With the guide of MSDN, I am able to get NT Kernel trace, but the trace only include trace level 0. https://learn.microsoft.com/en-us/windows/win32/etw/configuring-and-starting-the-nt-kernel-logger-session?redirectedfrom=MSDN
How to set the filter mask to 0xffff with code instead of set registry to capture the NT Kernel trace level 3? like the dbgview.exe to enable the Kernel verbose trace.