10 +2187,12 @@
               />
         </events>
         <channels>
-          <!--There are two channels defined for Windows PowerShell instrumentation
+          <!--There are four channels defined for Windows PowerShell instrumentation
               event provider
-                1. Operational - for high level diagnositc messages
+                1. Operational - for high level diagnostic messages
                 2. Analytic - for high volume high performance trace messages
+                3. Debug - for high volume high performance trace messages
+                4. Admin - for high level diagnostic messages
 		-->
           <channel
               chid="C_OPERATIONAL"
@@ -2211,7 +2214,6 @@
           <channel
               chid="C_ANALYTIC"
               enabled="false"
-              isolation="Application"
               message="$(string.PS_CHANNEL_ANALYTIC.ChannelMessage)"
               name="PowerShellCore/Analytic"
               symbol="C_ANALYTIC"
@@ -2238,7 +2240,6 @@
           <channel
               chid="C_DEBUG"
               enabled="false"
-              isolation="Application"
               message="$(string.PS_CHANNEL_DEBUG.ChannelMessage)"
               name="PowerShellCore/Debug"
               symbol="C_DEBUG"
@@ -2264,7 +2265,7 @@
           </channel>
           <channel
               chid="C_ADMIN"
-              enabled="true"
+              enabled="false"
               isolation="Application"
               message="$(string.PS_CHANNEL_ADMIN.ChannelMessage)"
               name="PowerShellCore/Admin"
@@ -2272,15 +2273,11 @@
               type="Admin"
               >
             <logging>
-              <!--this log is not circular, which means user has to
-					  manually clear logs-->
-              <retention>true</retention>
-              <!--max size of the analytic log file is 100 MB.
-					  It's ok to set it to this high a value because
-					  this channel is not enabled by default and the
-					  user will have to turn it on and this is the
-					  maximum size as well-->
-              <maxSize>1048985600</maxSize>
+              <!--this log is circular, which means older events
+                  will be overwritten if the log gets full-->
+              <retention>false</retention>
+              <!--max size of the operational log file is 15 MB-->
+              <maxSize>15728640</maxSize>
             </logging>
           </channel>
         </channels>

From a780a9f9475edd0850ca6278dd8584177a4e42b5 Mon Sep 17 00:00:00 2001
From: Kyle Sabo <Robo210@users.noreply.github.com>
Date: Wed, 6 Jun 2018 11:44:25 -0700
Subject: [PATCH 2/3] Remove admin channel

The admin channel is not used by any events, so remove it.
---
 .../PowerShell.Core.Instrumentation.man         | 17 -----------------
 1 file changed, 17 deletions(-)

diff --git a/src/PowerShell.Core.Instrumentation/PowerShell.Core.Instrumentation.man b/src/PowerShell.Core.Instrumentation/PowerShell.Core.Instrumentation.man
index 46a38bc65f4..394ef3b0f04 100644
--- a/src/PowerShell.Core.Instrumentation/PowerShell.Core.Instrumentation.man
+++ b/src/PowerShell.Core.Instrumentation/PowerShell.Core.Instrumentation.man
@@ -2263,23 +2263,6 @@
               <bufferSize>64</bufferSize>
             </publishing>
           </channel>
-          <channel
-              chid="C_ADMIN"
-              enabled="false"
-              isolation="Application"
-              message="$(string.PS_CHANNEL_ADMIN.ChannelMessage)"
-              name="PowerShellCore/Admin"
-              symbol="C_ADMIN"
-              type="Admin"
-              >
-            <logging>
-              <!--this log is circular, which means older events
-                  will be overwritten if the log gets full-->
-              <retention>false</retention>
-              <!--max size of the operational log file is 15 MB-->
-              <maxSize>15728640</maxSize>
-            </logging>
-          </channel>
         </channels>
         <levels>
           <level

From 70d054b1d62fedc0ff68faaeb061a62154675d07 Mon Sep 17 00:00:00 2001
From: Kyle Sabo <Robo210@users.noreply.github.com>
Date: Wed, 6 Jun 2018 12:15:57 -0700
Subject: [PATCH 3/3] Update PowerShell.Core.Instrumentation.man

---
 .../PowerShell.Core.Instrumentation.man                        | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/src/PowerShell.Core.Instrumentation/PowerShell.Core.Instrumentation.man b/src/PowerShell.Core.Instrumentation/PowerShell.Core.Instrumentation.man
index 394ef3b0f04..4022efa0656 100644
--- a/src/PowerShell.Core.Instrumentation/PowerShell.Core.Instrumentation.man
+++ b/src/PowerShell.Core.Instrumentation/PowerShell.Core.Instrumentation.man
@@ -2187,12 +2187,11 @@
               />
         </events>
         <channels>
-          <!--There are four channels defined for Windows PowerShell instrumentation
+          <!--There are three channels defined for Windows PowerShell instrumentation
               event provider
                 1. Operational - for high level diagnostic messages
                 2. Analytic - for high volume high performance trace messages
                 3. Debug - for high volume high performance trace messages
-                4. Admin - for high level diagnostic messages
 		-->
           <channel
               chid="C_OPERATIONAL"