sean-m
/
Vanara
mirror of https://github.com/dahall/Vanara.git
1
0
Fork 0
Code Issues Releases Wiki Activity
Vanara/PInvoke/Security/AdvApi32/Evntrace.cs

8502 lines
428 KiB
C#
Raw Blame History

This file contains ambiguous Unicode characters!

This file contains ambiguous Unicode characters that may be confused with others in your current locale. If your use case is intentional and legitimate, you can safely ignore this warning. Use the Escape button to highlight these characters.

using System;
using System.Collections.Generic;
using System.Runtime.InteropServices;
using Vanara.InteropServices;
using static Vanara.PInvoke.Kernel32;
using FILETIME = System.Runtime.InteropServices.ComTypes.FILETIME;
#if (NETCOREAPP2_0 || NETCOREAPP2_1 || NETCOREAPP2_2 || NETSTANDARD2_0)
using ArgIterator = System.IntPtr;
#endif
namespace Vanara.PInvoke
{
public static partial class AdvApi32
{
/// <summary>The diagnostic logger session name.</summary>
public const string DIAG_LOGGER_NAME = "DiagLog";
/// <summary>The event logger session name.</summary>
public const string EVENT_LOGGER_NAME = "EventLog";
/// <summary>The global logger session name.</summary>
public const string GLOBAL_LOGGER_NAME = "GlobalLogger";
/// <summary>The kernel logger session name.</summary>
public const string KERNEL_LOGGER_NAME = "NT Kernel Logger";
/// <summary>Specifies the default event tracing security</summary>
public static readonly Guid DefaultTraceSecurityGuid = new Guid("0811c1af-7a07-4a06-82ed-869455cdf713");
/// <summary/>
public static readonly Guid Dummy = new Guid("3595ab5c-042a-4c8e-b942-2d059bfeb1b1");
/// <summary>Used to report system configuration records</summary>
public static readonly Guid EventTraceConfigGuid = new Guid("01853a65-418f-4f36-aefc-dc0f1d2fd235");
/// <summary>EventTraceGuid is used to identify a event tracing session</summary>
public static readonly Guid EventTraceGuid = new Guid("68fdd900-4a3e-11d1-84f4-0000f80464e3");
/// <summary>Used for private cross-process logger notifications.</summary>
public static readonly Guid PrivateLoggerNotificationGuid = new Guid("3595ab5c-042a-4c8e-b942-2d059bfeb1b1");
/// <summary>Used to specify event tracing for kernel</summary>
public static readonly Guid SystemTraceControlGuid = new Guid("9e814aad-3204-11d2-9a82-006008a86939");
/// <summary>
/// <para>
/// Consumers implement this function to receive statistics about each buffer of events that ETW delivers to an event trace consumer.
/// ETW calls this function after the events for each buffer are delivered.
/// </para>
/// <para>
/// The <c>PEVENT_TRACE_BUFFER_CALLBACK</c> type defines a pointer to this callback function. <c>BufferCallback</c> is a placeholder
/// for the application-defined function name.
/// </para>
/// </summary>
/// <param name="Logfile"/>
/// <returns>
/// To continue processing events, return <c>TRUE</c>. Otherwise, return <c>FALSE</c>. Returning <c>FALSE</c> will terminate the
/// ProcessTrace function.
/// </returns>
/// <remarks>
/// <para>
/// To specify the function that ETW calls to deliver the buffer statistics, set the <c>BufferCallback</c> member of the
/// EVENT_TRACE_LOGFILE structure that you pass to the OpenTrace function.
/// </para>
/// <para>Examples</para>
/// <para>For an example implementation of a <c>BufferCallback</c> function, see Retrieving Event Data Using MOF.</para>
/// </remarks>
// https://docs.microsoft.com/en-us/windows/desktop/api/evntrace/nc-evntrace-pevent_trace_buffer_callbacka
// PEVENT_TRACE_BUFFER_CALLBACKA PeventTraceBufferCallbacka; ULONG PeventTraceBufferCallbacka( PEVENT_TRACE_LOGFILEA Logfile ) {...}
[UnmanagedFunctionPointer(CallingConvention.Winapi)]
[PInvokeData("evntrace.h", MSDNShortId = "0cfe2f62-63dc-45a6-96ce-fb4bf458358f")]
[return: MarshalAs(UnmanagedType.Bool)]
public delegate bool BufferCallback(in EVENT_TRACE_LOGFILE Logfile);
/// <summary>
/// <para>[Do not implement this function; it may be unavailable in subsequent versions.]</para>
/// <para>
/// Consumers implement this function to receive events for a specific event trace class from a session. ETW calls this function
/// every time the <c>ProcessTrace</c> function process an event belonging to the event trace class.
/// </para>
/// <para>
/// The <c>PEVENT_CALLBACK</c> type defines a pointer to this callback function. <c>EventClassCallback</c> is a placeholder for the
/// application-defined function name.
/// </para>
/// </summary>
/// <param name="pEvent">Pointer to an <c>EVENT_TRACE</c> structure that contains the event information.</param>
/// <returns>The function does not return a value.</returns>
/// <remarks>
/// <para>
/// To associate each <c>EventClassCallback</c> function with the class GUID of the event trace class it processes, use the
/// <c>SetTraceCallback</c> function.
/// </para>
/// <para>To stop the <c>EventClassCallback</c> from receiving events, call the <c>RemoveTraceCallback</c> function.</para>
/// <para>To processes all events that the session generates, see the <c>EventCallback</c> function.</para>
/// <para>
/// If you use both <c>EventCallback</c> and <c>EventClassCallback</c> to receive events, the event is always sent to
/// <c>EventCallback</c> and is only sent to <c>EventClassCallback</c> if the event matches the class GUID associated with the callback.
/// </para>
/// <para>
/// You use the <c>Header.Class.Type</c> member of <c>EVENT_TRACE</c> to determine the type of event you received. If you are
/// consuming events from your own provider and know the layout of the data, this is not an issue. Otherwise, to interpret the event,
/// the provider must have published their event schema in the \\root\wmi namespace. For information on using an event's MOF schema
/// to interpret the event, see Consuming Events.
/// </para>
/// </remarks>
// https://docs.microsoft.com/en-us/windows/desktop/ETW/eventclasscallback VOID WINAPI EventClassCallback( _In_ PEVENT_TRACE pEvent );
[UnmanagedFunctionPointer(CallingConvention.Winapi)]
[PInvokeData("Evntrace.h", MSDNShortId = "32e94f58-b8b6-4e0a-b53b-716a534ac374")]
public delegate void EventClassCallback(in EVENT_TRACE pEvent);
/// <summary>
/// <para>Consumers implement this callback to receive events from a session.</para>
/// <para>
/// The <c>PEVENT_RECORD_CALLBACK</c> type defines a pointer to this callback function. <c>EventRecordCallback</c> is a placeholder
/// for the application-defined function name.
/// </para>
/// </summary>
/// <param name="EventRecord">Pointer to an <c>EVENT_RECORD</c> structure that contains the event information.</param>
/// <returns>The function does not return a value.</returns>
/// <remarks>
/// <para>
/// To specify the function that ETW calls to deliver events, set the <c>EventRecordCallback</c> member of the
/// <c>EVENT_TRACE_LOGFILE</c> structure (you pass this structure to the <c>OpenTrace</c> function). You must also set the
/// <c>ProcessTraceMode</c> member to PROCESS_TRACE_MODE_EVENT_RECORD.
/// </para>
/// <para>
/// This callback receives all events that the session generates from the time you call the <c>OpenTrace</c> function. Call the
/// <c>ProcessTrace</c> function to begin receiving the events.
/// </para>
/// <para>For information on parsing the event data, see Retrieving Event Data Using TDH.</para>
/// </remarks>
// https://docs.microsoft.com/en-us/windows/desktop/ETW/eventrecordcallback VOID WINAPI EventRecordCallback( _In_ PEVENT_RECORD
// EventRecord );
[UnmanagedFunctionPointer(CallingConvention.Winapi)]
[PInvokeData("", MSDNShortId = "80a30faf-af1f-4440-8a17-9df44bdb2291")]
public delegate void EventRecordCallback(in EVENT_RECORD EventRecord);
/// <summary>
/// <para>Providers implement this function to receive enable or disable notification requests from controllers.</para>
/// <para>
/// The <c>WMIDPREQUEST</c> type defines a pointer to this callback function. <c>ControlCallback</c> is a placeholder for the
/// application-defined function name.
/// </para>
/// </summary>
/// <param name="RequestCode">Request code. Specify one of the following values.</param>
/// <param name="Context">
/// Provider-defined context. The provider uses the RequestContext parameter of <c>RegisterTraceGuids</c> to specify the context.
/// </param>
/// <param name="Reserved">Reserved for internal use.</param>
/// <param name="Buffer">
/// Pointer to a <c>WNODE_HEADER</c> structure that contains information about the event tracing session for which the provider is
/// being enabled or disabled.
/// </param>
/// <returns>
/// You should return ERROR_SUCCESS if the callback succeeds. Note that ETW ignores the return value for this function except when a
/// controller calls <c>EnableTrace</c> to enable a provider and the provider has not yet called <c>RegisterTraceGuids</c>. When this
/// occurs, <c>RegisterTraceGuids</c> will return the return value of this callback if the registration was successful.
/// </returns>
/// <remarks>
/// <para>
/// This function is specified using the <c>RegisterTraceGuids</c> function. When the controller calls the <c>EnableTrace</c>
/// function to enable, disable, or change the enable flags or level, ETW calls this callback. The provider enables or disables
/// itself based the RequestCode value. Typically, the provider uses this value to set a global flag to indicate its enabled state.
/// </para>
/// <para>
/// The provider defines its interpretation of being enabled or disabled. Generally, if a provider is enabled, it generates events,
/// but while it is disabled, it does not.
/// </para>
/// <para>
/// ETW does not pass the enable flags and enable level that the controller passes to the <c>EnableTrace</c> function to this
/// callback. To retrieve this information, call the <c>GetTraceEnableFlags</c> and <c>GetTraceEnableLevel</c> functions, respectively.
/// </para>
/// <para>
/// You also need to retrieve the session handle in this callback for future calls. To retrieve the session handle, call the
/// <c>GetTraceLoggerHandle</c> function.
/// </para>
/// <para>
/// Your callback function must not call anything that may incur LoadLibrary (more specifically, anything that requires a loader lock).
/// </para>
/// </remarks>
// https://docs.microsoft.com/en-us/windows/desktop/etw/controlcallback ULONG WINAPI ControlCallback( _In_ WMIDPREQUESTCODE
// RequestCode, _In_ PVOID Context, _In_ ULONG *Reserved, _In_ PVOID Buffer );
[UnmanagedFunctionPointer(CallingConvention.Winapi)]
[PInvokeData("evntrace.h", MSDNShortId = "e9f70ae6-906f-4e55-bca7-4355f1ca6091")]
public delegate Win32Error TraceControlCallback([In] WMIDPREQUESTCODE RequestCode, [In] IntPtr Context, ref uint Reserved, [In] IntPtr Buffer);
/// <summary>Defines the source of the event data.</summary>
// https://docs.microsoft.com/en-us/windows/win32/api/tdh/ne-tdh-decoding_source typedef enum _DECODING_SOURCE {
// DecodingSourceXMLFile, DecodingSourceWbem, DecodingSourceWPP, DecodingSourceTlg, DecodingSourceMax } DECODING_SOURCE;
[PInvokeData("tdh.h", MSDNShortId = "d6cd09da-9a67-4df2-9d82-370c559d3bfc")]
public enum DECODING_SOURCE
{
/// <summary>The source of the event data is a XML manifest.</summary>
DecodingSourceXMLFile,
/// <summary>The source of the event data is a WMI MOF class.</summary>
DecodingSourceWbem,
/// <summary>The source of the event data is a TMF file.</summary>
DecodingSourceWPP,
/// <summary>Indicates that the event was a self-describing event and was decoded using TraceLogging metadata.</summary>
DecodingSourceTlg,
}
/// <summary>
/// <para>
/// [Some information relates to pre-released product which may be substantially modified before it's commercially released.
/// Microsoft makes no warranties, express or implied, with respect to the information provided here.]
/// </para>
/// <para>Specifies what kind of operation will be done on a handle. currently used with the QueryTraceProcessingHandle function.</para>
/// </summary>
// https://docs.microsoft.com/en-us/windows/desktop/api/evntrace/ne-evntrace-etw_process_handle_info_type typedef enum
// _ETW_PROCESS_HANDLE_INFO_TYPE { EtwQueryPartitionInformation, EtwQueryProcessHandleInfoMax, EtwQueryPartitionInformationV2,
// EtwQueryLastDroppedTimes } ETW_PROCESS_HANDLE_INFO_TYPE;
[PInvokeData("evntrace.h", MSDNShortId = "92932E4C-0A06-4CDE-B14B-BF53226E133B")]
public enum ETW_PROCESS_HANDLE_INFO_TYPE
{
/// <summary>
/// Used to query partition identifying information. InBuffer should be Null. OutBuffer should be large enough to hold the
/// returned ETW_TRACE_PARTITION_INFORMATION structure. Note that this will only return a non-zero structure when the queried
/// handle is for a trace file generated from a non-host partition on Windows 10, version 1709.
/// </summary>
EtwQueryPartitionInformation,
}
/// <summary>Control code for EnableTraceEx2.</summary>
[PInvokeData("evntrace.h")]
public enum EVENT_CONTROL_CODE
{
/// <summary>Disables the provider.</summary>
EVENT_CONTROL_CODE_DISABLE_PROVIDER = 0,
/// <summary>Enables the provider. The session receives events when the provider is registered.</summary>
EVENT_CONTROL_CODE_ENABLE_PROVIDER = 1,
/// <summary>
/// Requests that the provider log its state information. First you would enable the provider and then call EnableTraceEx2 with
/// this control code to capture state information.
/// </summary>
EVENT_CONTROL_CODE_CAPTURE_STATE = 2
}
/// <summary>Defines the provider information to retrieve.</summary>
/// <remarks>
/// <para>
/// If you specify <c>EventOpcodeInformation</c> when calling TdhQueryProviderFieldInformation, you must specify the EventFieldValue
/// parameter as follows:
/// </para>
/// <list type="bullet">
/// <item>
/// <term>Bits 0 - 15 must contain the task value</term>
/// </item>
/// <item>
/// <term>Bits 16 - 23 must contain the opcode value</term>
/// </item>
/// </list>
/// <para>You can get the task and opcode values from EVENT_RECORD.EventHeader.EventDescriptor.</para>
/// <para>WMI MOF class supports retrieving keyword and level information only.</para>
/// </remarks>
// https://docs.microsoft.com/en-us/windows/win32/api/tdh/ne-tdh-event_field_type typedef enum _EVENT_FIELD_TYPE {
// EventKeywordInformation, EventLevelInformation, EventChannelInformation, EventTaskInformation, EventOpcodeInformation,
// EventInformationMax } EVENT_FIELD_TYPE;
[PInvokeData("tdh.h", MSDNShortId = "da525556-e42b-41cb-b954-300f378477e5")]
public enum EVENT_FIELD_TYPE
{
/// <summary>
/// Keyword information defined in the manifest. For providers that define themselves using MOF classes, this type returns the
/// enable flags values if the provider class includes the Flags property. For details, see the "Specifying level and enable
/// flags values for a provider" section of Event Tracing MOF Qualifiers.
/// </summary>
EventKeywordInformation,
/// <summary>Level information defined in the manifest.</summary>
EventLevelInformation,
/// <summary>Channel information defined in the manifest.</summary>
EventChannelInformation,
/// <summary>Task information defined in the manifest.</summary>
EventTaskInformation,
/// <summary>Operation code information defined in the manifest.</summary>
EventOpcodeInformation,
}
/// <summary>Requested control function.</summary>
[PInvokeData("evntrace.h", MSDNShortId = "c39f669c-ff40-40ed-ba47-798474ec2de4")]
public enum EVENT_TRACE_CONTROL
{
/// <summary>Retrieves session properties and statistics.</summary>
EVENT_TRACE_CONTROL_QUERY = 0,
/// <summary>Stops the session. The session handle is no longer valid.</summary>
EVENT_TRACE_CONTROL_STOP = 1,
/// <summary>Updates the session properties.</summary>
EVENT_TRACE_CONTROL_UPDATE = 2,
/// <summary>
/// Flushes the session's active buffers. Typically, you do not need to flush buffers yourself. However, you may want to flush
/// buffers if the event rate is low and you are delivering events in real time.
/// <para>Windows 2000: This value is not supported.</para>
/// </summary>
EVENT_TRACE_CONTROL_FLUSH = 3,
/// <summary>Undocumented.</summary>
EVENT_TRACE_CONTROL_INCREMENT_FILE = 4,
}
/// <summary>
/// A system logger must set EnableFlags to indicate which SystemTraceProvider events should be included in the trace. This is also
/// used for NT Kernel Logger sessions.
/// </summary>
[PInvokeData("evntrace.h")]
[Flags]
public enum EVENT_TRACE_FLAG : uint
{
/// <summary>
/// Enables the ALPC event types.
/// <para>This value is supported on Windows Vista and later.</para>
/// </summary>
EVENT_TRACE_FLAG_ALPC = 0x00100000,
/// <summary>
/// Enables the following Thread event type:
/// <list type="bullet">
/// <item>CSwitch</item>
/// </list>
/// <para>This value is supported on Windows Vista and later.</para>
/// </summary>
EVENT_TRACE_FLAG_CSWITCH = 0x00000010,
/// <summary>Enables the DbgPrint and DbgPrintEx calls to be converted to ETW events.</summary>
EVENT_TRACE_FLAG_DBGPRINT = 0x00040000,
/// <summary>
/// Enables the following FileIo event type (you must also enable EVENT_TRACE_FLAG_DISK_IO):
/// <list type="bullet">
/// <item>FileIo_Name</item>
/// </list>
/// </summary>
EVENT_TRACE_FLAG_DISK_FILE_IO = 0x00000200,
/// <summary>
/// Enables the following DiskIo event types:
/// <list type="bullet">
/// <item>DiskIo_TypeGroup1</item>
/// <item>DiskIo_TypeGroup3</item>
/// </list>
/// </summary>
EVENT_TRACE_FLAG_DISK_IO = 0x00000100,
/// <summary>
/// Enables the following DiskIo event type:
/// <list type="bullet">
/// <item>DiskIo_TypeGroup2</item>
/// </list>
/// <para>This value is supported on Windows Vista and later.</para>
/// </summary>
EVENT_TRACE_FLAG_DISK_IO_INIT = 0x00000400,
/// <summary>
/// Enables the following Thread event type:
/// <list type="bullet">
/// <item>ReadyThread</item>
/// </list>
/// <para>This value is supported on Windows 7, Windows Server 2008 R2, and later.</para>
/// </summary>
EVENT_TRACE_FLAG_DISPATCHER = 0x00000800,
/// <summary>
/// Enables the following PerfInfo event type:
/// <list type="bullet">
/// <item>DPC</item>
/// </list>
/// <para>This value is supported on Windows Vista and later.</para>
/// </summary>
EVENT_TRACE_FLAG_DPC = 0x00000020,
/// <summary>
/// Enables the following DiskIo event types:
/// <list type="bullet">
/// <item>DriverCompleteRequest</item>
/// <item>DriverCompleteRequestReturn</item>
/// <item>DriverCompletionRoutine</item>
/// <item>DriverMajorFunctionCall</item>
/// <item>DriverMajorFunctionReturn</item>
/// </list>
/// <para>This value is supported on Windows Vista and later.</para>
/// </summary>
EVENT_TRACE_FLAG_DRIVER = 0x00800000,
/// <summary>
/// Enables the following FileIo event types:
/// <list type="bullet">
/// <item>FileIo_OpEnd</item>
/// </list>
/// <para>This value is supported on Windows Vista and later.</para>
/// </summary>
EVENT_TRACE_FLAG_FILE_IO = 0x02000000,
/// <summary>
/// Enables the following FileIo event type:
/// <list type="bullet">
/// <item>FileIo_Create</item>
/// <item>FileIo_DirEnum</item>
/// <item>FileIo_Info</item>
/// <item>FileIo_ReadWrite</item>
/// <item>FileIo_SimpleOp</item>
/// </list>
/// <para>This value is supported on Windows Vista and later.</para>
/// </summary>
EVENT_TRACE_FLAG_FILE_IO_INIT = 0x04000000,
/// <summary>
/// Enables the following Image event type:
/// <list type="bullet">
/// <item>Image_Load</item>
/// </list>
/// </summary>
EVENT_TRACE_FLAG_IMAGE_LOAD = 0x00000004,
/// <summary>
/// Enables the following PerfInfo event type:
/// <list type="bullet">
/// <item>ISR</item>
/// </list>
/// <para>This value is supported on Windows Vista and later.</para>
/// </summary>
EVENT_TRACE_FLAG_INTERRUPT = 0x00000040,
/// <summary>This value is supported on Windows 10</summary>
EVENT_TRACE_FLAG_JOB = 0x00080000,
/// <summary>
/// Enables the following PageFault_V2 event type:
/// <list type="bullet">
/// <item>PageFault_HardFault</item>
/// </list>
/// </summary>
EVENT_TRACE_FLAG_MEMORY_HARD_FAULTS = 0x00002000,
/// <summary>
/// Enables the following PageFault_V2 event type:
/// <list type="bullet">
/// <item>PageFault_TypeGroup1</item>
/// </list>
/// </summary>
EVENT_TRACE_FLAG_MEMORY_PAGE_FAULTS = 0x00001000,
/// <summary>Enables the TcpIp and UdpIp event types.</summary>
EVENT_TRACE_FLAG_NETWORK_TCPIP = 0x00010000,
/// <summary>
/// Do not do a system configuration rundown.
/// <para>This value is supported on Windows 8, Windows Server 2012, and later.</para>
/// </summary>
EVENT_TRACE_FLAG_NO_SYSCONFIG = 0x10000000,
/// <summary>
/// Enables the following Process event type:
/// <list type="bullet">
/// <item>Process_TypeGroup1</item>
/// </list>
/// </summary>
EVENT_TRACE_FLAG_PROCESS = 0x00000001,
/// <summary>
/// Enables the following Process_V2 event type:
/// <list type="bullet">
/// <item>Process_V2_TypeGroup2</item>
/// </list>
/// <para>This value is supported on Windows Vista and later.</para>
/// </summary>
EVENT_TRACE_FLAG_PROCESS_COUNTERS = 0x00000008,
/// <summary>
/// Enables the following PerfInfo event type:
/// <list type="bullet">
/// <item>SampledProfile</item>
/// </list>
/// <para>This value is supported on Windows Vista and later.</para>
/// </summary>
EVENT_TRACE_FLAG_PROFILE = 0x01000000,
/// <summary>Enables the Registry event types.</summary>
EVENT_TRACE_FLAG_REGISTRY = 0x00020000,
/// <summary>
/// Enables the SplitIo event types.
/// <para>This value is supported on Windows Vista and later.</para>
/// </summary>
EVENT_TRACE_FLAG_SPLIT_IO = 0x00200000,
/// <summary>
/// Enables the following PerfInfo event type:
/// <list type="bullet">
/// <item>SysCallEnter</item>
/// <item>SysCallExit</item>
/// </list>
/// <para>This value is supported on Windows Vista and later.</para>
/// </summary>
EVENT_TRACE_FLAG_SYSTEMCALL = 0x00000080,
/// <summary>
/// Enables the following Thread event type:
/// <para>Thread_TypeGroup1</para>
/// </summary>
EVENT_TRACE_FLAG_THREAD = 0x00000002,
/// <summary>
/// Enables the map and unmap (excluding image files) event type.
/// <para>This value is supported on Windows 8, Windows Server 2012, and later.</para>
/// </summary>
EVENT_TRACE_FLAG_VAMAP = 0x00008000,
/// <summary>
/// Enables the following PageFault_V2 event type:
/// <list type="bullet">
/// <item>PageFault_VirtualAlloc</item>
/// </list>
/// <para>This value is supported on Windows 7, Windows Server 2008 R2, and later.</para>
/// </summary>
EVENT_TRACE_FLAG_VIRTUAL_ALLOC = 0x00004000,
}
/// <summary>Type flags used by <see cref="EVENT_TRACE_HEADER"/>.</summary>
[PInvokeData("evntrace.h")]
public enum EVENT_TRACE_TYPE : byte
{
/// <summary>Checkpoint event. Use for an event that is not at the start or end of an activity.</summary>
EVENT_TRACE_TYPE_CHECKPOINT = 0x08,
/// <summary>Data collection end event.</summary>
EVENT_TRACE_TYPE_DC_END = 0x04,
/// <summary>Data collection start event.</summary>
EVENT_TRACE_TYPE_DC_START = 0x03,
/// <summary>
/// Dequeue event. Use when an activity is queued before it begins. Use EVENT_TRACE_TYPE_START to mark the time when a work item
/// is queued. Use the dequeue event type to mark the time when work on the item actually begins. Use EVENT_TRACE_TYPE_END to
/// mark the time when work on the item completes.
/// </summary>
EVENT_TRACE_TYPE_DEQUEUE = 0x07,
/// <summary>End event. Use to trace the final state of a multi-step event.</summary>
EVENT_TRACE_TYPE_END = 0x02,
/// <summary>
/// Extension event. Use for an event that is a continuation of a previous event. For example, use the extension event type when
/// an event trace records more data than can fit in a session buffer.
/// </summary>
EVENT_TRACE_TYPE_EXTENSION = 0x05,
/// <summary>Informational event. This is the default event type.</summary>
EVENT_TRACE_TYPE_INFO = 0x00,
/// <summary>
/// Reply event. Use when an application that requests resources can receive multiple responses. For example, if a client
/// application requests a URL, and the web server replies by sending several files, each file received can be marked as a reply event.
/// </summary>
EVENT_TRACE_TYPE_REPLY = 0x06,
/// <summary>Start event. Use to trace the initial state of a multi-step event.</summary>
EVENT_TRACE_TYPE_START = 0x01,
/// <summary>Send Event (WinEvent compatible)</summary>
EVENT_TRACE_TYPE_WINEVT_SEND = 0x09,
/// <summary>Receive Event (WinEvent compatible)</summary>
EVENT_TRACE_TYPE_WINEVT_RECEIVE = 0XF0,
}
/// <summary>Defines what component of the security descriptor that the EventAccessControl function modifies.</summary>
/// <remarks>For information on DACLs and SACLs, see Access Control Lists.</remarks>
// https://docs.microsoft.com/en-us/windows/desktop/api/evntcons/ne-evntcons-eventsecurityoperation typedef enum {
// EventSecuritySetDACL, EventSecuritySetSACL, EventSecurityAddDACL, EventSecurityAddSACL, EventSecurityMax } ;
[PInvokeData("evntcons.h", MSDNShortId = "81f6cf07-2705-4075-b085-d5aebba17121")]
public enum EVENTSECURITYOPERATION
{
/// <summary>
/// Clears the current discretionary access control list (DACL) and adds an ACE to the DACL. The Sid, Rights, and AllowOrDeny
/// parameters of the EventAccessControl function determine the contents of the ACE (who has access to the provider or session
/// and the type of access). To add a new ACE to the DACL without clearing the existing DACL, specify EventSecurityAddDACL.
/// </summary>
EventSecuritySetDACL,
/// <summary>
/// Clears the current system access control list (SACL) and adds an audit ACE to the SACL. The Sid and Rights parameters of the
/// EventAccessControl function determine the contents of the ACE (who generates an audit record when attempting the specified
/// access). To add a new ACE to the SACL without clearing the existing SACL, specify EventSecurityAddSACL.
/// </summary>
EventSecuritySetSACL,
/// <summary>
/// Adds an ACE to the current DACL. The Sid, Rights, and AllowOrDeny parameters of the EventAccessControl function determine the
/// contents of the ACE (who has access to the provider or session and the type of access).
/// </summary>
EventSecurityAddDACL,
/// <summary>
/// Adds an ACE to the current SACL. The Sid and Rights parameters of the EventAccessControl function determine the contents of
/// the ACE (who generates an audit record when attempting the specified access).
/// </summary>
EventSecurityAddSACL,
}
/// <summary>
/// <para>The following constants represent the possible logging modes for an event tracing session.</para>
/// <para>
/// The constants are used in the <c>LogFileMode</c> members of <c>EVENT_TRACE_LOGFILE</c>, <c>EVENT_TRACE_PROPERTIES</c> and
/// <c>TRACE_LOGFILE_HEADER</c> structures. These constants are defined in the Evntrace.h header file.
/// </para>
/// </summary>
// https://docs.microsoft.com/en-us/windows/win32/etw/logging-mode-constants
[PInvokeData("Evntrace.h", MSDNShortId = "d12aaecb-776a-4476-9ba4-16af30fde9c2")]
[Flags]
public enum LogFileMode : uint
{
/// <summary>Same as EVENT_TRACE_FILE_MODE_SEQUENTIAL with no maximum file size specified.</summary>
EVENT_TRACE_FILE_MODE_NONE = 0x00000000,
/// <summary>
/// Writes events to a log file sequentially; stops when the file reaches its maximum size.Do not use with
/// EVENT_TRACE_FILE_MODE_CIRCULAR or EVENT_TRACE_FILE_MODE_NEWFILE.
/// </summary>
EVENT_TRACE_FILE_MODE_SEQUENTIAL = 0x00000001,
/// <summary>
/// Writes events to a log file. After the file reaches the maximum size, the oldest events are replaced with incoming
/// events.Note that the contents of the circular log file may appear out of order on multiprocessor computers.
/// <para>Do not use with EVENT_TRACE_FILE_MODE_APPEND, EVENT_TRACE_FILE_MODE_NEWFILE, or EVENT_TRACE_FILE_MODE_SEQUENTIAL.</para>
/// </summary>
EVENT_TRACE_FILE_MODE_CIRCULAR = 0x00000002,
/// <summary>
/// Appends events to an existing sequential log file. If the file does not exist, it is created. Use only if you specify system
/// time for the clock resolution, otherwise, ProcessTrace will return events with incorrect time stamps. When using
/// EVENT_TRACE_FILE_MODE_APPEND, the values for BufferSize, NumberOfProcessors, and ClockType must be explicitly provided and
/// must be the same in both the logger and the file being appended.
/// <para>Do not use with EVENT_TRACE_REAL_TIME_MODE, EVENT_TRACE_FILE_MODE_CIRCULAR, EVENT_TRACE_FILE_MODE_NEWFILE, or EVENT_TRACE_PRIVATE_LOGGER_MODE.</para>
/// <para>Windows 2000: This value is not supported.</para>
/// </summary>
EVENT_TRACE_FILE_MODE_APPEND = 0x00000004,
/// <summary>
/// Automatically switches to a new log file when the file reaches the maximum size. The MaximumFileSize member of
/// EVENT_TRACE_PROPERTIES must be set.The specified file name must be a formatted string (for example, the string contains a %d,
/// such as c:\test%d.etl). Each time a new file is created, a counter is incremented and its value is used, the formatted string
/// is updated, and the resulting string is used as the file name.
/// <para>This option is not allowed for private event tracing sessions and should not be used for NT kernel logger sessions.</para>
/// <para>Do not use with EVENT_TRACE_FILE_MODE_CIRCULAR, EVENT_TRACE_FILE_MODE_APPEND or EVENT_TRACE_FILE_MODE_SEQUENTIAL.</para>
/// <para>Windows 2000: This value is not supported.</para>
/// </summary>
EVENT_TRACE_FILE_MODE_NEWFILE = 0x00000008,
/// <summary>
/// Reserves EVENT_TRACE_PROPERTIES.MaximumFileSize bytes of disk space for the log file in advance. The file occupies the entire
/// space during logging, for both circular and sequential log files. When you stop the session, the log file is reduced to the
/// size needed. You must set EVENT_TRACE_PROPERTIES.MaximumFileSize.
/// <para>You cannot use the mode for private event tracing sessions.</para>
/// <para>Windows 2000: This value is not supported.</para>
/// </summary>
EVENT_TRACE_FILE_MODE_PREALLOCATE = 0x00000020,
/// <summary>
/// The logging session cannot be stopped. This mode is only supported by Autologger.This option is supported on Windows Vista
/// and later.
/// </summary>
EVENT_TRACE_NONSTOPPABLE_MODE = 0x00000040,
/// <summary>
/// Restricts who can log events to the session to those with TRACELOG_LOG_EVENT permission. This option is supported on Windows
/// Vista and later.
/// </summary>
EVENT_TRACE_SECURE_MODE = 0X00000080,
/// <summary>
/// Delivers the events to consumers in real-time. Events are delivered when the buffers are flushed, not at the time the
/// provider writes the event. You should not enable real-time mode if there are no consumers to consume the events because calls
/// to log events will eventually fail when the buffers become full. Prior to Windows Vista, if the events were not being
/// consumed, the events were discarded.Do not specify more than one real-time consumer in one process on Windows XP orWindows
/// Server 2003. Instead, have one thread consume events and distribute the events to others.
/// <para>
/// Prior to Windows Vista: You should not use real-time mode because the supported event rate is much lower than reading from
/// the log file (events may be dropped). Also, the event order is not guaranteed on computers with multiple processors. The
/// real-time mode is more suitable for low-traffic, notification type events.
/// </para>
/// <para>
/// You can combine this mode with other log file modes; however, do not use this mode with EVENT_TRACE_PRIVATE_LOGGER_MODE. Note
/// that if you combine this mode with other log file modes, buffers will be flushed once every second, resulting in partially
/// filled buffers being written to your log file. For example if you use 64k buffers and your logging rate is 1 event every
/// second, the service will write 64k/second to your log file.
/// </para>
/// </summary>
EVENT_TRACE_REAL_TIME_MODE = 0x00000100,
/// <summary>
/// This mode is used to delay opening the log file until an event occurs.
/// <para>[!Note]</para>
/// <para>On Windows Vista or later, this mode is not applicable should not be used.</para>
/// </summary>
EVENT_TRACE_DELAY_OPEN_FILE_MODE = 0x00000200,
/// <summary>
/// This mode writes events to a circular memory buffer. Events written beyond the total size of the buffer evict the oldest
/// events still remaining in the buffer. The size of this memory buffer is the product of MinimumBuffers and BufferSize (see
/// EVENT_TRACE_PROPERTIES).As a consequence of this formula, any buffer that uses EVENT_TRACE_BUFFERING_MODE will ignore the
/// MaximumBuffers value.
/// <para>
/// Events are not written to a log file or delivered in real-time, and ETW does not flush the buffers. To get a snapshot of the
/// buffer, call the FlushTrace function.
/// </para>
/// <para>
/// This mode is particularly useful for debugging device drivers in conjunction with the ability to view the contents of
/// in-memory buffers with the WMITrace kernel debugger extension.
/// </para>
/// <para>
/// Do not use with EVENT_TRACE_FILE_MODE_SEQUENTIAL, EVENT_TRACE_FILE_MODE_CIRCULAR, EVENT_TRACE_FILE_MODE_APPEND,
/// EVENT_TRACE_FILE_MODE_NEWFILE, or EVENT_TRACE_REAL_TIME_MODE.
/// </para>
/// </summary>
EVENT_TRACE_BUFFERING_MODE = 0x00000400,
/// <summary>
/// Creates a user-mode event tracing session that runs in the same process as its event trace provider. The memory for buffers
/// comes from the process's memory. Processes that do not require data from the kernel can eliminate the overhead associated
/// with kernel-mode transitions by using a private event tracing session.
/// <para>
/// If the provider is registered by multiple processes, ETW appends the process identifier to the log file name to create a
/// unique log file name. For example, if the controller specifies the log file names as c:\mylogs\myprivatelog.etl, ETW creates
/// the log file as c:\mylogs\myprivatelog.etl_nnnn, where nnnn is the process identifier. The process identifier is not appended
/// to the first process that registers the provider, it is appended to only the subsequent processes that register the provider.
/// </para>
/// <para>Private event tracing sessions have the following limitations:</para>
/// <list type="bullet">
/// <item>A private session can record events only for the threads of the process in which it is executing.</item>
/// <item>There can be up to eight private session per process.</item>
/// <item>Private sessions cannot be used with real-time delivery.</item>
/// <item>
/// Events that are generated by a private session do not include execution time for kernel-mode versus user-mode instructions,
/// or thread-level detail of the CPU time used.
/// </item>
/// </list>
/// <para>
/// Process ID filters and executable name filters can now be passed in to session control APIs when system wide private loggers
/// are started. For the best results in cross process scenarios, the same filters should be passed to every control operation
/// during the session, including provider enable/diasble calls. Note that the filters have the same format as those consumed by EnableTraceEx2.
/// </para>
/// <para>You can use this mode in conjunction with the EVENT_TRACE_PRIVATE_IN_PROC mode.</para>
/// <para>
/// <strong>Prior to Windows 10, version 1703</strong>: Only LocalSystem, the administrator, and users in the administrator group
/// that run in an elevated process can create a private session. If you include the EVENT_TRACE_PRIVATE_IN_PROC flag, any user
/// can create an in-process private session. Also, in prior versions of Windows, there can only be one private session per
/// process (unless the EVENT_TRACE_PRIVATE_IN_PROC mode is also specified, in which case you can create up to three in-process
/// private sessions).
/// </para>
/// <para><strong>Prior to Windows Vista:</strong> Users in the Performance Log Users group could also create a private session.</para>
/// <para>Do not use with EVENT_TRACE_REAL_TIME_MODE.</para>
/// <para><strong>Prior to Windows 7 and Windows Server 2008 R2</strong>: Do not use with EVENT_TRACE_FILE_MODE_NEWFILE.</para>
/// </summary>
EVENT_TRACE_PRIVATE_LOGGER_MODE = 0x00000800,
/// <summary>
/// This option adds a header to the log file.
/// <para>[!Note]</para>
/// <para>On Windows Vista or later, this mode is not applicable should not be used.</para>
/// </summary>
EVENT_TRACE_ADD_HEADER_MODE = 0x00001000,
/// <summary>
/// Use kilobytes as the unit of measure for specifying the size of a file. The default unit of measure is megabytes. This mode
/// applies to the MaxFileSize registry value for an AutoLogger session and the MaximumFileSize member of EVENT_TRACE_PROPERTIES.
/// This option is supported on Windows Vista and later.
/// </summary>
EVENT_TRACE_USE_KBYTES_FOR_SIZE = 0x00002000,
/// <summary>
/// Uses sequence numbers that are unique across event tracing sessions. This mode only applies to events logged using the
/// TraceMessage function. For more information, see TraceMessage for usage details.
/// <para>EVENT_TRACE_USE_GLOBAL_SEQUENCE and EVENT_TRACE_USE_LOCAL_SEQUENCE are mutually exclusive.</para>
/// <para>Windows 2000: This value is not supported.</para>
/// </summary>
EVENT_TRACE_USE_GLOBAL_SEQUENCE = 0x00004000,
/// <summary>
/// Uses sequence numbers that are unique only for an individual event tracing session. This mode only applies to events logged
/// using the TraceMessage function. For more information, see TraceMessage for usage details.
/// <para>EVENT_TRACE_USE_GLOBAL_SEQUENCE and EVENT_TRACE_USE_LOCAL_SEQUENCE are mutually exclusive.</para>
/// <para>Windows 2000: This value is not supported.</para>
/// </summary>
EVENT_TRACE_USE_LOCAL_SEQUENCE = 0x00008000,
/// <summary>
/// Logs the event without including EVENT_TRACE_HEADER.
/// <para>[!Note]</para>
/// <para>This mode should not be used. It is reserved for internal use.</para>
/// <para>Windows 2000: This value is not supported.</para>
/// </summary>
EVENT_TRACE_RELOG_MODE = 0x00010000,
/// <summary>
/// Use in conjunction with the EVENT_TRACE_PRIVATE_LOGGER_MODE mode to start a private session. This mode enforces that only the
/// process that registered the provider GUID can start the logger session with that GUID.
/// <para>You can create up to three in-process private sessions per process.</para>
/// <para>This option is supported on Windows Vista and later.</para>
/// </summary>
EVENT_TRACE_PRIVATE_IN_PROC = 0x00020000,
/// <summary>
/// This option is used to signal heap and critical section tracing. This option is supported on Windows Vista and later.
/// </summary>
EVENT_TRACE_MODE_RESERVED = 0x00100000,
/// <summary>
/// This option stops logging on hybrid shutdown. If neither EVENT_TRACE_STOP_ON_HYBRID_SHUTDOWN or
/// EVENT_TRACE_PERSIST_ON_HYBRID_SHUTDOWN is specified, ETW will chose a default based on whether the caller is coming from
/// Session 0 or not.This option is supported on Windows 8 and Windows Server 2012.
/// </summary>
EVENT_TRACE_STOP_ON_HYBRID_SHUTDOWN = 0x00400000,
/// <summary>
/// This option continues logging on hybrid shutdown. If neither EVENT_TRACE_STOP_ON_HYBRID_SHUTDOWN or
/// EVENT_TRACE_PERSIST_ON_HYBRID_SHUTDOWN is specified, ETW will chose a default based on whether the caller is coming from
/// Session 0 or not.This option is supported on Windows 8 and Windows Server 2012.
/// </summary>
EVENT_TRACE_PERSIST_ON_HYBRID_SHUTDOWN = 0x00800000,
/// <summary>
/// Uses paged memory. This setting is recommended so that events do not use up the nonpaged memory.Nonpaged buffers use nonpaged
/// memory for buffer space. Because nonpaged buffers are never paged out, a logging session performs well. Using pageable
/// buffers is less resource-intensive.
/// <para>Kernel-mode providers and system loggers cannot log events to sessions that specify this logging mode.</para>
/// <para>This mode is ignored if EVENT_TRACE_PRIVATE_LOGGER_MODE is set.</para>
/// <para>You cannot use this mode with the NT Kernel Logger.</para>
/// <para>Windows 2000: This value is not supported.</para>
/// </summary>
EVENT_TRACE_USE_PAGED_MEMORY = 0x01000000,
/// <summary>
/// This option will receive events from SystemTraceProvider. If the StartTraceProperties parameter LogFileMode includes this
/// flag, the logger will be a system logger.This option is supported on Windows 8 and Windows Server 2012.
/// </summary>
EVENT_TRACE_SYSTEM_LOGGER_MODE = 0x02000000,
/// <summary>
/// Indicates that a logging session should not be affected by EventWrite failures in other sessions. Without this flag, if an
/// event cannot be published to one of the sessions that a provider is enabled to, the event will not get published to any of
/// the sessions. When this flag is set, a failure to write an event to one session will not cause the EventWrite function to
/// return an error code in other sessions.
/// <para>Do not use with EVENT_TRACE_PRIVATE_LOGGER_MODE.</para>
/// <para>This option is supported on Windows 8.1, Windows Server 2012 R2, and later.</para>
/// </summary>
EVENT_TRACE_INDEPENDENT_SESSION_MODE = 0x08000000,
/// <summary>
/// Writes events that were logged on different processors to a common buffer. Using this mode can eliminate the issue of events
/// appearing out of order when events are being published on different processors using system time. This mode can also
/// eliminate the issue with circular logs appearing to drop events on multiple processor computers.
/// <para>
/// If you do not use this mode and you use system time, the events may appear out of order on multiple processor computers. This
/// is because ETW buffers are associated with a processor instead of a thread. As a result, if a thread is switched from one CPU
/// to another, the buffer associated with the latter CPU can be flushed to disk before the one associated with the former CPU.
/// </para>
/// <para>If you expect a high volume of events (for example, more than 1,000 events per second), you should not use this mode.</para>
/// <para>Note that the processor number is not included with the event.</para>
/// <para>This option is supported on Windows 7, Windows Server 2008 R2, and later.</para>
/// </summary>
EVENT_TRACE_NO_PER_PROCESSOR_BUFFERING = 0x10000000,
/// <summary>This option adds ETW buffers to triage dumps. This option is supported on Windows 8 and Windows Server 2012.</summary>
EVENT_TRACE_ADDTO_TRIAGE_DUMP = 0x80000000,
}
/// <summary>Defines constant values that indicate if the map is a value map, bitmap, or pattern map.</summary>
/// <remarks>The following MOF example shows the flags that are set based on the WMI property attributes used.</remarks>
// https://docs.microsoft.com/en-us/windows/win32/api/tdh/ne-tdh-map_flags typedef enum _MAP_FLAGS {
// EVENTMAP_INFO_FLAG_MANIFEST_VALUEMAP, EVENTMAP_INFO_FLAG_MANIFEST_BITMAP, EVENTMAP_INFO_FLAG_MANIFEST_PATTERNMAP,
// EVENTMAP_INFO_FLAG_WBEM_VALUEMAP, EVENTMAP_INFO_FLAG_WBEM_BITMAP, EVENTMAP_INFO_FLAG_WBEM_FLAG, EVENTMAP_INFO_FLAG_WBEM_NO_MAP } MAP_FLAGS;
[PInvokeData("tdh.h", MSDNShortId = "3fc6935a-328a-4df3-8c2f-cd634d94ca16")]
public enum MAP_FLAGS
{
/// <summary>The manifest value map maps integer values to strings. For details, see the MapType complex type.</summary>
EVENTMAP_INFO_FLAG_MANIFEST_VALUEMAP,
/// <summary>The manifest value map maps bit values to strings. For details, see the MapType complex type.</summary>
EVENTMAP_INFO_FLAG_MANIFEST_BITMAP,
/// <summary>
/// The manifest value map uses regular expressions to map one name to another name. For details, see the PatternMapType complex type.
/// </summary>
EVENTMAP_INFO_FLAG_MANIFEST_PATTERNMAP,
/// <summary>The WMI value map maps integer values to strings. For details, see ValueMap and Value Qualifiers.</summary>
EVENTMAP_INFO_FLAG_WBEM_VALUEMAP,
/// <summary>The WMI value map maps bit values to strings. For details, see BitMap and BitValue Qualifiers.</summary>
EVENTMAP_INFO_FLAG_WBEM_BITMAP,
/// <summary>
/// This flag can be combined with the EVENTMAP_INFO_FLAG_WBEM_VALUEMAP flag to indicate that the ValueMap qualifier contains bit
/// (flag) values instead of index values.
/// </summary>
EVENTMAP_INFO_FLAG_WBEM_FLAG,
/// <summary>
/// This flag can be combined with the EVENTMAP_INFO_FLAG_WBEM_VALUEMAP or EVENTMAP_INFO_FLAG_WBEM_BITMAP flag to indicate that
/// the MOF class property contains a BitValues or Values qualifier but does not contain the BitMap or ValueMap qualifier.
/// </summary>
EVENTMAP_INFO_FLAG_WBEM_NO_MAP,
}
/// <summary>Defines if the value map value is in a ULONG data type or a string.</summary>
// https://docs.microsoft.com/en-us/windows/win32/api/tdh/ne-tdh-map_valuetype typedef enum _MAP_VALUETYPE {
// EVENTMAP_ENTRY_VALUETYPE_ULONG, EVENTMAP_ENTRY_VALUETYPE_STRING } MAP_VALUETYPE;
[PInvokeData("tdh.h", MSDNShortId = "a17e5214-29d3-465f-9785-0cc8965a42c9")]
public enum MAP_VALUETYPE
{
/// <summary>Use the Value member of EVENT_MAP_ENTRY to access the map value.</summary>
EVENTMAP_ENTRY_VALUETYPE_ULONG,
/// <summary>Use the InputOffset member of EVENT_MAP_ENTRY to access the map value.</summary>
EVENTMAP_ENTRY_VALUETYPE_STRING,
}
/// <summary>Modes for processing events.</summary>
[PInvokeData("Evntcons.h", MSDNShortId = "179451e9-7e3c-4d3a-bcc6-3ad9d382229a")]
[Flags]
public enum PROCESS_TRACE_MODE : uint
{
/// <summary>Specify this mode to receive events in real time (you must specify this mode if LoggerName is not NULL).</summary>
PROCESS_TRACE_MODE_REAL_TIME = 0x00000100,
/// <summary>
/// Specify this mode if you do not want the time stamp value in the TimeStamp member of EVENT_HEADER and EVENT_TRACE_HEADER
/// converted to system time (leaves the time stamp value in the resolution that the controller specified in the
/// Wnode.ClientContext member of EVENT_TRACE_PROPERTIES). Prior to Windows Vista: Not supported.
/// </summary>
PROCESS_TRACE_MODE_RAW_TIMESTAMP = 0x00001000,
/// <summary>
/// Specify this mode if you want to receive events in the new EVENT_RECORD format. To receive events in the new format you must
/// specify a callback in the EventRecordCallback member. If you do not specify this mode, you receive events in the old format
/// through the callback specified in the EventCallback member. Prior to Windows Vista: Not supported.
/// </summary>
PROCESS_TRACE_MODE_EVENT_RECORD = 0x10000000,
}
/// <summary>Defines if the property is contained in a structure or array.</summary>
// https://docs.microsoft.com/en-us/windows/win32/api/tdh/ne-tdh-property_flags typedef enum _PROPERTY_FLAGS { PropertyStruct,
// PropertyParamLength, PropertyParamCount, PropertyWBEMXmlFragment, PropertyParamFixedLength, PropertyParamFixedCount,
// PropertyHasTags, PropertyHasCustomSchema } PROPERTY_FLAGS;
[PInvokeData("tdh.h", MSDNShortId = "517c1662-4230-44dc-94f0-a1996291bbee")]
public enum PROPERTY_FLAGS
{
/// <summary>The property information is contained in the structType member of the EVENT_PROPERTY_INFO structure.</summary>
PropertyStruct,
/// <summary>
/// Use the lengthPropertyIndex member of the EVENT_PROPERTY_INFO structure to locate the property that contains the length value
/// of the property.
/// </summary>
PropertyParamLength,
/// <summary>
/// Use the countPropertyIndex member of the EVENT_PROPERTY_INFO structure to locate the property that contains the size of the array.
/// </summary>
PropertyParamCount,
/// <summary>
/// Indicates that the MOF data is in XML format (the event data contains within itself a fully-rendered XML description). This
/// flag is set if the MOF property contains the XMLFragment qualifier.
/// </summary>
PropertyWBEMXmlFragment,
/// <summary>
/// Indicates that the length member of the EVENT_PROPERTY_INFO structure contains a fixed length, e.g. as specified in the
/// provider manifest with &lt;data length="12" … /&gt;. This flag will not be set for a variable-length field, e.g. &lt;data
/// length="LengthField" … /&gt;, nor will this flag be set for fields where the length is not specified in the manifest, e.g.
/// int32 or null-terminated string. As an example, if PropertyParamLength is unset, length is 0, and InType is
/// TDH_INTYPE_UNICODESTRING, we must check the PropertyParamFixedLength flag to determine the length of the string. If
/// PropertyParamFixedLength is set, the string length is fixed at 0. If PropertyParamFixedLength is unset, the string is null-terminated.
/// </summary>
PropertyParamFixedLength,
/// <summary>
/// Indicates that the count member of the EVENT_PROPERTY_INFO structure contains a fixed array count, e.g. as specified in the
/// provider manifest with &lt;data count="12" … /&gt;. This flag will not be set for a variable-length array, e.g. &lt;data
/// count="ArrayCount" … /&gt;, nor will this flag be set for non-array fields. As an example, if PropertyParamCount is unset and
/// count is 1, PropertyParamFixedCount flag must be checked to determine whether the field is a scalar value or a single-element
/// array. If PropertyParamFixedCount is set, the field is a single-element array. If PropertyParamFixedCount is unset, the field
/// is a scalar value, not an array.
/// </summary>
PropertyParamFixedCount,
/// <summary>Indicates that the Tags field contains valid field tag data.</summary>
PropertyHasTags,
/// <summary>Indicates that the Type is described with a custom schema.</summary>
PropertyHasCustomSchema,
}
/// <summary>Defines the context type.</summary>
/// <remarks>
/// If you are specifying context information for a legacy ETW event, you only need to specify the TDH_CONTEXT_POINTERSIZE type—the
/// other types are used for WPP events and are ignored for legacy ETW events.
/// </remarks>
// https://docs.microsoft.com/en-us/windows/win32/api/tdh/ne-tdh-tdh_context_type typedef enum _TDH_CONTEXT_TYPE {
// TDH_CONTEXT_WPP_TMFFILE, TDH_CONTEXT_WPP_TMFSEARCHPATH, TDH_CONTEXT_WPP_GMT, TDH_CONTEXT_POINTERSIZE, TDH_CONTEXT_PDB_PATH,
// TDH_CONTEXT_MAXIMUM } TDH_CONTEXT_TYPE;
[PInvokeData("tdh.h", MSDNShortId = "7892f0d2-84f6-4543-b94e-8501e3911266")]
public enum TDH_CONTEXT_TYPE
{
/// <summary>
/// Null-terminated Unicode string that contains the name of the .tmf file used for parsing the WPP log. Typically, the .tmf file
/// name is picked up from the event GUID so you do not have to specify the file name.
/// </summary>
TDH_CONTEXT_WPP_TMFFILE,
/// <summary>
/// Null-terminated Unicode string that contains the path to the .tmf file. You do not have to specify this path if the search
/// path contains the file. Only specify this context information if you also specify the TDH_CONTEXT_WPP_TMFFILE context type.
/// If the file is not found, TDH searches the following locations in the given order:
/// </summary>
TDH_CONTEXT_WPP_TMFSEARCHPATH,
/// <summary>
/// A 1-byte Boolean flag that indicates if the WPP event time stamp should be converted to Universal Time Coordinate (UTC). If
/// 1, the time stamp is converted to UTC. If 0, the time stamp is in local time. By default, the time stamp is in local time.
/// </summary>
TDH_CONTEXT_WPP_GMT,
/// <summary>
/// Size, in bytes, of the pointer data types or size_t data types used in the event. Indicates if the event used 4-byte or
/// 8-byte values. By default, the pointer size is the pointer size of the decoding computer. To determine the size of the
/// pointer or size_t value, use the PointerSize member of TRACE_LOGFILE_HEADER (the first event you receive in your
/// EventRecordCallback callback contains this header in the data section). However, this value may not be accurate. For example,
/// on a 64-bit computer, a 32-bit application will log 4-byte pointers; however, the session will set PointerSize to 8.
/// </summary>
TDH_CONTEXT_POINTERSIZE,
/// <summary>
/// Null-terminated Unicode string that contains the name of the .pdb file for the binary that contains WPP messages. This
/// parameter can be used as an alternative to TDH_CONTEXT_WPP_TMFFILE or TDH_CONTEXT_WPP_TMFSEARCHPATH.
/// </summary>
TDH_CONTEXT_PDB_PATH,
}
/// <summary>Provider-defined value that specifies the level of information the event generates.</summary>
[PInvokeData("evntrace.h", MSDNShortId = "d75f18e1-e5fa-4039-bb74-76dea334b0fd")]
public enum TRACE_LEVEL : byte
{
/// <summary>Abnormal exit or termination events</summary>
TRACE_LEVEL_CRITICAL = 1,
/// <summary>Severe error events</summary>
TRACE_LEVEL_ERROR = 2,
/// <summary>Warning events such as allocation failures</summary>
TRACE_LEVEL_WARNING = 3,
/// <summary>Non-error events such as entry or exit events</summary>
TRACE_LEVEL_INFORMATION = 4,
/// <summary>Detailed trace events</summary>
TRACE_LEVEL_VERBOSE = 5,
}
/// <summary>Adds additional information to the beginning of the provider-specific data section of the event.</summary>
[PInvokeData("Evntrace.h", MSDNShortId = "5d81c851-d47e-43f8-97b0-87156f36119a")]
[Flags]
public enum TRACE_MESSAGE : uint
{
/// <summary>
/// Include a sequence number in the message. The sequence number starts at one. To use this flag, the controller must have set
/// the EVENT_TRACE_USE_GLOBAL_SEQUENCE or EVENT_TRACE_USE_LOCAL_SEQUENCE log file mode when creating the session.
/// </summary>
TRACE_MESSAGE_SEQUENCE = 1,
/// <summary>
/// Include the event trace class GUID in the message. The MessageGuid parameter contains the event trace class GUID.
/// </summary>
TRACE_MESSAGE_GUID = 2,
/// <summary>Include the component identifier in the message. The MessageGuid parameter contains the component identifier.</summary>
TRACE_MESSAGE_COMPONENTID = 4,
/// <summary>Include a time stamp in the message.</summary>
TRACE_MESSAGE_TIMESTAMP = 8,
/// <summary/>
TRACE_MESSAGE_PERFORMANCE_TIMESTAMP = 16,
/// <summary>Include the thread identifier and process identifier in the message.</summary>
TRACE_MESSAGE_SYSTEMINFO = 32,
/// <summary/>
TRACE_MESSAGE_POINTER32 = 0x0040,
/// <summary/>
TRACE_MESSAGE_POINTER64 = 0x0080,
/// <summary/>
TRACE_MESSAGE_FLAG_MASK = 0xFFFF,
}
/// <summary>Flags used by <c>TRACE_PROVIDER_INSTANCE_INFO</c>.</summary>
[PInvokeData("evntrace.h", MSDNShortId = "49c11cd5-2cb1-474a-8b51-2d86b4501da1")]
public enum TRACE_PROVIDER_FLAG
{
/// <summary>The provider used RegisterTraceGuids instead of EventRegister to register itself.</summary>
TRACE_PROVIDER_FLAG_LEGACY = 1,
/// <summary>The provider is not registered; however, one or more sessions have enabled the provider.</summary>
TRACE_PROVIDER_FLAG_PRE_ENABLE
}
/// <summary>Determines the type of information to include with the trace.</summary>
/// <remarks>
/// The <c>TRACE_INFO_CLASS</c> and <c>TRACE_QUERY_INFO_CLASS</c> enumerations both define the same values. Use both enumerations
/// with the EnumerateTraceGuidsEx function or the TraceSetInformation function.
/// </remarks>
// https://docs.microsoft.com/en-us/windows/desktop/api/evntrace/ne-evntrace-trace_query_info_class typedef enum
// _TRACE_QUERY_INFO_CLASS { TraceGuidQueryList, TraceGuidQueryInfo, TraceGuidQueryProcess, TraceStackTracingInfo,
// TraceSystemTraceEnableFlagsInfo, TraceSampledProfileIntervalInfo, TraceProfileSourceConfigInfo, TraceProfileSourceListInfo,
// TracePmcEventListInfo, TracePmcCounterListInfo, TraceSetDisallowList, TraceVersionInfo, TraceGroupQueryList, TraceGroupQueryInfo,
// TraceDisallowListQuery, TraceInfoReserved15, TracePeriodicCaptureStateListInfo, TracePeriodicCaptureStateInfo,
// TraceProviderBinaryTracking, TraceMaxLoggersQuery, MaxTraceSetInfoClass, TraceLbrConfigurationInfo, TraceLbrEventListInfo,
// TraceMaxPmcCounterQuery } TRACE_QUERY_INFO_CLASS, TRACE_INFO_CLASS;
[PInvokeData("evntrace.h", MSDNShortId = "b163e120-454a-48ba-93a9-71351fc3f2c2")]
public enum TRACE_QUERY_INFO_CLASS
{
/// <summary>Query an array of GUIDs of the providers that are registered on the computer.</summary>
[CorrespondingType(typeof(Guid[]), CorrespondingAction.Get)]
TraceGuidQueryList,
/// <summary>Query information that each session used to enable the provider.</summary>
[CorrespondingType(typeof(TRACE_GUID_INFO), CorrespondingAction.Get)]
TraceGuidQueryInfo,
/// <summary>Query an array of GUIDs of the providers that registered themselves in the same process as the calling process.</summary>
[CorrespondingType(typeof(Guid[]), CorrespondingAction.Get)]
TraceGuidQueryProcess,
/// <summary>
/// Query the setting for call stack tracing for kernel events. The value is supported on Windows 7, Windows Server 2008 R2, and later.
/// </summary>
[CorrespondingType(typeof(CLASSIC_EVENT_ID[]), CorrespondingAction.Set)]
TraceStackTracingInfo,
/// <summary>
/// Query the setting for the EnableFlags for the system trace provider. For more information, see the EVENT_TRACE_PROPERTIES
/// structure. The value is supported on Windows 8, Windows Server 2012, and later.
/// </summary>
[CorrespondingType(typeof(EVENT_TRACE_FLAG[]), CorrespondingAction.Set)]
TraceSystemTraceEnableFlagsInfo,
/// <summary>
/// Queries the setting for the sampling profile interval for the supplied source. The value is supported on Windows 8, Windows
/// Server 2012, and later.
/// </summary>
[CorrespondingType(typeof(TRACE_PROFILE_INTERVAL), CorrespondingAction.GetSet)]
TraceSampledProfileIntervalInfo,
/// <summary>Sets a list of sources to be used for PMC Profiling system-wide.</summary>
[CorrespondingType(typeof(uint[]), CorrespondingAction.Set)]
TraceProfileSourceConfigInfo,
/// <summary>
/// Query the setting for sampled profile list information. The value is supported on Windows 8, Windows Server 2012, and later.
/// </summary>
[CorrespondingType(typeof(PROFILE_SOURCE_INFO[]), CorrespondingAction.Get)]
TraceProfileSourceListInfo,
/// <summary>
/// Query the setting for sampled profile list information. The value is supported on Windows 8, Windows Server 2012, and later.
/// </summary>
[CorrespondingType(typeof(CLASSIC_EVENT_ID[]), CorrespondingAction.Set)]
TracePmcEventListInfo,
/// <summary>
/// Query the list of performance monitoring counters to collect The value is supported on Windows 8, Windows Server 2012, and later.
/// </summary>
[CorrespondingType(typeof(uint[]), CorrespondingAction.Set)]
TracePmcCounterListInfo,
// TraceSetDisallowList:
// - TraceSetInformation Sets a list of provider GUIDs that should not be enabled via Provider Groups on the specified logging session.
//
// Input Format: An array of GUIDs.
/// <summary/>
[CorrespondingType(typeof(Guid[]), CorrespondingAction.Set)]
TraceSetDisallowList = 10,
// TraceVersionInfo:
// - TraceQueryInformation Queries the version number of the trace processing code.
//
// Output Format: TRACE_VERSION_INFO
/// <summary>Query the trace file version information. The value is supported on Windows 10.</summary>
[CorrespondingType(typeof(TRACE_VERSION_INFO), CorrespondingAction.Get)]
TraceVersionInfo,
// TraceGroupQueryList:
// - EnumerateTraceGuidsEx. Returns a list of Group GUIDs that are currently known to the kernel.
//
// Input Format: None. Output Format: An array of GUIDs.
/// <summary/>
[CorrespondingType(typeof(Guid[]), CorrespondingAction.Get)]
TraceGroupQueryList,
// TraceGroupQueryInfo:
// - EnumerateTraceGuidsEx. Returns the current enablement information and list of member providers for the input Group GUID.
//
// Input Format: GUID Output Format: a) ULONG - Length of the following TRACE_ENABLE_INFO array.
// b) Array of TRACE_ENABLE_INFO. Size of the array is inferred from (a)
// c) ULONG - Count of the Number of Unique Providers that belong to this Group
// d) Array of GUID - Size of the array is specified by (c)
//
// PseudoStructure - struct TRACE_GROUP_INFO { ULONG TraceEnableInfoSize; TRACE_ENABLE_INFO
// TraceEnableInfos[TraceEnableInfoSize]; ULONG GuidArraySize; GUID UniqueProviders[GuidArraySize]; }
/// <summary/>
[CorrespondingType(typeof(IntPtr), CorrespondingAction.Get)]
TraceGroupQueryInfo,
// TraceDisallowListQuery:
// - TraceQueryInformation Queries the list of provider GUIDs that should not be enabled via Provider Groups on the specified
// logging session.
//
// Output Format: An array of GUIDs.
/// <summary/>
[CorrespondingType(typeof(Guid[]), CorrespondingAction.Get)]
TraceDisallowListQuery,
/// <summary/>
TraceInfoReserved15,
// TracePeriodicCaptureStateListInfo:
// - TraceSetInformation Sets the list of providers for which capture stat should be collected at periodic time intervals for the
// specified logging session. If a NULL input buffer is specified, then the current periodic capture state settings are cleared.
//
// Input Format: TRACE_PERIODIC_CAPTURE_STATE_INFO followed by an array of ProviderCount Provider GUIDs. Or a NULL Buffer.
/// <summary/>
[CorrespondingType(typeof(TRACE_PERIODIC_CAPTURE_STATE_INFO), CorrespondingAction.Set)]
TracePeriodicCaptureStateListInfo,
// TracePeriodicCaptureStatInfo:
// - TraceQueryInformation Queries the limits of periodic capture settings on this system, including the minimum time frequency
// and the maximum number of providers that can be enabled for periodic capture state.
//
// Output Format: TRACE_PERIODIC_CAPTURE_STATE_INFO
/// <summary/>
[CorrespondingType(typeof(TRACE_PERIODIC_CAPTURE_STATE_INFO), CorrespondingAction.Get)]
TracePeriodicCaptureStateInfo,
// TraceProviderBinaryTracking:
// - TraceSetInformation Instructs ETW to begin tracking binaries for all providers that are enabled to the session. The tracking
// applies retroactively for providers that were enabled to the session prior to the call, as well as for all future providers
// that are enabled to the session.
//
// ETW fabricates tracking events for these tracked providers that contain a mapping between provider GUID(s). ETW also
// fabricates the file path that describes where the registered provider is located on disk. If the session is in realtime, the
// events are provided live in the realtime buffers. If the session is file-based (i.e. trace is saved to an .etl file), the
// events are aggregated and written to the file header; they will be among some of the first events the ETW runtime provides
// when the .etl file is played back.
//
// The binary tracking events will come from the EventTraceGuid provider, with an opcode of WMI_LOG_TYPE_BINARY_PATH.
//
// Input Format: BOOLEAN (The 1-byte type, rather than the 4-byte BOOL.) True to turn tracking on. False to turn tracking off.
/// <summary/>
[CorrespondingType(typeof(byte), CorrespondingAction.Set)]
TraceProviderBinaryTracking,
// TraceMaxLoggersQuery:
// - TraceQueryInformation Queries the maximum number of system-wide loggers that can be running at a time on this system.
//
// Output Format: ULONG
/// <summary>
/// Queries the currently-configured maximum number of system loggers allowed by the operating system. Returns a ULONG. Used with
/// EnumerateTraceGuidsEx. The value is supported on Windows 10, version 1709 and later.
/// </summary>
[CorrespondingType(typeof(uint), CorrespondingAction.Get)]
TraceMaxLoggersQuery,
// TraceLbrConfigurationInfo:
// - TraceSetInformation Sets a bitfield of configuration options for Last Branch Record tracing.
//
// Input Format: ULONG
/// <summary/>
[CorrespondingType(typeof(uint), CorrespondingAction.Set)]
TraceLbrConfigurationInfo,
// TraceLbrEventListInfo:
// - TraceSetInformation Provides a list of kernel events to collect Last Branch Records on. The events are specified by their HookIds.
//
// Input Format: An array of ULONGs
/// <summary/>
[CorrespondingType(typeof(uint[]), CorrespondingAction.Set)]
TraceLbrEventListInfo,
// TraceMaxPmcCounterQuery:
// - TraceQueryInformation Queries the maximum number of PMC counters supported on this platform
//
// Output Format: ULONG
/// <summary/>
[CorrespondingType(typeof(uint), CorrespondingAction.Get)]
TraceMaxPmcCounterQuery,
}
/// <summary>Specific rights for WMI guid objects.</summary>
[PInvokeData("evntcons.h", MSDNShortId = "699bb165-680f-4d3b-8859-959f319ca4be")]
[Flags]
public enum TRACELOG_RIGHTS : uint
{
/// <summary>Allows the user to query information about the trace session. Set this permission on the session's GUID.</summary>
WMIGUID_QUERY = 0x0001,
/// <summary></summary>
WMIGUID_SET = 0x0002,
/// <summary></summary>
WMIGUID_NOTIFICATION = 0x0004,
/// <summary></summary>
WMIGUID_READ_DESCRIPTION = 0x0008,
/// <summary></summary>
WMIGUID_EXECUTE = 0x0010,
/// <summary>Allows the user to start or update a real-time session. Set this permission on the session's GUID.</summary>
TRACELOG_CREATE_REALTIME = 0x0020,
/// <summary>
/// Allows the user to start or update a session that writes events to a log file. Set this permission on the session's GUID.
/// </summary>
TRACELOG_CREATE_ONDISK = 0x0040,
/// <summary>Allows the user to enable the provider. Set this permission on the provider's GUID.</summary>
TRACELOG_GUID_ENABLE = 0x0080,
/// <summary>Not used.</summary>
TRACELOG_ACCESS_KERNEL_LOGGER = 0x0100,
/// <summary>
/// Allows the user to log events to a trace session if session is running in SECURE mode (the session set the
/// EVENT_TRACE_SECURE_MODE flag in the LogFileMode member of EVENT_TRACE_PROPERTIES).
/// </summary>
TRACELOG_LOG_EVENT = 0x0200,
/// <summary></summary>
TRACELOG_CREATE_INPROC = 0x0200,
/// <summary>Allows a user to consume events in real-time. Set this permission on the session's GUID.</summary>
TRACELOG_ACCESS_REALTIME = 0x0400,
/// <summary>Allows the user to register the provider. Set this permission on the provider's GUID.</summary>
TRACELOG_REGISTER_GUIDS = 0x0800,
/// <summary></summary>
TRACELOG_JOIN_GROUP = 0x1000,
}
/// <summary>Request code.</summary>
[PInvokeData("wmistr.h")]
public enum WMIDPREQUESTCODE
{
/// <summary/>
WMI_GET_ALL_DATA = 0,
/// <summary/>
WMI_GET_SINGLE_INSTANCE = 1,
/// <summary/>
WMI_SET_SINGLE_INSTANCE = 2,
/// <summary/>
WMI_SET_SINGLE_ITEM = 3,
/// <summary>Enables the provider.</summary>
WMI_ENABLE_EVENTS = 4,
/// <summary>Disables the provider.</summary>
WMI_DISABLE_EVENTS = 5,
/// <summary/>
WMI_ENABLE_COLLECTION = 6,
/// <summary/>
WMI_DISABLE_COLLECTION = 7,
/// <summary/>
WMI_REGINFO = 8,
/// <summary/>
WMI_EXECUTE_METHOD = 9,
/// <summary/>
WMI_CAPTURE_STATE = 10
}
/// <summary/>
[Flags]
public enum WNODE_FLAG : uint
{
/// <summary/>
WNODE_FLAG_ALL_DATA = 0x00000001,
/// <summary/>
WNODE_FLAG_SINGLE_INSTANCE = 0x00000002,
/// <summary/>
WNODE_FLAG_SINGLE_ITEM = 0x00000004,
/// <summary/>
WNODE_FLAG_EVENT_ITEM = 0x00000008,
/// <summary/>
WNODE_FLAG_FIXED_INSTANCE_SIZE = 0x00000010,
/// <summary/>
WNODE_FLAG_TOO_SMALL = 0x00000020,
/// <summary/>
WNODE_FLAG_INSTANCES_SAME = 0x00000040,
/// <summary/>
WNODE_FLAG_STATIC_INSTANCE_NAMES = 0x00000080,
/// <summary/>
WNODE_FLAG_INTERNAL = 0x00000100,
/// <summary/>
WNODE_FLAG_USE_TIMESTAMP = 0x00000200,
/// <summary/>
WNODE_FLAG_PERSIST_EVENT = 0x00000400,
/// <summary/>
WNODE_FLAG_EVENT_REFERENCE = 0x00002000,
/// <summary/>
WNODE_FLAG_ANSI_INSTANCENAMES = 0x00004000,
/// <summary/>
WNODE_FLAG_METHOD_ITEM = 0x00008000,
/// <summary/>
WNODE_FLAG_PDO_INSTANCE_NAMES = 0x00010000,
/// <summary/>
WNODE_FLAG_TRACED_GUID = 0x00020000,
/// <summary/>
WNODE_FLAG_LOG_WNODE = 0x00040000,
/// <summary/>
WNODE_FLAG_USE_GUID_PTR = 0x00080000,
/// <summary/>
WNODE_FLAG_USE_MOF_PTR = 0x00100000,
/// <summary/>
WNODE_FLAG_NO_HEADER = 0x00200000,
/// <summary/>
WNODE_FLAG_SEND_DATA_BLOCK = 0x00400000,
/// <summary/>
WNODE_FLAG_VERSIONED_PROPERTIES = 0x00800000,
/// <summary/>
WNODE_FLAG_SEVERITY_MASK = 0xff000000,
}
/// <summary>The <c>CloseTrace</c> function closes a trace.</summary>
/// <param name="TraceHandle">Handle to the trace to close. The <c>OpenTrace</c> function returns this handle.</param>
/// <returns>
/// <para>If the function succeeds, the return value is ERROR_SUCCESS.</para>
/// <para>
/// If the function fails, the return value is one of the system error codes. The following table includes some common errors and
/// their causes.
/// </para>
/// <list type="table">
/// <listheader>
/// <term>Return code</term>
/// <term>Description</term>
/// </listheader>
/// <item>
/// <term>ERROR_INVALID_HANDLE</term>
/// <term>One of the following is true:</term>
/// </item>
/// <item>
/// <term>ERROR_BUSY</term>
/// <term>Prior to Windows Vista, you cannot close the trace until the ProcessTrace function completes.</term>
/// </item>
/// <item>
/// <term>ERROR_CTX_CLOSE_PENDING</term>
/// <term>
/// The call was successful. The ProcessTrace function will stop after it has processed all real-time events in its buffers (it will
/// not receive any new events).
/// </term>
/// </item>
/// </list>
/// </returns>
/// <remarks>
/// <para>Consumers call this function.</para>
/// <para>
/// If you are processing events from a log file, you call this function only after the <c>ProcessTrace</c> function returns.
/// However, if you are processing real-time events, you can call this function before <c>ProcessTrace</c> returns. If you call this
/// function before <c>ProcessTrace</c> returns, the <c>CloseTrace</c> function returns ERROR_CTX_CLOSE_PENDING. The
/// ERROR_CTX_CLOSE_PENDING code indicates that the <c>CloseTrace</c> function call was successful; the <c>ProcessTrace</c> function
/// will stop processing events after it processes all events in its buffers ( <c>ProcessTrace</c> will not receive any new events
/// after you call the <c>CloseTrace</c> function). You can call the <c>CloseTrace</c> function from your BufferCallback,
/// EventCallback, or EventClassCallback callback.
/// </para>
/// <para><c>Prior to Windows Vista:</c> You can call <c>CloseTrace</c> only after <c>ProcessTrace</c> returns.</para>
/// </remarks>
// https://docs.microsoft.com/en-us/windows/desktop/etw/closetrace ULONG CloseTrace( _In_ TRACEHANDLE TraceHandle );
[DllImport(Lib.AdvApi32, SetLastError = false, ExactSpelling = true)]
[PInvokeData("evntrace.h", MSDNShortId = "25f4c4d3-0b70-40fe-bf03-8f9ffd82fbec")]
public static extern Win32Error CloseTrace(TRACEHANDLE TraceHandle);
/// <summary>The <c>ControlTrace</c> function flushes, queries, updates, or stops the specified event tracing session.</summary>
/// <param name="SessionHandle">
/// Handle to an event tracing session, or <c>NULL</c>. You must specify SessionHandle if SessionName is <c>NULL</c>. However, ETW
/// ignores the handle if SessionName is not <c>NULL</c>. The handle is returned by the <c>StartTrace</c> function.
/// </param>
/// <param name="SessionName">
/// <para>Name of an event tracing session, or <c>NULL</c>. You must specify SessionName if SessionHandle is <c>NULL</c>.</para>
/// <para>To specify the NT Kernel Logger session, set SessionName to <c>KERNEL_LOGGER_NAME</c>.</para>
/// </param>
/// <param name="Properties">
/// <para>Pointer to an initialized <c>EVENT_TRACE_PROPERTIES</c> structure. This structure should be zeroed out before it is used.</para>
/// <para>
/// If ControlCode specifies <c>EVENT_TRACE_CONTROL_STOP</c>, <c>EVENT_TRACE_CONTROL_QUERY</c> or <c>EVENT_TRACE_CONTROL_FLUSH</c>,
/// you only need to set the <c>Wnode.BufferSize</c>, <c>Wnode.Guid</c>, <c>LoggerNameOffset</c>, and <c>LogFileNameOffset</c>
/// members of the <c>EVENT_TRACE_PROPERTIES</c> structure. If the session is a private session, you also need to set
/// <c>LogFileMode</c>. You can use the maximum session name (1024 characters) and maximum log file name (1024 characters) lengths to
/// calculate the buffer size and offsets if not known.
/// </para>
/// <para>
/// If ControlCode specifies <c>EVENT_TRACE_CONTROL_UPDATE</c>, on input, the members must specify the new values for the properties
/// to update. On output, Properties contains the properties and statistics for the event tracing session. You can update the
/// following properties.
/// </para>
/// <list type="table">
/// <listheader>
/// <term>Member</term>
/// <term>Use</term>
/// </listheader>
/// <item>
/// <term>EnableFlags</term>
/// <term>
/// Set this member to 0 to disable all kernel providers. Otherwise, you must specify the kernel providers that you want to enable or
/// keep enabled. Applies only to NT Kernel Logger sessions.
/// </term>
/// </item>
/// <item>
/// <term>FlushTimer</term>
/// <term>
/// Set this member if you want to change the time to wait before flushing buffers. If this member is 0, the member is not updated.
/// </term>
/// </item>
/// <item>
/// <term>LogFileNameOffset</term>
/// <term>
/// Set this member if you want to switch to another log file. If this member is 0, the file name is not updated. If the offset is
/// not zero and you do not change the log file name, the function returns an error.
/// </term>
/// </item>
/// <item>
/// <term>LogFileMode</term>
/// <term>
/// Set this member if you want to turn EVENT_TRACE_REAL_TIME_MODE on and off. To turn real time consuming off, set this member to 0.
/// To turn real time consuming on, set this member to EVENT_TRACE_REAL_TIME_MODE and it will be OR'd with the current modes.
/// </term>
/// </item>
/// <item>
/// <term>MaximumBuffers</term>
/// <term>
/// Set this member if you want to change the maximum number of buffers that ETW uses. If this member is 0, the member is not updated.
/// </term>
/// </item>
/// </list>
/// <para>For private logger sessions, you can update only the <c>LogFileNameOffset</c> and <c>FlushTimer</c> members.</para>
/// <para>
/// If you are using a newly initialized <c>EVENT_TRACE_PROPERTIES</c> structure, the only members you need to specify, other than
/// the members you are updating, are <c>Wnode.BufferSize</c>, <c>Wnode.Guid</c>, and <c>Wnode.Flags</c>.
/// </para>
/// <para>
/// If you use the property structure you passed to <c>StartTrace</c>, make sure the <c>LogFileNameOffset</c> member is 0 unless you
/// are changing the log file name.
/// </para>
/// <para>
/// If you call the <c>ControlTrace</c> function to query the current session properties and then update those properties to update
/// the session, make sure you set <c>LogFileNameOffset</c> to 0 (unless you are changing the log file name) and set
/// <c>EVENT_TRACE_PROPERTIES.Wnode.Flags</c> to <c>WNODE_FLAG_TRACED_GUID</c>.
/// </para>
/// <para>
/// <c>Starting with Windows 10, version 1703:</c> For better performance in cross process scenarios, you can now pass filtering in
/// to <c>ControlTrace</c> for system wide private loggers. You will need to pass in the new <c>EVENT_TRACE_PROPERTIES_V2</c>
/// structure to include filtering information. See Configuring and Starting a Private Logger Session for more details.
/// </para>
/// </param>
/// <param name="ControlCode">
/// <para>Requested control function. You can specify one of the following values.</para>
/// <list type="table">
/// <listheader>
/// <term>Value</term>
/// <term>Meaning</term>
/// </listheader>
/// <item>
/// <term>EVENT_TRACE_CONTROL_FLUSH</term>
/// <term>
/// Flushes the session's active buffers. Typically, you do not need to flush buffers yourself. However, you may want to flush
/// buffers if the event rate is low and you are delivering events in real time. Windows 2000: This value is not supported.
/// </term>
/// </item>
/// <item>
/// <term>EVENT_TRACE_CONTROL_QUERY</term>
/// <term>Retrieves session properties and statistics.</term>
/// </item>
/// <item>
/// <term>EVENT_TRACE_CONTROL_STOP</term>
/// <term>Stops the session. The session handle is no longer valid.</term>
/// </item>
/// <item>
/// <term>EVENT_TRACE_CONTROL_UPDATE</term>
/// <term>Updates the session properties.</term>
/// </item>
/// </list>
/// <para>Note that it is not safe to flush buffers or stop a trace session from DllMain.</para>
/// </param>
/// <returns>
/// <para>If the function succeeds, the return value is ERROR_SUCCESS.</para>
/// <para>
/// If the function fails, the return value is one of the system error codes. The following table includes some common errors and
/// their causes.
/// </para>
/// <list type="table">
/// <listheader>
/// <term>Return code</term>
/// <term>Description</term>
/// </listheader>
/// <item>
/// <term>ERROR_BAD_LENGTH</term>
/// <term>One of the following is true:</term>
/// </item>
/// <item>
/// <term>ERROR_INVALID_PARAMETER</term>
/// <term>One of the following is true:</term>
/// </item>
/// <item>
/// <term>ERROR_BAD_PATHNAME</term>
/// <term>Another session is already using the file name specified by the LogFileNameOffset member of the Properties structure.</term>
/// </item>
/// <item>
/// <term>ERROR_MORE_DATA</term>
/// <term>
/// The buffer for EVENT_TRACE_PROPERTIES is too small to hold all the information for the session. If you do not need the session's
/// property information, you can ignore this error. If you receive this error when stopping the session, ETW will have already
/// stopped the session before generating this error.
/// </term>
/// </item>
/// <item>
/// <term>ERROR_ACCESS_DENIED</term>
/// <term>
/// Only users running with elevated administrative privileges, users in the Performance Log Users group, and services running as
/// LocalSystem, LocalService, NetworkService can control event tracing sessions. To grant a restricted user the ability to control
/// trace sessions, add them to the Performance Log Users group. Only users with administrative privileges and services running as
/// LocalSystem can control an NT Kernel Logger session. Windows XP and Windows 2000: Anyone can control a trace session.
/// </term>
/// </item>
/// <item>
/// <term>ERROR_WMI_INSTANCE_NOT_FOUND</term>
/// <term>The given session is not running.</term>
/// </item>
/// </list>
/// </returns>
/// <remarks>
/// <para>Event trace controllers call this function.</para>
/// <para>This function supersedes the <c>FlushTrace</c>, <c>QueryTrace</c>, <c>StopTrace</c>, and <c>UpdateTrace</c> functions.</para>
/// </remarks>
// https://docs.microsoft.com/en-us/windows/desktop/ETW/controltrace ULONG ControlTrace( _In_ TRACEHANDLE SessionHandle, _In_ LPCTSTR
// SessionName, _Inout_ PEVENT_TRACE_PROPERTIES Properties, _In_ ULONG ControlCode );
[DllImport(Lib.AdvApi32, SetLastError = false, CharSet = CharSet.Auto)]
[PInvokeData("evntrace.h", MSDNShortId = "c39f669c-ff40-40ed-ba47-798474ec2de4")]
public static extern Win32Error ControlTrace([Optional] TRACEHANDLE SessionHandle, [Optional] string SessionName, ref EVENT_TRACE_PROPERTIES Properties, EVENT_TRACE_CONTROL ControlCode);
/// <summary>
/// The <c>CreateTraceInstanceId</c> function creates a unique transaction identifier and maps it to a class GUID registration
/// handle. You then use the transaction identifier when calling the TraceEventInstance function.
/// </summary>
/// <param name="RegHandle">
/// Handle to a registered event trace class. The RegisterTraceGuids function returns this handle in the <c>RegHandle</c> member of
/// the TRACE_GUID_REGISTRATION structure.
/// </param>
/// <param name="InstInfo">
/// Pointer to an EVENT_INSTANCE_INFO structure. The <c>InstanceId</c> member of this structure contains the transaction identifier.
/// </param>
/// <returns>
/// <para>If the function is successful, the return value is ERROR_SUCCESS.</para>
/// <para>
/// If the function fails, the return value is one of the system error codes. The following table includes some common errors and
/// their causes.
/// </para>
/// <list type="table">
/// <listheader>
/// <term>Return code</term>
/// <term>Description</term>
/// </listheader>
/// <item>
/// <term>ERROR_INVALID_PARAMETER</term>
/// <term>One of the following is true:</term>
/// </item>
/// </list>
/// </returns>
/// <remarks>
/// <para>Providers call this function.</para>
/// <para>
/// ETW creates the identifier in the user-mode process, thus it can return the same number for different processes. The value starts
/// over at one when <c>InstanceId</c> reaches the maximum value for a <c>ULONG</c>. Only user-mode providers can call the
/// <c>CreateTraceInstanceId</c> function; drivers cannot call this function.
/// </para>
/// <para>Examples</para>
/// <para>For an example that uses <c>CreateTraceInstanceId</c>, see Tracing Event Instances.</para>
/// </remarks>
// https://docs.microsoft.com/en-us/windows/desktop/api/evntrace/nf-evntrace-createtraceinstanceid ULONG WMIAPI
// CreateTraceInstanceId( HANDLE RegHandle, PEVENT_INSTANCE_INFO InstInfo );
[DllImport(Lib.AdvApi32, SetLastError = false, ExactSpelling = true)]
[PInvokeData("evntrace.h", MSDNShortId = "ab890392-f1e4-4b4e-a46c-8c7c2bfd3897")]
public static extern Win32Error CreateTraceInstanceId(HANDLE RegHandle, ref EVENT_INSTANCE_INFO InstInfo);
/// <summary>
/// <para>Enables or disables the specified classic event trace provider.</para>
/// <para>On Windows Vista and later, call the <c>EnableTraceEx</c> function to enable or disable a provider.</para>
/// </summary>
/// <param name="Enable">If <c>TRUE</c>, the provider is enabled; otherwise, the provider is disabled.</param>
/// <param name="EnableFlag">
/// <para>
/// Provider-defined value that specifies the class of events for which the provider generates events. A provider that generates only
/// one class of events will typically ignore this flag. If the provider is more complex, the provider could use the TraceGuidReg
/// parameter of <c>RegisterTraceGuids</c> to register more than one class of events. For example, if the provider has a database
/// component, a UI component, and a general processing component, the provider could register separate event classes for these
/// components. This would then allow the controller the ability to turn on tracing in only the database component.
/// </para>
/// <para>The provider calls <c>GetTraceEnableFlags</c> from its ControlCallback function to obtain the enable flags.</para>
/// </param>
/// <param name="EnableLevel">
/// <para>
/// Provider-defined value that specifies the level of information the event generates. For example, you can use this value to
/// indicate the severity level of the events (informational, warning, error) you want the provider to generate.
/// </para>
/// <para>
/// Specify a value from zero to 255. ETW defines the following severity levels that you can use. Higher numbers imply that you get
/// lower levels as well. For example, if you specify TRACE_LEVEL_WARNING, you also receive all warning, error, and fatal events.
/// </para>
/// <list type="table">
/// <listheader>
/// <term>Value</term>
/// <term>Meaning</term>
/// </listheader>
/// <item>
/// <term>TRACE_LEVEL_CRITICAL 1</term>
/// <term>Abnormal exit or termination events</term>
/// </item>
/// <item>
/// <term>TRACE_LEVEL_ERROR 2</term>
/// <term>Severe error events</term>
/// </item>
/// <item>
/// <term>TRACE_LEVEL_WARNING 3</term>
/// <term>Warning events such as allocation failures</term>
/// </item>
/// <item>
/// <term>TRACE_LEVEL_INFORMATION 4</term>
/// <term>Non-error events such as entry or exit events</term>
/// </item>
/// <item>
/// <term>TRACE_LEVEL_VERBOSE 5</term>
/// <term>Detailed trace events</term>
/// </item>
/// </list>
/// </param>
/// <param name="ControlGuid">GUID of the event trace provider that you want to enable or disable.</param>
/// <param name="SessionHandle">
/// Handle of the event tracing session to which you want to enable, disable, or change the logging level of the provider. The
/// <c>StartTrace</c> function returns this handle.
/// </param>
/// <returns>
/// <para>If the function is successful, the return value is ERROR_SUCCESS.</para>
/// <para>
/// If the function fails, the return value is one of the system error codes. The following table includes some common errors and
/// their causes.
/// </para>
/// <list type="table">
/// <listheader>
/// <term>Return code</term>
/// <term>Description</term>
/// </listheader>
/// <item>
/// <term>ERROR_INVALID_PARAMETER</term>
/// <term>One of the following is true:</term>
/// </item>
/// <item>
/// <term>ERROR_INVALID_FUNCTION</term>
/// <term>You cannot change the enable flags and level when the provider is not registered.</term>
/// </item>
/// <item>
/// <term>ERROR_WMI_GUID_NOT_FOUND</term>
/// <term>
/// The provider is not registered. Occurs when KB307331 or Windows 2000 Service Pack 4 is installed and the provider is not
/// registered. To avoid this error, the provider must first be registered.
/// </term>
/// </item>
/// <item>
/// <term>ERROR_NO_SYSTEM_RESOURCES</term>
/// <term>Exceeded the number of trace sessions that can enable the provider.</term>
/// </item>
/// <item>
/// <term>ERROR_ACCESS_DENIED</term>
/// <term>
/// Only users with administrative privileges, users in the Performance Log Users group, and services running as LocalSystem,
/// LocalService, NetworkService can enable trace providers. To grant a restricted user the ability to enable a trace provider, add
/// them to the Performance Log Users group or see EventAccessControl. Windows XP and Windows 2000: Anyone can enable a trace provider.
/// </term>
/// </item>
/// </list>
/// </returns>
/// <remarks>
/// <para>Event trace controllers call this function.</para>
/// <para>
/// Up to eight trace sessions can enable and receive events from the same manifest-based provider; however, only one trace session
/// can enable a classic provider. If more than one session tried to enable a classic provider, the first session would stop
/// receiving events when the second session enabled the same provider. For example, if Session A enabled Provider 1 and then Session
/// B enabled Provider 1, only Session B would receive events from Provider 1.
/// </para>
/// <para>
/// The provider remains enabled for the session until the session disables the provider. If the application that started the session
/// ends without disabling the provider, the provider remains enabled.
/// </para>
/// <para>
/// The <c>EnableTrace</c> function calls the <c>ControlCallback</c> function implemented by the event trace provider, if defined.
/// The provider defines its interpretation of being enabled or disabled. Typically, if a provider has been enabled, it generates
/// events, but while it is disabled, it does not. The <c>ControlCallback</c> function can call the <c>GetTraceEnableFlags</c>,
/// <c>GetTraceEnableLevel</c>, and <c>GetTraceLoggerHandle</c> functions to obtain the values specified for the EnableFlag,
/// EnableLevel, and SessionHandle parameters, respectively.
/// </para>
/// <para>
/// You can call this function one time to enable a provider before the provider registers itself. After the provider registers
/// itself, ETW calls the provider's <c>ControlCallback</c> function. If you try to enable the provider for multiple sessions before
/// the provider registers itself, ETW will only enable the provider for the last session. For example, if you enable the provider to
/// Session A and then enable the provider to Session B, when the provider registers itself, the provider is only enabled for Session B.
/// </para>
/// <para>
/// You do not call <c>EnableTrace</c> to enable kernel providers. To enable kernel providers, set the <c>EnableFlags</c> member of
/// <c>EVENT_TRACE_PROPERTIES</c> which you then pass to <c>StartTrace</c>. The <c>StartTrace</c> function enables the selected
/// kernel providers.
/// </para>
/// <para>To determine the level and keywords used to enable a manifest-based provider, use one of the following commands:</para>
/// <list type="bullet">
/// <item>
/// <term>Logman query providers</term>
/// </item>
/// <item>
/// <term>Wevtutil gp</term>
/// </item>
/// </list>
/// <para>
/// For classic providers, it is up to the provider to document and make available to potential controllers the severity levels or
/// enable flags that it supports. If the provider wants to be enabled by any controller, the provider should accept 0 for the
/// severity level and enable flags and interpret 0 as a request to perform default logging (whatever that may be).
/// </para>
/// <para>If you use <c>EnableTrace</c> to enable a manifest-based provider, the following translation occurs:</para>
/// <list type="bullet">
/// <item>
/// <term>The EnableLevel parameter is the same as setting the Level parameter in <c>EnableTraceEx</c>.</term>
/// </item>
/// <item>
/// <term>The EnableFlag is the same as setting the MatchAnyKeyword parameter in <c>EnableTraceEx</c>.</term>
/// </item>
/// <item>
/// <term>
/// In the <c>EnableCallback</c> callback, the SourceId parameter will be <c>NULL</c>, Level will be set to the value in
/// <c>EnableTrace</c>, MatchAnyKeyword will be set to the value of EnableFlag in <c>EventTrace</c>, MatchAllKeyword will be 0, and
/// FilterData will be <c>NULL</c>.
/// </term>
/// </item>
/// </list>
/// <para>
/// On Windows 8.1,Windows Server 2012 R2, and later, payload filters can be used by the <c>EnableTraceEx2</c> function to filter on
/// specific conditions in a logger session.
/// </para>
/// </remarks>
// https://docs.microsoft.com/en-us/windows/desktop/ETW/enabletrace
[PInvokeData("evntrace.h", MSDNShortId = "d75f18e1-e5fa-4039-bb74-76dea334b0fd")]
public static Win32Error EnableTrace(bool Enable, uint EnableFlag, TRACE_LEVEL EnableLevel, in Guid ControlGuid, TRACEHANDLE SessionHandle) =>
InternalEnableTrace(Enable, EnableFlag, (uint)EnableLevel, ControlGuid, SessionHandle);
/// <summary>
/// <para>Enables or disables the specified event trace provider.</para>
/// <para>The <c>EnableTraceEx2</c> function supersedes this function.</para>
/// </summary>
/// <param name="ProviderId">GUID of the event trace provider that you want to enable or disable.</param>
/// <param name="SourceId">
/// GUID that uniquely identifies the session that is enabling or disabling the provider. Can be <c>NULL</c>. If the provider does
/// not implement <c>EnableCallback</c>, the GUID is not used.
/// </param>
/// <param name="TraceHandle">
/// Handle of the event tracing session to which you want to enable or disable the provider. The <c>StartTrace</c> function returns
/// this handle.
/// </param>
/// <param name="IsEnabled">
/// Set to 1 to receive events when the provider is registered; otherwise, set to 0 to no longer receive events from the provider.
/// </param>
/// <param name="Level">
/// Provider-defined value that specifies the level of detail included in the event. Specify one of the following levels that are
/// defined in Winmeta.h. Higher numbers imply that you get lower levels as well. For example, if you specify TRACE_LEVEL_WARNING,
/// you also receive all warning, error, and critical events.
/// </param>
/// <param name="MatchAnyKeyword">
/// Bitmask of keywords that determine the category of events that you want the provider to write. The provider writes the event if
/// any of the event's keyword bits match any of the bits set in this mask. See Remarks.
/// </param>
/// <param name="MatchAllKeyword">
/// This bitmask is optional. This mask further restricts the category of events that you want the provider to write. If the event's
/// keyword meets the MatchAnyKeyword condition, the provider will write the event only if all of the bits in this mask exist in the
/// event's keyword. This mask is not used if MatchAnyKeyword is zero. See Remarks.
/// </param>
/// <param name="EnableProperty">
/// Optional information that ETW can include when writing the event. The data is written to the <c>extended data item</c> section of
/// the event. To include the optional information, specify one or more of the following flags; otherwise, set to zero.
/// </param>
/// <param name="EnableFilterDesc">
/// <para>
/// An <c>EVENT_FILTER_DESCRIPTOR</c> structure that points to the filter data. The provider uses to filter data to prevent events
/// that match the filter criteria from being written to the session; the provider determines the layout of the data and how it
/// applies the filter to the event's data. A session can pass only one filter to the provider.
/// </para>
/// <para>A session can call the <c>TdhEnumerateProviderFilters</c> function to determine the filters that it can pass to the provider.</para>
/// </param>
/// <returns>
/// <para>If the function is successful, the return value is ERROR_SUCCESS.</para>
/// <para>
/// If the function fails, the return value is one of the system error codes. The following table includes some common errors and
/// their causes.
/// </para>
/// <list type="table">
/// <listheader>
/// <term>Return code</term>
/// <term>Description</term>
/// </listheader>
/// <item>
/// <term>ERROR_INVALID_PARAMETER</term>
/// <term>One of the following is true:</term>
/// </item>
/// <item>
/// <term>ERROR_INVALID_FUNCTION</term>
/// <term>You cannot update the level when the provider is not registered.</term>
/// </item>
/// <item>
/// <term>ERROR_NO_SYSTEM_RESOURCES</term>
/// <term>Exceeded the number of trace sessions that can enable the provider.</term>
/// </item>
/// <item>
/// <term>ERROR_ACCESS_DENIED</term>
/// <term>
/// Only users with administrative privileges, users in the Performance Log Users group, and services running as LocalSystem,
/// LocalService, NetworkService can enable trace providers. To grant a restricted user the ability to enable a trace provider, add
/// them to the Performance Log Users group or see EventAccessControl. Windows XP and Windows 2000: Anyone can enable a trace provider.
/// </term>
/// </item>
/// </list>
/// </returns>
/// <remarks>
/// <para>Event trace controllers call this function.</para>
/// <para>
/// The provider defines its interpretation of being enabled or disabled. Typically, if a provider has been enabled, it generates
/// events, but while it is disabled, it does not.
/// </para>
/// <para>
/// To include all events that a provider provides, set MatchAnyKeyword to zero (for a manifest-based provider and 0xFFFFFFFF for a
/// classic provider). To include specific events, set the MatchAnyKeyword mask to those specific events. For example, if the
/// provider defines an event for its initialization and cleanup routines (set keyword bit 0), an event for its file operations (set
/// keyword bit 1), and an event for its calculation operations (set keyword bit 2), you can set MatchAnyKeyword to 5 to receive
/// initialization and cleanup events and calculation events.
/// </para>
/// <para>
/// If the provider defines more complex event keywords, for example, the provider defines an event that sets bit 0 for read and bit
/// 1 for local access and a second event that sets bit 0 for read and bit 2 for remote access, you could set MatchAnyKeyword to 1 to
/// receive all read events, or you could set MatchAnykeyword to 1 and MatchAllKeywords to 3 to receive local reads only.
/// </para>
/// <para>
/// If an event's keyword is zero, the provider will write the event to the session, regardless of the MatchAnyKeyword and
/// MatchAllKeyword masks.
/// </para>
/// <para>
/// When you call <c>EnableTraceEx</c> the provider may or may not be registered. If the provider is registered, ETW calls the
/// provider's callback function, if it implements one, and the session begins receiving events. If the provider is not registered,
/// ETW will call the provider's callback function when it registers itself, if it implements one, and the session will begin
/// receiving events. If the provider is not registered, the provider's callback function will not receive the source ID or filter
/// data. You can call <c>EnableTraceEx</c> one time to enable a provider before the provider registers itself.
/// </para>
/// <para>
/// If the provider is registered and already enabled to your session, you can also use this function to update the Level,
/// MatchAnyKeyword, MatchAllKeyword, EnableProperty and EnableFilterDesc parameters that determine which events the provider writes.
/// </para>
/// <para>
/// You do not call <c>EnableTraceEx</c> to enable kernel providers. To enable kernel providers, set the <c>EnableFlags</c> member of
/// <c>EVENT_TRACE_PROPERTIES</c> which you then pass to <c>StartTrace</c>. The <c>StartTrace</c> function enables the selected
/// kernel providers.
/// </para>
/// <para>
/// Up to eight trace sessions can enable and receive events from the same manifest-based provider; however, only one trace session
/// can enable a classic provider. If more than one session tried to enable a classic provider, the first session would stop
/// receiving events when the second session enabled the same provider. For example, if Session A enabled Provider 1 and then Session
/// B enabled Provider 1, only Session B would receive events from Provider 1.
/// </para>
/// <para>
/// The provider remains enabled for the session until the session disables the provider. If the application that started the session
/// ends without disabling the provider, the provider remains enabled.
/// </para>
/// <para>To determine the level and keywords used to enable a manifest-based provider, use one of the following commands:</para>
/// <list type="bullet">
/// <item>
/// <term>Logman query providers</term>
/// </item>
/// <item>
/// <term>Wevtutil gp</term>
/// </item>
/// </list>
/// <para>
/// For classic providers, it is up to the provider to document and make available to potential controllers the severity levels or
/// enable flags that it supports. If the provider wants to be enabled by any controller, the provider should accept 0 for the
/// severity level and enable flags and interpret 0 as a request to perform default logging (whatever that may be).
/// </para>
/// <para>If you use <c>EnableTraceEx</c> to enable a classic provider, the following translation occurs:</para>
/// <list type="bullet">
/// <item>
/// <term>The Level parameter is the same as setting the EnableLevel parameter in <c>EnableTrace</c>.</term>
/// </item>
/// <item>
/// <term>
/// The MatchAnyKeyword is the same as setting the EnableFlag parameter in <c>EnableTrace</c> except that the keyword value is
/// truncated from a ULONGLONG to a ULONG value.
/// </term>
/// </item>
/// <item>
/// <term>
/// In the ControlCallback callback, the provider can call <c>GetTraceEnableLevel</c> to get the level and <c>GetTraceEnableFlags</c>
/// to get the enable flag.
/// </term>
/// </item>
/// <item>
/// <term>The other parameter are not used.</term>
/// </item>
/// </list>
/// <para>
/// A provider can define filters that a session uses to filter events based on event data. With the level and keywords that you
/// provide, ETW determines whether the event is written to the session but with filters, the provider uses the filter data to
/// determine whether it writes the event to the session. For example, if the provider generates process events, it could define a
/// data filter that filters process events based on the process identifier. If the identifier of the process did not match the
/// identifier that you passed as filter data, the provider would prevent event from being written to your session.
/// </para>
/// <para>
/// On Windows 8.1,Windows Server 2012 R2, and later, payload filters can be used by the <c>EnableTraceEx2</c> function to filter on
/// specific conditions in a logger session.
/// </para>
/// </remarks>
// https://docs.microsoft.com/en-us/windows/desktop/ETW/enabletraceex-func ULONG EnableTraceEx( _In_ LPCGUID ProviderId, _In_opt_
// LPCGUID SourceId, _In_ TRACEHANDLE TraceHandle, _In_ ULONG IsEnabled, _In_ UCHAR Level, _In_ ULONGLONG MatchAnyKeyword, _In_
// ULONGLONG MatchAllKeyword, _In_ ULONG EnableProperty, _In_opt_ PEVENT_FILTER_DESCRIPTOR EnableFilterDesc );
[DllImport(Lib.AdvApi32, SetLastError = false, ExactSpelling = true)]
[PInvokeData("evntrace.h", MSDNShortId = "1c675bf7-f292-49b1-8b60-720499a497fd")]
public static extern Win32Error EnableTraceEx(in Guid ProviderId, [Optional] IntPtr SourceId, TRACEHANDLE TraceHandle, [MarshalAs(UnmanagedType.Bool)] bool IsEnabled, TRACE_LEVEL Level, [Optional] ulong MatchAnyKeyword, [Optional] ulong MatchAllKeyword, [Optional] uint EnableProperty, [Optional] IntPtr EnableFilterDesc);
/// <summary>
/// <para>Enables or disables the specified event trace provider.</para>
/// <para>The <c>EnableTraceEx2</c> function supersedes this function.</para>
/// </summary>
/// <param name="ProviderId">GUID of the event trace provider that you want to enable or disable.</param>
/// <param name="SourceId">
/// GUID that uniquely identifies the session that is enabling or disabling the provider. Can be <c>NULL</c>. If the provider does
/// not implement <c>EnableCallback</c>, the GUID is not used.
/// </param>
/// <param name="TraceHandle">
/// Handle of the event tracing session to which you want to enable or disable the provider. The <c>StartTrace</c> function returns
/// this handle.
/// </param>
/// <param name="IsEnabled">
/// Set to 1 to receive events when the provider is registered; otherwise, set to 0 to no longer receive events from the provider.
/// </param>
/// <param name="Level">
/// Provider-defined value that specifies the level of detail included in the event. Specify one of the following levels that are
/// defined in Winmeta.h. Higher numbers imply that you get lower levels as well. For example, if you specify TRACE_LEVEL_WARNING,
/// you also receive all warning, error, and critical events.
/// </param>
/// <param name="MatchAnyKeyword">
/// Bitmask of keywords that determine the category of events that you want the provider to write. The provider writes the event if
/// any of the event's keyword bits match any of the bits set in this mask. See Remarks.
/// </param>
/// <param name="MatchAllKeyword">
/// This bitmask is optional. This mask further restricts the category of events that you want the provider to write. If the event's
/// keyword meets the MatchAnyKeyword condition, the provider will write the event only if all of the bits in this mask exist in the
/// event's keyword. This mask is not used if MatchAnyKeyword is zero. See Remarks.
/// </param>
/// <param name="EnableProperty">
/// Optional information that ETW can include when writing the event. The data is written to the <c>extended data item</c> section of
/// the event. To include the optional information, specify one or more of the following flags; otherwise, set to zero.
/// </param>
/// <param name="EnableFilterDesc">
/// <para>
/// An <c>EVENT_FILTER_DESCRIPTOR</c> structure that points to the filter data. The provider uses to filter data to prevent events
/// that match the filter criteria from being written to the session; the provider determines the layout of the data and how it
/// applies the filter to the event's data. A session can pass only one filter to the provider.
/// </para>
/// <para>A session can call the <c>TdhEnumerateProviderFilters</c> function to determine the filters that it can pass to the provider.</para>
/// </param>
/// <returns>
/// <para>If the function is successful, the return value is ERROR_SUCCESS.</para>
/// <para>
/// If the function fails, the return value is one of the system error codes. The following table includes some common errors and
/// their causes.
/// </para>
/// <list type="table">
/// <listheader>
/// <term>Return code</term>
/// <term>Description</term>
/// </listheader>
/// <item>
/// <term>ERROR_INVALID_PARAMETER</term>
/// <term>One of the following is true:</term>
/// </item>
/// <item>
/// <term>ERROR_INVALID_FUNCTION</term>
/// <term>You cannot update the level when the provider is not registered.</term>
/// </item>
/// <item>
/// <term>ERROR_NO_SYSTEM_RESOURCES</term>
/// <term>Exceeded the number of trace sessions that can enable the provider.</term>
/// </item>
/// <item>
/// <term>ERROR_ACCESS_DENIED</term>
/// <term>
/// Only users with administrative privileges, users in the Performance Log Users group, and services running as LocalSystem,
/// LocalService, NetworkService can enable trace providers. To grant a restricted user the ability to enable a trace provider, add
/// them to the Performance Log Users group or see EventAccessControl. Windows XP and Windows 2000: Anyone can enable a trace provider.
/// </term>
/// </item>
/// </list>
/// </returns>
/// <remarks>
/// <para>Event trace controllers call this function.</para>
/// <para>
/// The provider defines its interpretation of being enabled or disabled. Typically, if a provider has been enabled, it generates
/// events, but while it is disabled, it does not.
/// </para>
/// <para>
/// To include all events that a provider provides, set MatchAnyKeyword to zero (for a manifest-based provider and 0xFFFFFFFF for a
/// classic provider). To include specific events, set the MatchAnyKeyword mask to those specific events. For example, if the
/// provider defines an event for its initialization and cleanup routines (set keyword bit 0), an event for its file operations (set
/// keyword bit 1), and an event for its calculation operations (set keyword bit 2), you can set MatchAnyKeyword to 5 to receive
/// initialization and cleanup events and calculation events.
/// </para>
/// <para>
/// If the provider defines more complex event keywords, for example, the provider defines an event that sets bit 0 for read and bit
/// 1 for local access and a second event that sets bit 0 for read and bit 2 for remote access, you could set MatchAnyKeyword to 1 to
/// receive all read events, or you could set MatchAnykeyword to 1 and MatchAllKeywords to 3 to receive local reads only.
/// </para>
/// <para>
/// If an event's keyword is zero, the provider will write the event to the session, regardless of the MatchAnyKeyword and
/// MatchAllKeyword masks.
/// </para>
/// <para>
/// When you call <c>EnableTraceEx</c> the provider may or may not be registered. If the provider is registered, ETW calls the
/// provider's callback function, if it implements one, and the session begins receiving events. If the provider is not registered,
/// ETW will call the provider's callback function when it registers itself, if it implements one, and the session will begin
/// receiving events. If the provider is not registered, the provider's callback function will not receive the source ID or filter
/// data. You can call <c>EnableTraceEx</c> one time to enable a provider before the provider registers itself.
/// </para>
/// <para>
/// If the provider is registered and already enabled to your session, you can also use this function to update the Level,
/// MatchAnyKeyword, MatchAllKeyword, EnableProperty and EnableFilterDesc parameters that determine which events the provider writes.
/// </para>
/// <para>
/// You do not call <c>EnableTraceEx</c> to enable kernel providers. To enable kernel providers, set the <c>EnableFlags</c> member of
/// <c>EVENT_TRACE_PROPERTIES</c> which you then pass to <c>StartTrace</c>. The <c>StartTrace</c> function enables the selected
/// kernel providers.
/// </para>
/// <para>
/// Up to eight trace sessions can enable and receive events from the same manifest-based provider; however, only one trace session
/// can enable a classic provider. If more than one session tried to enable a classic provider, the first session would stop
/// receiving events when the second session enabled the same provider. For example, if Session A enabled Provider 1 and then Session
/// B enabled Provider 1, only Session B would receive events from Provider 1.
/// </para>
/// <para>
/// The provider remains enabled for the session until the session disables the provider. If the application that started the session
/// ends without disabling the provider, the provider remains enabled.
/// </para>
/// <para>To determine the level and keywords used to enable a manifest-based provider, use one of the following commands:</para>
/// <list type="bullet">
/// <item>
/// <term>Logman query providers</term>
/// </item>
/// <item>
/// <term>Wevtutil gp</term>
/// </item>
/// </list>
/// <para>
/// For classic providers, it is up to the provider to document and make available to potential controllers the severity levels or
/// enable flags that it supports. If the provider wants to be enabled by any controller, the provider should accept 0 for the
/// severity level and enable flags and interpret 0 as a request to perform default logging (whatever that may be).
/// </para>
/// <para>If you use <c>EnableTraceEx</c> to enable a classic provider, the following translation occurs:</para>
/// <list type="bullet">
/// <item>
/// <term>The Level parameter is the same as setting the EnableLevel parameter in <c>EnableTrace</c>.</term>
/// </item>
/// <item>
/// <term>
/// The MatchAnyKeyword is the same as setting the EnableFlag parameter in <c>EnableTrace</c> except that the keyword value is
/// truncated from a ULONGLONG to a ULONG value.
/// </term>
/// </item>
/// <item>
/// <term>
/// In the ControlCallback callback, the provider can call <c>GetTraceEnableLevel</c> to get the level and <c>GetTraceEnableFlags</c>
/// to get the enable flag.
/// </term>
/// </item>
/// <item>
/// <term>The other parameter are not used.</term>
/// </item>
/// </list>
/// <para>
/// A provider can define filters that a session uses to filter events based on event data. With the level and keywords that you
/// provide, ETW determines whether the event is written to the session but with filters, the provider uses the filter data to
/// determine whether it writes the event to the session. For example, if the provider generates process events, it could define a
/// data filter that filters process events based on the process identifier. If the identifier of the process did not match the
/// identifier that you passed as filter data, the provider would prevent event from being written to your session.
/// </para>
/// <para>
/// On Windows 8.1,Windows Server 2012 R2, and later, payload filters can be used by the <c>EnableTraceEx2</c> function to filter on
/// specific conditions in a logger session.
/// </para>
/// </remarks>
// https://docs.microsoft.com/en-us/windows/desktop/ETW/enabletraceex-func ULONG EnableTraceEx( _In_ LPCGUID ProviderId, _In_opt_
// LPCGUID SourceId, _In_ TRACEHANDLE TraceHandle, _In_ ULONG IsEnabled, _In_ UCHAR Level, _In_ ULONGLONG MatchAnyKeyword, _In_
// ULONGLONG MatchAllKeyword, _In_ ULONG EnableProperty, _In_opt_ PEVENT_FILTER_DESCRIPTOR EnableFilterDesc );
[DllImport(Lib.AdvApi32, SetLastError = false, ExactSpelling = true)]
[PInvokeData("evntrace.h", MSDNShortId = "1c675bf7-f292-49b1-8b60-720499a497fd")]
public static extern Win32Error EnableTraceEx(in Guid ProviderId, in Guid SourceId, TRACEHANDLE TraceHandle, [MarshalAs(UnmanagedType.Bool)] bool IsEnabled, TRACE_LEVEL Level, ulong MatchAnyKeyword, ulong MatchAllKeyword, uint EnableProperty, in EVENT_FILTER_DESCRIPTOR EnableFilterDesc);
/// <summary>
/// <para>The <c>EnableTraceEx2</c> function enables or disables the specified event trace provider.</para>
/// <para>This function supersedes the <c>EnableTraceEx</c> function.</para>
/// </summary>
/// <param name="TraceHandle">
/// A handle of the event tracing session to which you want to enable or disable the provider. The <c>StartTrace</c> function returns
/// this handle.
/// </param>
/// <param name="ProviderId">A GUID of the event trace provider that you want to enable or disable.</param>
/// <param name="ControlCode">You can specify one of the following control codes:</param>
/// <param name="Level">
/// A provider-defined value that specifies the level of detail included in the event. Specify one of the following levels that are
/// defined in the Winmeta.h header file. Higher numbers imply that you get lower levels as well. For example, if you specify
/// TRACE_LEVEL_WARNING, you also receive all warning, error, and critical events.
/// </param>
/// <param name="MatchAnyKeyword">
/// A bitmask of keywords that determine the category of events that you want the provider to write. The provider writes the event if
/// any of the event's keyword bits match any of the bits set in this mask. See Remarks.
/// </param>
/// <param name="MatchAllKeyword">
/// This bitmask is optional. This mask further restricts the category of events that you want the provider to write. If the event's
/// keyword meets the MatchAnyKeyword condition, the provider will write the event only if all of the bits in this mask exist in the
/// event's keyword. This mask is not used if MatchAnyKeyword is zero. See Remarks.
/// </param>
/// <param name="Timeout">
/// Set to zero to enable the trace asynchronously; this is the default. If the timeout value is zero, this function calls the
/// provider's enable callback and returns immediately. To enable the trace synchronously, specify a timeout value, in milliseconds.
/// If you specify a timeout value, this function calls the provider's enable callback and waits until the callback exits or the
/// timeout expires. To wait forever, set to INFINITE.
/// </param>
/// <param name="EnableParameters">
/// The trace parameters used to enable the provider. For details, see <c>ENABLE_TRACE_PARAMETERS</c> and <c>ENABLE_TRACE_PARAMETERS_V1</c>.
/// </param>
/// <returns>
/// <para>If the function is successful, the return value is <c>ERROR_SUCCESS</c>.</para>
/// <para>
/// If the function fails, the return value is one of the system error codes. The following table includes some common errors and
/// their causes.
/// </para>
/// <list type="table">
/// <listheader>
/// <term>Return code</term>
/// <term>Description</term>
/// </listheader>
/// <item>
/// <term>ERROR_INVALID_PARAMETER</term>
/// <term>A parameter is incorrect. This can occur if any of the following are true:</term>
/// </item>
/// <item>
/// <term>ERROR_TIMEOUT</term>
/// <term>The timeout value expired before the enable callback completed. For details, see the Timeout parameter.</term>
/// </item>
/// <item>
/// <term>ERROR_INVALID_FUNCTION</term>
/// <term>You cannot update the level when the provider is not registered.</term>
/// </item>
/// <item>
/// <term>ERROR_NO_SYSTEM_RESOURCES</term>
/// <term>Exceeded the number of trace sessions that can enable the provider.</term>
/// </item>
/// <item>
/// <term>ERROR_ACCESS_DENIED</term>
/// <term>
/// Only users with administrative privileges, users in the Performance Log Users group, and services running as LocalSystem,
/// LocalService, or NetworkService can enable trace providers. To grant a restricted user the ability to enable a trace provider,
/// add them to the Performance Log Users group or see EventAccessControl. Windows XP and Windows 2000: Anyone can enable a trace provider.
/// </term>
/// </item>
/// </list>
/// </returns>
/// <remarks>
/// <para>Event trace controllers call this function.</para>
/// <para>
/// The provider defines its interpretation of being enabled or disabled. Typically, if a provider has been enabled, it generates
/// events, but while it is disabled, it does not.
/// </para>
/// <para>Event Tracing for Windows (ETW) supports several categories of filtering.</para>
/// <list type="bullet">
/// <item>
/// <term>
/// Schematized filtering - This is the traditional filtering setup also called provider-side filtering. The controller defines a
/// custom set of filters as a binary object that is passed to the provider in the <c>EnableTrace</c> call. It is incumbent on the
/// controller and provider to define and interpret these filters and the controller should only log applicable events. This requires
/// a close coupling of the controller and provider since the type and format of the binary object of what can be filtered is not
/// defined. The <c>TdhEnumerateProviderFilters</c> function can be used to retrieve the filters defined in a manifest.
/// </term>
/// </item>
/// <item>
/// <term>
/// Scope filtering - Certain providers are enabled or not enabled to a session based on whether or not they meet the criteria
/// specified by the scope filters. There are several types of scope filters that allow filtering based on the event ID, the process
/// ID (PID), executable filename, the app ID, and the app package name. This feature is supported on Windows 8.1,Windows Server 2012
/// R2, and later.
/// </term>
/// </item>
/// <item>
/// <term>
/// Stackwalk filtering - This notifies ETW to only perform a stack walk for a given set of event IDs. This feature is supported on
/// Windows 8.1,Windows Server 2012 R2, and later.
/// </term>
/// </item>
/// <item>
/// <term>
/// Event payload filtering - For manifest providers, events can be filtered on-the-fly based on whether or not they satisfy a
/// logical expression based on one or more predicates.
/// </term>
/// </item>
/// </list>
/// <para>
/// Every time <c>EnableTraceEx2</c> is called, the filters for the provider in that session are replaced by the new parameters
/// defined by the parameters passed to the <c>EnableTraceEx2</c> function. Multiple filters passed in a single <c>EnableTraceEx2</c>
/// call can be combined with an additive effect. To disable filtering and thereby enable all providers/events in the logging
/// session, call <c>EnableTraceEx2</c> with the EnableParameters parameter pointed to an <c>ENABLE_TRACE_PARAMETERS</c> structure
/// with the <c>FilterDescCount</c> member set to 0.
/// </para>
/// <para>
/// Each filter passed to the <c>EnableTraceEx2</c> function is specified by a <c>Type</c> member in the
/// <c>EVENT_FILTER_DESCRIPTOR</c>. An array of <c>EVENT_FILTER_DESCRIPTOR</c> structures is passed in the
/// <c>ENABLE_TRACE_PARAMETERS</c> structure passed in the <c>EnableParameters</c> parameter to the <c>EnableTraceEx2</c> function.
/// </para>
/// <para>
/// Each type of filter (a specific <c>Type</c> member) may only appear once in a call to the <c>EnableTraceEx2</c> function,
/// however, some filter types allow multiple conditions to be included in a single filter. The maximum number of filters that can be
/// included in a call to <c>EnableTraceEx2</c> is set by <c>MAX_EVENT_FILTERS_COUNT</c> defined to be 8 in the Evntprov.h header file.
/// </para>
/// <para>
/// Each filter type has its own size or entity limits based on the specific <c>Type</c> member in the <c>EVENT_FILTER_DESCRIPTOR</c>
/// structure. The list below indicates these limits.
/// </para>
/// <list type="table">
/// <listheader>
/// <term>Term</term>
/// <term>Description</term>
/// </listheader>
/// <item>
/// <term>EVENT_FILTER_TYPE_SCHEMATIZED</term>
/// <term>Filter size limit: MAX_EVENT_FILTER_DATA_SIZE (1024) Number of elements allowed: Defined by provider and controller</term>
/// </item>
/// <item>
/// <term>EVENT_FILTER_TYPE_PID</term>
/// <term>Filter size limit: MAX_EVENT_FILTER_DATA_SIZE (1024) Number of elements allowed: MAX_EVENT_FILTER_PID_COUNT (8)</term>
/// </item>
/// <item>
/// <term>EVENT_FILTER_TYPE_EXECUTABLE_NAME</term>
/// <term>
/// Filter size limit: MAX_EVENT_FILTER_DATA_SIZE (1024) Number of elements allowed: A single string that can contain multiple
/// executable file names separated by semicolons.
/// </term>
/// </item>
/// <item>
/// <term>EVENT_FILTER_TYPE_PACKAGE_ID</term>
/// <term>
/// Filter size limit: MAX_EVENT_FILTER_DATA_SIZE (1024) Number of elements allowed: A single string that can contain multiple
/// package IDs separated by semicolons.
/// </term>
/// </item>
/// <item>
/// <term>EVENT_FILTER_TYPE_PACKAGE_APP_ID</term>
/// <term>
/// Filter size limit: MAX_EVENT_FILTER_DATA_SIZE (1024) Number of elements allowed: A single string that can contain multiple
/// package relative app IDs (PRAIDs) separated by semicolons.
/// </term>
/// </item>
/// <item>
/// <term>EVENT_FILTER_TYPE_PAYLOAD</term>
/// <term>Filter size limit: 1MAX_EVENT_FILTER_PAYLOAD_SIZE (4096) Number of elements allowed: 1</term>
/// </item>
/// <item>
/// <term>EVENT_FILTER_TYPE_EVENT_ID</term>
/// <term>Filter size limit: Not defined Number of elements allowed: MAX_EVENT_FILTER_EVENT_ID_COUNT (64)</term>
/// </item>
/// <item>
/// <term>EVENT_FILTER_TYPE_STACKWALK</term>
/// <term>Filter size limit: Not defined Number of elements allowed: MAX_EVENT_FILTER_EVENT_ID_COUNT (64)</term>
/// </item>
/// </list>
/// <para>
/// To include all events that a provider provides, set MatchAnyKeyword to zero (for a manifest-based provider or TraceLogging
/// provider and 0xFFFFFFFF for a classic provider). To include specific events, set the MatchAnyKeyword mask to those specific
/// events. To indicate that you wish to enable a Provider Group, use the EVENT_ENABLE_PROPERTY_PROVIDER_GROUP flag on the
/// <c>EnableProperty</c> member of EnableParameters. For example, if the provider defines an event for its initialization and
/// cleanup routines (set keyword bit 0), an event for its file operations (set keyword bit 1), and an event for its calculation
/// operations (set keyword bit 2), you can set MatchAnyKeyword to 5 to receive initialization and cleanup events and calculation events.
/// </para>
/// <para>
/// If the provider defines more complex event keywords, for example, the provider defines an event that sets bit 0 for read and bit
/// 1 for local access and a second event that sets bit 0 for read and bit 2 for remote access, you could set MatchAnyKeyword to 1 to
/// receive all read events, or you could set MatchAnykeyword to 1 and MatchAllKeywords to 3 to receive local reads only.
/// </para>
/// <para>
/// If an event's keyword is zero, the provider will write the event to the session, regardless of the MatchAnyKeyword and
/// MatchAllKeyword masks.
/// </para>
/// <para>
/// When you call <c>EnableTraceEx2</c> the provider may or may not be registered. If the provider is registered, ETW calls the
/// provider's callback function, if it implements one, and the session begins receiving events. If the provider is not registered,
/// ETW will call the provider's callback function when it registers itself, if it implements one, and the session will begin
/// receiving events. If the provider is not registered, the provider's callback function will not receive the source ID or filter
/// data. You can call <c>EnableTraceEx2</c> one time to enable a provider before the provider registers itself.
/// </para>
/// <para>
/// If the provider is registered and already enabled to your session, you can also use this function to update the Level,
/// MatchAnyKeyword, MatchAllKeyword parameters, and the <c>EnableProperty</c> and <c>EnableFilterDesc</c> members of EnableParameters.
/// </para>
/// <para>
/// On Windows 8.1,Windows Server 2012 R2, and later, event payload , scope, and stack walk filters can be used by the
/// <c>EnableTraceEx2</c> function and the <c>ENABLE_TRACE_PARAMETERS</c> and <c>EVENT_FILTER_DESCRIPTOR</c> structures to filter on
/// specific conditions in a logger session. For more information on event payload filters, see the <c>TdhCreatePayloadFilter</c>,
/// and <c>TdhAggregatePayloadFilters</c> functions and the <c>ENABLE_TRACE_PARAMETERS</c>, <c>EVENT_FILTER_DESCRIPTOR</c>, and
/// <c>PAYLOAD_FILTER_PREDICATE</c> structures.
/// </para>
/// <para>
/// You do not call <c>EnableTraceEx2</c> to enable kernel providers. To enable kernel providers, set the <c>EnableFlags</c> member
/// of <c>EVENT_TRACE_PROPERTIES</c> which you then pass to <c>StartTrace</c>. The <c>StartTrace</c> function enables the selected
/// kernel providers.
/// </para>
/// <para>
/// Up to eight trace sessions can enable and receive events from the same manifest-based provider or TraceLogging provider; however,
/// only one trace session can enable a classic provider. If more than one session tried to enable a classic provider, the first
/// session would stop receiving events when the second session enabled the same provider. For example, if Session A enabled Provider
/// 1 and then Session B enabled Provider 1, only Session B would receive events from Provider 1.
/// </para>
/// <para>
/// The provider remains enabled for the session until the session disables the provider. If the application that started the session
/// ends without disabling the provider, the provider remains enabled.
/// </para>
/// <para>To determine the level and keywords used to enable a manifest-based provider, use one of the following commands:</para>
/// <list type="bullet">
/// <item>
/// <term>Logman query providers</term>
/// </item>
/// <item>
/// <term>Wevtutil gp</term>
/// </item>
/// </list>
/// <para>
/// For classic providers, it is up to the provider to document and make available to potential controllers the severity levels or
/// enable flags that it supports. If the provider wants to be enabled by any controller, the provider should accept 0 for the
/// severity level and enable flags and interpret 0 as a request to perform default logging (whatever that may be).
/// </para>
/// <para>If you use <c>EnableTraceEx2</c> to enable a classic provider, the following translation occurs:</para>
/// <list type="bullet">
/// <item>
/// <term>The Level parameter is the same as setting the EnableLevel parameter in <c>EnableTrace</c>.</term>
/// </item>
/// <item>
/// <term>
/// The MatchAnyKeyword is the same as setting the EnableFlag parameter in <c>EnableTrace</c> except that the keyword value is
/// truncated from a ULONGLONG to a ULONG value.
/// </term>
/// </item>
/// <item>
/// <term>
/// In the ControlCallback callback, the provider can call <c>GetTraceEnableLevel</c> to get the level and <c>GetTraceEnableFlags</c>
/// to get the enable flag.
/// </term>
/// </item>
/// <item>
/// <term>The other parameter are not used.</term>
/// </item>
/// </list>
/// <para>
/// If <c>EnableTraceEx2</c> returns <c>ERROR_INVALID_PARAMETER</c> when enabling filtering, you can turn on tracing to view
/// debugging messages about the failure. This requires a checked build.
/// </para>
/// </remarks>
// https://docs.microsoft.com/en-us/windows/desktop/ETW/enabletraceex2 ULONG EnableTraceEx2( _In_ TRACEHANDLE TraceHandle, _In_
// LPCGUID ProviderId, _In_ ULONG ControlCode, _In_ UCHAR Level, _In_ ULONGLONG MatchAnyKeyword, _In_ ULONGLONG MatchAllKeyword, _In_
// ULONG Timeout, _In_opt_ PENABLE_TRACE_PARAMETERS EnableParameters );
[DllImport(Lib.AdvApi32, SetLastError = false, ExactSpelling = true)]
[PInvokeData("evntrace.h", MSDNShortId = "3aceffb6-614f-4cad-bbec-f181f0cbdbff")]
public static extern Win32Error EnableTraceEx2(TRACEHANDLE TraceHandle, in Guid ProviderId, EVENT_CONTROL_CODE ControlCode, TRACE_LEVEL Level, ulong MatchAnyKeyword, ulong MatchAllKeyword, uint Timeout, in ENABLE_TRACE_PARAMETERS EnableParameters);
/// <summary>
/// <para>The <c>EnableTraceEx2</c> function enables or disables the specified event trace provider.</para>
/// <para>This function supersedes the <c>EnableTraceEx</c> function.</para>
/// </summary>
/// <param name="TraceHandle">
/// A handle of the event tracing session to which you want to enable or disable the provider. The <c>StartTrace</c> function returns
/// this handle.
/// </param>
/// <param name="ProviderId">A GUID of the event trace provider that you want to enable or disable.</param>
/// <param name="ControlCode">You can specify one of the following control codes:</param>
/// <param name="Level">
/// A provider-defined value that specifies the level of detail included in the event. Specify one of the following levels that are
/// defined in the Winmeta.h header file. Higher numbers imply that you get lower levels as well. For example, if you specify
/// TRACE_LEVEL_WARNING, you also receive all warning, error, and critical events.
/// </param>
/// <param name="MatchAnyKeyword">
/// A bitmask of keywords that determine the category of events that you want the provider to write. The provider writes the event if
/// any of the event's keyword bits match any of the bits set in this mask. See Remarks.
/// </param>
/// <param name="MatchAllKeyword">
/// This bitmask is optional. This mask further restricts the category of events that you want the provider to write. If the event's
/// keyword meets the MatchAnyKeyword condition, the provider will write the event only if all of the bits in this mask exist in the
/// event's keyword. This mask is not used if MatchAnyKeyword is zero. See Remarks.
/// </param>
/// <param name="Timeout">
/// Set to zero to enable the trace asynchronously; this is the default. If the timeout value is zero, this function calls the
/// provider's enable callback and returns immediately. To enable the trace synchronously, specify a timeout value, in milliseconds.
/// If you specify a timeout value, this function calls the provider's enable callback and waits until the callback exits or the
/// timeout expires. To wait forever, set to INFINITE.
/// </param>
/// <param name="EnableParameters">
/// The trace parameters used to enable the provider. For details, see <c>ENABLE_TRACE_PARAMETERS</c> and <c>ENABLE_TRACE_PARAMETERS_V1</c>.
/// </param>
/// <returns>
/// <para>If the function is successful, the return value is <c>ERROR_SUCCESS</c>.</para>
/// <para>
/// If the function fails, the return value is one of the system error codes. The following table includes some common errors and
/// their causes.
/// </para>
/// <list type="table">
/// <listheader>
/// <term>Return code</term>
/// <term>Description</term>
/// </listheader>
/// <item>
/// <term>ERROR_INVALID_PARAMETER</term>
/// <term>A parameter is incorrect. This can occur if any of the following are true:</term>
/// </item>
/// <item>
/// <term>ERROR_TIMEOUT</term>
/// <term>The timeout value expired before the enable callback completed. For details, see the Timeout parameter.</term>
/// </item>
/// <item>
/// <term>ERROR_INVALID_FUNCTION</term>
/// <term>You cannot update the level when the provider is not registered.</term>
/// </item>
/// <item>
/// <term>ERROR_NO_SYSTEM_RESOURCES</term>
/// <term>Exceeded the number of trace sessions that can enable the provider.</term>
/// </item>
/// <item>
/// <term>ERROR_ACCESS_DENIED</term>
/// <term>
/// Only users with administrative privileges, users in the Performance Log Users group, and services running as LocalSystem,
/// LocalService, or NetworkService can enable trace providers. To grant a restricted user the ability to enable a trace provider,
/// add them to the Performance Log Users group or see EventAccessControl. Windows XP and Windows 2000: Anyone can enable a trace provider.
/// </term>
/// </item>
/// </list>
/// </returns>
/// <remarks>
/// <para>Event trace controllers call this function.</para>
/// <para>
/// The provider defines its interpretation of being enabled or disabled. Typically, if a provider has been enabled, it generates
/// events, but while it is disabled, it does not.
/// </para>
/// <para>Event Tracing for Windows (ETW) supports several categories of filtering.</para>
/// <list type="bullet">
/// <item>
/// <term>
/// Schematized filtering - This is the traditional filtering setup also called provider-side filtering. The controller defines a
/// custom set of filters as a binary object that is passed to the provider in the <c>EnableTrace</c> call. It is incumbent on the
/// controller and provider to define and interpret these filters and the controller should only log applicable events. This requires
/// a close coupling of the controller and provider since the type and format of the binary object of what can be filtered is not
/// defined. The <c>TdhEnumerateProviderFilters</c> function can be used to retrieve the filters defined in a manifest.
/// </term>
/// </item>
/// <item>
/// <term>
/// Scope filtering - Certain providers are enabled or not enabled to a session based on whether or not they meet the criteria
/// specified by the scope filters. There are several types of scope filters that allow filtering based on the event ID, the process
/// ID (PID), executable filename, the app ID, and the app package name. This feature is supported on Windows 8.1,Windows Server 2012
/// R2, and later.
/// </term>
/// </item>
/// <item>
/// <term>
/// Stackwalk filtering - This notifies ETW to only perform a stack walk for a given set of event IDs. This feature is supported on
/// Windows 8.1,Windows Server 2012 R2, and later.
/// </term>
/// </item>
/// <item>
/// <term>
/// Event payload filtering - For manifest providers, events can be filtered on-the-fly based on whether or not they satisfy a
/// logical expression based on one or more predicates.
/// </term>
/// </item>
/// </list>
/// <para>
/// Every time <c>EnableTraceEx2</c> is called, the filters for the provider in that session are replaced by the new parameters
/// defined by the parameters passed to the <c>EnableTraceEx2</c> function. Multiple filters passed in a single <c>EnableTraceEx2</c>
/// call can be combined with an additive effect. To disable filtering and thereby enable all providers/events in the logging
/// session, call <c>EnableTraceEx2</c> with the EnableParameters parameter pointed to an <c>ENABLE_TRACE_PARAMETERS</c> structure
/// with the <c>FilterDescCount</c> member set to 0.
/// </para>
/// <para>
/// Each filter passed to the <c>EnableTraceEx2</c> function is specified by a <c>Type</c> member in the
/// <c>EVENT_FILTER_DESCRIPTOR</c>. An array of <c>EVENT_FILTER_DESCRIPTOR</c> structures is passed in the
/// <c>ENABLE_TRACE_PARAMETERS</c> structure passed in the <c>EnableParameters</c> parameter to the <c>EnableTraceEx2</c> function.
/// </para>
/// <para>
/// Each type of filter (a specific <c>Type</c> member) may only appear once in a call to the <c>EnableTraceEx2</c> function,
/// however, some filter types allow multiple conditions to be included in a single filter. The maximum number of filters that can be
/// included in a call to <c>EnableTraceEx2</c> is set by <c>MAX_EVENT_FILTERS_COUNT</c> defined to be 8 in the Evntprov.h header file.
/// </para>
/// <para>
/// Each filter type has its own size or entity limits based on the specific <c>Type</c> member in the <c>EVENT_FILTER_DESCRIPTOR</c>
/// structure. The list below indicates these limits.
/// </para>
/// <list type="table">
/// <listheader>
/// <term>Term</term>
/// <term>Description</term>
/// </listheader>
/// <item>
/// <term>EVENT_FILTER_TYPE_SCHEMATIZED</term>
/// <term>Filter size limit: MAX_EVENT_FILTER_DATA_SIZE (1024) Number of elements allowed: Defined by provider and controller</term>
/// </item>
/// <item>
/// <term>EVENT_FILTER_TYPE_PID</term>
/// <term>Filter size limit: MAX_EVENT_FILTER_DATA_SIZE (1024) Number of elements allowed: MAX_EVENT_FILTER_PID_COUNT (8)</term>
/// </item>
/// <item>
/// <term>EVENT_FILTER_TYPE_EXECUTABLE_NAME</term>
/// <term>
/// Filter size limit: MAX_EVENT_FILTER_DATA_SIZE (1024) Number of elements allowed: A single string that can contain multiple
/// executable file names separated by semicolons.
/// </term>
/// </item>
/// <item>
/// <term>EVENT_FILTER_TYPE_PACKAGE_ID</term>
/// <term>
/// Filter size limit: MAX_EVENT_FILTER_DATA_SIZE (1024) Number of elements allowed: A single string that can contain multiple
/// package IDs separated by semicolons.
/// </term>
/// </item>
/// <item>
/// <term>EVENT_FILTER_TYPE_PACKAGE_APP_ID</term>
/// <term>
/// Filter size limit: MAX_EVENT_FILTER_DATA_SIZE (1024) Number of elements allowed: A single string that can contain multiple
/// package relative app IDs (PRAIDs) separated by semicolons.
/// </term>
/// </item>
/// <item>
/// <term>EVENT_FILTER_TYPE_PAYLOAD</term>
/// <term>Filter size limit: 1MAX_EVENT_FILTER_PAYLOAD_SIZE (4096) Number of elements allowed: 1</term>
/// </item>
/// <item>
/// <term>EVENT_FILTER_TYPE_EVENT_ID</term>
/// <term>Filter size limit: Not defined Number of elements allowed: MAX_EVENT_FILTER_EVENT_ID_COUNT (64)</term>
/// </item>
/// <item>
/// <term>EVENT_FILTER_TYPE_STACKWALK</term>
/// <term>Filter size limit: Not defined Number of elements allowed: MAX_EVENT_FILTER_EVENT_ID_COUNT (64)</term>
/// </item>
/// </list>
/// <para>
/// To include all events that a provider provides, set MatchAnyKeyword to zero (for a manifest-based provider or TraceLogging
/// provider and 0xFFFFFFFF for a classic provider). To include specific events, set the MatchAnyKeyword mask to those specific
/// events. To indicate that you wish to enable a Provider Group, use the EVENT_ENABLE_PROPERTY_PROVIDER_GROUP flag on the
/// <c>EnableProperty</c> member of EnableParameters. For example, if the provider defines an event for its initialization and
/// cleanup routines (set keyword bit 0), an event for its file operations (set keyword bit 1), and an event for its calculation
/// operations (set keyword bit 2), you can set MatchAnyKeyword to 5 to receive initialization and cleanup events and calculation events.
/// </para>
/// <para>
/// If the provider defines more complex event keywords, for example, the provider defines an event that sets bit 0 for read and bit
/// 1 for local access and a second event that sets bit 0 for read and bit 2 for remote access, you could set MatchAnyKeyword to 1 to
/// receive all read events, or you could set MatchAnykeyword to 1 and MatchAllKeywords to 3 to receive local reads only.
/// </para>
/// <para>
/// If an event's keyword is zero, the provider will write the event to the session, regardless of the MatchAnyKeyword and
/// MatchAllKeyword masks.
/// </para>
/// <para>
/// When you call <c>EnableTraceEx2</c> the provider may or may not be registered. If the provider is registered, ETW calls the
/// provider's callback function, if it implements one, and the session begins receiving events. If the provider is not registered,
/// ETW will call the provider's callback function when it registers itself, if it implements one, and the session will begin
/// receiving events. If the provider is not registered, the provider's callback function will not receive the source ID or filter
/// data. You can call <c>EnableTraceEx2</c> one time to enable a provider before the provider registers itself.
/// </para>
/// <para>
/// If the provider is registered and already enabled to your session, you can also use this function to update the Level,
/// MatchAnyKeyword, MatchAllKeyword parameters, and the <c>EnableProperty</c> and <c>EnableFilterDesc</c> members of EnableParameters.
/// </para>
/// <para>
/// On Windows 8.1,Windows Server 2012 R2, and later, event payload , scope, and stack walk filters can be used by the
/// <c>EnableTraceEx2</c> function and the <c>ENABLE_TRACE_PARAMETERS</c> and <c>EVENT_FILTER_DESCRIPTOR</c> structures to filter on
/// specific conditions in a logger session. For more information on event payload filters, see the <c>TdhCreatePayloadFilter</c>,
/// and <c>TdhAggregatePayloadFilters</c> functions and the <c>ENABLE_TRACE_PARAMETERS</c>, <c>EVENT_FILTER_DESCRIPTOR</c>, and
/// <c>PAYLOAD_FILTER_PREDICATE</c> structures.
/// </para>
/// <para>
/// You do not call <c>EnableTraceEx2</c> to enable kernel providers. To enable kernel providers, set the <c>EnableFlags</c> member
/// of <c>EVENT_TRACE_PROPERTIES</c> which you then pass to <c>StartTrace</c>. The <c>StartTrace</c> function enables the selected
/// kernel providers.
/// </para>
/// <para>
/// Up to eight trace sessions can enable and receive events from the same manifest-based provider or TraceLogging provider; however,
/// only one trace session can enable a classic provider. If more than one session tried to enable a classic provider, the first
/// session would stop receiving events when the second session enabled the same provider. For example, if Session A enabled Provider
/// 1 and then Session B enabled Provider 1, only Session B would receive events from Provider 1.
/// </para>
/// <para>
/// The provider remains enabled for the session until the session disables the provider. If the application that started the session
/// ends without disabling the provider, the provider remains enabled.
/// </para>
/// <para>To determine the level and keywords used to enable a manifest-based provider, use one of the following commands:</para>
/// <list type="bullet">
/// <item>
/// <term>Logman query providers</term>
/// </item>
/// <item>
/// <term>Wevtutil gp</term>
/// </item>
/// </list>
/// <para>
/// For classic providers, it is up to the provider to document and make available to potential controllers the severity levels or
/// enable flags that it supports. If the provider wants to be enabled by any controller, the provider should accept 0 for the
/// severity level and enable flags and interpret 0 as a request to perform default logging (whatever that may be).
/// </para>
/// <para>If you use <c>EnableTraceEx2</c> to enable a classic provider, the following translation occurs:</para>
/// <list type="bullet">
/// <item>
/// <term>The Level parameter is the same as setting the EnableLevel parameter in <c>EnableTrace</c>.</term>
/// </item>
/// <item>
/// <term>
/// The MatchAnyKeyword is the same as setting the EnableFlag parameter in <c>EnableTrace</c> except that the keyword value is
/// truncated from a ULONGLONG to a ULONG value.
/// </term>
/// </item>
/// <item>
/// <term>
/// In the ControlCallback callback, the provider can call <c>GetTraceEnableLevel</c> to get the level and <c>GetTraceEnableFlags</c>
/// to get the enable flag.
/// </term>
/// </item>
/// <item>
/// <term>The other parameter are not used.</term>
/// </item>
/// </list>
/// <para>
/// If <c>EnableTraceEx2</c> returns <c>ERROR_INVALID_PARAMETER</c> when enabling filtering, you can turn on tracing to view
/// debugging messages about the failure. This requires a checked build.
/// </para>
/// </remarks>
// https://docs.microsoft.com/en-us/windows/desktop/ETW/enabletraceex2 ULONG EnableTraceEx2( _In_ TRACEHANDLE TraceHandle, _In_
// LPCGUID ProviderId, _In_ ULONG ControlCode, _In_ UCHAR Level, _In_ ULONGLONG MatchAnyKeyword, _In_ ULONGLONG MatchAllKeyword, _In_
// ULONG Timeout, _In_opt_ PENABLE_TRACE_PARAMETERS EnableParameters );
[DllImport(Lib.AdvApi32, SetLastError = false, ExactSpelling = true)]
[PInvokeData("evntrace.h", MSDNShortId = "3aceffb6-614f-4cad-bbec-f181f0cbdbff")]
public static extern Win32Error EnableTraceEx2(TRACEHANDLE TraceHandle, in Guid ProviderId, EVENT_CONTROL_CODE ControlCode, TRACE_LEVEL Level, [Optional] ulong MatchAnyKeyword, [Optional] ulong MatchAllKeyword, [Optional] uint Timeout, [Optional] IntPtr EnableParameters);
/// <summary>
/// The <c>EnumerateTraceGuids</c> function retrieves information about registered event trace providers that are running on the computer.
/// </summary>
/// <param name="GuidPropertiesArray">An array of pointers to <c>TRACE_GUID_PROPERTIES</c> structures.</param>
/// <param name="PropertyArrayCount">Number of elements in the GuidPropertiesArray array.</param>
/// <param name="GuidCount">Actual number of event tracing providers registered on the computer.</param>
/// <returns>
/// <para>If the function succeeds, the return value is ERROR_SUCCESS.</para>
/// <para>
/// If the function fails, the return value is one of the system error codes. The following table includes some common errors and
/// their causes.
/// </para>
/// <list type="table">
/// <listheader>
/// <term>Return code</term>
/// <term>Description</term>
/// </listheader>
/// <item>
/// <term>ERROR_INVALID_PARAMETER</term>
/// <term>One of the following is true:</term>
/// </item>
/// <item>
/// <term>ERROR_MORE_DATA</term>
/// <term>
/// The property array is too small to receive information for all registered providers (GuidCount is greater than
/// PropertyArrayCount). The function fills the GUID property array with the number of structures specified in PropertyArrayCount.
/// </term>
/// </item>
/// </list>
/// </returns>
/// <remarks>
/// <para>Event trace controllers call this function.</para>
/// <para>For information on registering event trace providers, see <c>RegisterTraceGuids</c>.</para>
/// <para>
/// You can use the <c>TRACE_GUID_PROPERTIES.LoggerId</c> member to determine which session enabled the provider if
/// <c>TRACE_GUID_PROPERTIES.IsEnable</c> is <c>TRUE</c>.
/// </para>
/// <para>The list will not include kernel providers.</para>
/// </remarks>
// https://docs.microsoft.com/en-us/windows/desktop/ETW/enumeratetraceguids ULONG EnumerateTraceGuids( _Inout_ PTRACE_GUID_PROPERTIES
// *GuidPropertiesArray, _In_ ULONG PropertyArrayCount, _Out_ PULONG GuidCount );
[DllImport(Lib.AdvApi32, SetLastError = false, ExactSpelling = true)]
[PInvokeData("evntrace.h", MSDNShortId = "9a9e2f53-9916-4a9c-a08e-c8affd5fc4c9")]
public static extern Win32Error EnumerateTraceGuids([In, Out, MarshalAs(UnmanagedType.LPArray, SizeParamIndex = 1)] IntPtr[] GuidPropertiesArray, uint PropertyArrayCount, out uint GuidCount);
/// <summary>Use this function to retrieve information about trace providers that are registered on the computer.</summary>
/// <param name="TraceQueryInfoClass">
/// Determines the type of information to include with the list of registered providers. For possible values, see the
/// <c>TRACE_QUERY_INFO_CLASS</c> enumeration.
/// </param>
/// <param name="InBuffer">
/// GUID of the provider or provider group whose information you want to retrieve. Specify the GUID only if TraceQueryInfoClass is
/// <c>TraceGuidQueryInfo</c> or <c>TraceGroupQueryInfo</c>.
/// </param>
/// <param name="InBufferSize">Size, in bytes, of the data InBuffer.</param>
/// <param name="OutBuffer">
/// Application-allocated buffer that contains the enumerated information. The format of the information depends on the value of
/// TraceQueryInfoClass. For details, see Remarks.
/// </param>
/// <param name="OutBufferSize">
/// Size, in bytes, of the OutBuffer buffer. If the function succeeds, the ReturnLength parameter receives the size of the buffer
/// used. If the buffer is too small, the function returns ERROR_INSUFFICIENT_BUFFER and the ReturnLength parameter receives the
/// required buffer size. If the buffer size is zero on input, no data is returned in the buffer and the ReturnLength parameter
/// receives the required buffer size.
/// </param>
/// <param name="ReturnLength">Actual size of the data in OutBuffer, in bytes.</param>
/// <returns>
/// <para>If the function succeeds, the return value is ERROR_SUCCESS.</para>
/// <para>
/// If the function fails, the return value is one of the system error codes. The following table includes some common errors and
/// their causes.
/// </para>
/// <list type="table">
/// <listheader>
/// <term>Return code</term>
/// <term>Description</term>
/// </listheader>
/// <item>
/// <term>ERROR_INVALID_PARAMETER</term>
/// <term>One of the parameters is not valid.</term>
/// </item>
/// <item>
/// <term>ERROR_INSUFFICIENT_BUFFER</term>
/// <term>
/// The OutBuffer buffer is too small to receive information for all registered providers. Reallocate the buffer using the size
/// returned in ReturnLength.
/// </term>
/// </item>
/// </list>
/// </returns>
/// <remarks>
/// <para>Event trace controllers call this function.</para>
/// <para>
/// If TraceQueryInfoClass is <c>TraceGuidQueryInfo</c>, ETW returns the data in a <c>TRACE_GUID_INFO</c> block that is a header to
/// the information. The info block contains a <c>TRACE_PROVIDER_INSTANCE_INFO</c> block for each provider that uses the same GUID.
/// Each instance info block contains a <c>TRACE_ENABLE_INFO</c> structure for each session that enabled the provider.
/// </para>
/// <para>For information on registering event trace providers, see <c>EventRegister</c> and <c>RegisterTraceGuids</c>.</para>
/// </remarks>
// https://docs.microsoft.com/en-us/windows/desktop/ETW/enumeratetraceguidsex ULONG WINAPI EnumerateTraceGuidsEx( _In_
// TRACE_QUERY_INFO_CLASS TraceQueryInfoClass, _In_ PVOID InBuffer, _In_ ULONG InBufferSize, _Out_ PVOID OutBuffer, _In_ ULONG
// OutBufferSize, _Out_ PULONG ReturnLength );
[DllImport(Lib.AdvApi32, SetLastError = false, ExactSpelling = true)]
[PInvokeData("evntrace.h", MSDNShortId = "9d70fe21-1750-4d60-a825-2004f7d666c7")]
public static extern Win32Error EnumerateTraceGuidsEx(TRACE_QUERY_INFO_CLASS TraceQueryInfoClass, IntPtr InBuffer, uint InBufferSize, IntPtr OutBuffer, uint OutBufferSize, out uint ReturnLength);
/// <summary>Use this function to retrieve information about trace providers that are registered on the computer.</summary>
/// <typeparam name="TOut">The type of the expected enumeration value that is output.</typeparam>
/// <typeparam name="TIn">The type of the input value.</typeparam>
/// <param name="TraceQueryInfoClass">
/// Determines the type of information to include with the list of registered providers. For possible values, see the
/// <c>TRACE_QUERY_INFO_CLASS</c> enumeration.
/// </param>
/// <param name="InBuffer">
/// GUID of the provider or provider group whose information you want to retrieve. Specify the GUID only if TraceQueryInfoClass is
/// <c>TraceGuidQueryInfo</c> or <c>TraceGroupQueryInfo</c>.
/// </param>
/// <returns>
/// The enumerated information. The format of the information depends on the value of TraceQueryInfoClass. For details, see Remarks.
/// </returns>
/// <remarks>
/// <para>Event trace controllers call this function.</para>
/// <para>
/// If TraceQueryInfoClass is <c>TraceGuidQueryInfo</c>, ETW returns the data in a <c>TRACE_GUID_INFO</c> block that is a header to
/// the information. The info block contains a <c>TRACE_PROVIDER_INSTANCE_INFO</c> block for each provider that uses the same GUID.
/// Each instance info block contains a <c>TRACE_ENABLE_INFO</c> structure for each session that enabled the provider.
/// </para>
/// <para>For information on registering event trace providers, see <c>EventRegister</c> and <c>RegisterTraceGuids</c>.</para>
/// </remarks>
[PInvokeData("evntrace.h", MSDNShortId = "9d70fe21-1750-4d60-a825-2004f7d666c7")]
public static IEnumerable<TOut> EnumerateTraceGuidsEx<TOut, TIn>(TRACE_QUERY_INFO_CLASS TraceQueryInfoClass, in TIn InBuffer) where TOut : struct where TIn : struct
{
using (var buffer = EnumerateTraceGuidsEx<TIn>(TraceQueryInfoClass, InBuffer))
return buffer.ToArray<TOut>(buffer.Size / Marshal.SizeOf(typeof(TOut)));
}
/// <summary>Use this function to retrieve information about trace providers that are registered on the computer.</summary>
/// <typeparam name="TOut">The type of the expected enumeration value that is output.</typeparam>
/// <param name="TraceQueryInfoClass">
/// Determines the type of information to include with the list of registered providers. For possible values, see the
/// <c>TRACE_QUERY_INFO_CLASS</c> enumeration.
/// </param>
/// <returns>
/// The enumerated information. The format of the information depends on the value of TraceQueryInfoClass. For details, see Remarks.
/// </returns>
/// <remarks>
/// <para>Event trace controllers call this function.</para>
/// <para>
/// If TraceQueryInfoClass is <c>TraceGuidQueryInfo</c>, ETW returns the data in a <c>TRACE_GUID_INFO</c> block that is a header to
/// the information. The info block contains a <c>TRACE_PROVIDER_INSTANCE_INFO</c> block for each provider that uses the same GUID.
/// Each instance info block contains a <c>TRACE_ENABLE_INFO</c> structure for each session that enabled the provider.
/// </para>
/// <para>For information on registering event trace providers, see <c>EventRegister</c> and <c>RegisterTraceGuids</c>.</para>
/// </remarks>
[PInvokeData("evntrace.h", MSDNShortId = "9d70fe21-1750-4d60-a825-2004f7d666c7")]
public static IEnumerable<TOut> EnumerateTraceGuidsEx<TOut>(TRACE_QUERY_INFO_CLASS TraceQueryInfoClass) where TOut : struct
{
using (var buffer = EnumerateTraceGuidsEx<int>(TraceQueryInfoClass, null))
return buffer.ToArray<TOut>(buffer.Size / Marshal.SizeOf(typeof(TOut)));
}
/// <summary>Use this function to retrieve information about trace providers that are registered on the computer.</summary>
/// <typeparam name="TIn">The type of the input value.</typeparam>
/// <param name="TraceQueryInfoClass">
/// Determines the type of information to include with the list of registered providers. For possible values, see the
/// <c>TRACE_QUERY_INFO_CLASS</c> enumeration.
/// </param>
/// <param name="InBuffer">
/// GUID of the provider or provider group whose information you want to retrieve. Specify the GUID only if TraceQueryInfoClass is
/// <c>TraceGuidQueryInfo</c> or <c>TraceGroupQueryInfo</c>.
/// </param>
/// <returns>
/// The enumerated information as a memory allocation. The format of the information depends on the value of TraceQueryInfoClass. For
/// details, see Remarks.
/// </returns>
/// <remarks>
/// <para>Event trace controllers call this function.</para>
/// <para>
/// If TraceQueryInfoClass is <c>TraceGuidQueryInfo</c>, ETW returns the data in a <c>TRACE_GUID_INFO</c> block that is a header to
/// the information. The info block contains a <c>TRACE_PROVIDER_INSTANCE_INFO</c> block for each provider that uses the same GUID.
/// Each instance info block contains a <c>TRACE_ENABLE_INFO</c> structure for each session that enabled the provider.
/// </para>
/// <para>For information on registering event trace providers, see <c>EventRegister</c> and <c>RegisterTraceGuids</c>.</para>
/// </remarks>
[PInvokeData("evntrace.h", MSDNShortId = "9d70fe21-1750-4d60-a825-2004f7d666c7")]
public static SafeHGlobalHandle EnumerateTraceGuidsEx<TIn>(TRACE_QUERY_INFO_CLASS TraceQueryInfoClass, TIn? InBuffer = null) where TIn : struct
{
using (var input = InBuffer.HasValue ? SafeHGlobalHandle.CreateFromStructure(InBuffer.Value) : SafeHGlobalHandle.Null)
{
var err = EnumerateTraceGuidsEx(TraceQueryInfoClass, input, input.Size, IntPtr.Zero, 0, out var sz);
if (err != Win32Error.ERROR_INSUFFICIENT_BUFFER)
throw err.GetException();
var output = new SafeHGlobalHandle(sz);
while ((err = EnumerateTraceGuidsEx(TraceQueryInfoClass, input, input.Size, output, output.Size, out sz)) == Win32Error.ERROR_INSUFFICIENT_BUFFER)
output.Size = sz;
if (err.Failed)
throw err.GetException();
return output;
}
}
/// <summary>Adds or modifies the permissions of the specified provider or session.</summary>
/// <param name="Guid">GUID that uniquely identifies the provider or session whose permissions you want to add or modify.</param>
/// <param name="Operation">
/// Type of operation to perform, for example, add a DACL to the session's GUID or provider's GUID. For possible values, see the
/// EVENTSECURITYOPERATION enumeration.
/// </param>
/// <param name="Sid">The security identifier (SID) of the user or group to whom you want to grant or deny permissions.</param>
/// <param name="Rights">You can specify one or more of the following permissions:</param>
/// <param name="AllowOrDeny">
/// If <c>TRUE</c>, grant the user permissions to the session or provider; otherwise, deny permissions. This value is ignored if the
/// value of Operation is EventSecuritySetSACL or EventSecurityAddSACL.
/// </param>
/// <returns>Returns ERROR_SUCCESS if successful.</returns>
/// <remarks>
/// <para>
/// By default, only the administrator of the computer, users in the Performance Log Users group, and services running as
/// LocalSystem, LocalService, NetworkService can control trace sessions and provide and consume event data. Only users with
/// administrative privileges and services running as LocalSystem can start and control an NT Kernel Logger session.
/// </para>
/// <para>
/// <c>Windows Server 2003:</c> Only users with administrator privileges can control trace sessions and consume event data; any user
/// can provide event data.
/// </para>
/// <para><c>Windows XP and Windows 2000:</c> Any user can control trace sessions and provide and consume event data.</para>
/// <para>
/// Users with administrator privileges can control trace sessions if the tool that they use to control the session is started from a
/// Command Prompt window that is opened with <c>Run as administrator...</c>.
/// </para>
/// <para>
/// To grant a restricted user the ability to control trace sessions, you can add them to the Performance Log Users group or call
/// this function to grant them permission. For example, you can grant user A permission to start and stop a trace session and grant
/// user B permission to only query the session.
/// </para>
/// <para>To restrict who can log events to the session, see the TRACELOG_LOG_EVENT permission.</para>
/// <para>
/// The ACL on the log file determines who can consume event data from the log file. To consume events from a session in real-time,
/// you must grant the user TRACELOG_ACCESS_REALTIME permission or the user must be a member of the Performance Log Users group.
/// </para>
/// <para>You can also specify the provider's GUID to restrict who can register the provider and who can enable the provider.</para>
/// </remarks>
// https://docs.microsoft.com/en-us/windows/desktop/api/evntcons/nf-evntcons-eventaccesscontrol ULONG EVNTAPI EventAccessControl(
// LPGUID Guid, ULONG Operation, PSID Sid, ULONG Rights, BOOLEAN AllowOrDeny );
[DllImport(Lib.AdvApi32, SetLastError = false, ExactSpelling = true)]
[PInvokeData("evntcons.h", MSDNShortId = "699bb165-680f-4d3b-8859-959f319ca4be")]
public static extern Win32Error EventAccessControl(in Guid Guid, EVENTSECURITYOPERATION Operation, PSID Sid, TRACELOG_RIGHTS Rights, [MarshalAs(UnmanagedType.U1)] bool AllowOrDeny);
/// <summary>Retrieves the permissions for the specified controller or provider.</summary>
/// <param name="Guid">GUID that uniquely identifies the provider or session.</param>
/// <param name="Buffer">Application-allocated buffer that will contain the security descriptor of the controller or provider.</param>
/// <param name="BufferSize">
/// Size of the security descriptor buffer, in bytes. If the function succeeds, this parameter receives the size of the buffer used.
/// If the buffer is too small, the function returns ERROR_MORE_DATA and this parameter receives the required buffer size. If the
/// buffer size is zero on input, no data is returned in the buffer and this parameter receives the required buffer size.
/// </param>
/// <returns>
/// <para>Returns ERROR_SUCCESS if successful.</para>
/// <para>The function returns the following return code if an error occurs:</para>
/// <list type="table">
/// <listheader>
/// <term>Return code</term>
/// <term>Description</term>
/// </listheader>
/// <item>
/// <term>ERROR_MORE_DATA</term>
/// <term>The buffer is too small to receive the security descriptor. Reallocate the buffer using the size returned in BufferSize.</term>
/// </item>
/// </list>
/// </returns>
/// <remarks>
/// <para>
/// If the GUID does not exist in the registry, ETW returns the default permissions for a provider or controller. For details on
/// specifying the GUID in the registry, see EventAccessControl.
/// </para>
/// <para>
/// For information on accessing the components of the security descriptor, see Getting Information from an ACL, the
/// GetSecurityDescriptorDacl, GetSecurityDescriptorSacl, and GetAce functions, and the ACE structure.
/// </para>
/// </remarks>
// https://docs.microsoft.com/en-us/windows/desktop/api/evntcons/nf-evntcons-eventaccessquery ULONG EVNTAPI EventAccessQuery( LPGUID
// Guid, PSECURITY_DESCRIPTOR Buffer, PULONG BufferSize );
[DllImport(Lib.AdvApi32, SetLastError = false, ExactSpelling = true)]
[PInvokeData("evntcons.h", MSDNShortId = "21c87137-0e8f-43d1-9dad-9f2b4fc591a3")]
public static extern Win32Error EventAccessQuery(in Guid Guid, SafePSECURITY_DESCRIPTOR Buffer, ref uint BufferSize);
/// <summary>Removes the permissions defined in the registry for the specified provider or session.</summary>
/// <param name="Guid">GUID that uniquely identifies the provider or session whose permissions you want to remove from the registry.</param>
/// <returns>Returns ERROR_SUCCESS if successful.</returns>
/// <remarks>
/// After removing the permission from the registry, the default permissions apply to the provider or session. For details on the
/// default permissions, see EventAccessControl.
/// </remarks>
// https://docs.microsoft.com/en-us/windows/desktop/api/evntcons/nf-evntcons-eventaccessremove ULONG EVNTAPI EventAccessRemove(
// LPGUID Guid );
[DllImport(Lib.AdvApi32, SetLastError = false, ExactSpelling = true)]
[PInvokeData("evntcons.h", MSDNShortId = "9f25f163-046c-41b0-82f9-0b214b74b87e")]
public static extern Win32Error EventAccessRemove(in Guid Guid);
/// <summary>
/// <para>
/// The <c>FlushTrace</c> function causes an event tracing session to immediately deliver buffered events for the specified session.
/// (An event tracing session does not deliver events until an active buffer is full.)
/// </para>
/// <para>The ControlTrace function supersedes this function.</para>
/// </summary>
/// <param name="TraceHandle">
/// Handle to the event tracing session for whose buffers you want to flush, or <c>NULL</c>. You must specify SessionHandle if
/// SessionName is <c>NULL</c>. However, ETW ignores the handle if SessionName is not <c>NULL</c>. The handle is returned by the
/// StartTrace function.
/// </param>
/// <param name="InstanceName">
/// <para>
/// Pointer to a null-terminated string that specifies the name of the event tracing session whose buffers you want to flush, or
/// <c>NULL</c>. You must specify SessionName if SessionHandle is <c>NULL</c>.
/// </para>
/// <para>To specify the NT Kernel Logger session, set SessionName to <c>KERNEL_LOGGER_NAME</c>.</para>
/// </param>
/// <param name="Properties">
/// <para>Pointer to an initialized EVENT_TRACE_PROPERTIES structure.</para>
/// <para>
/// If you are using a newly initialized structure, you only need to set the <c>Wnode.BufferSize</c>, <c>Wnode.Guid</c>,
/// <c>LoggerNameOffset</c>, and <c>LogFileNameOffset</c> members of the structure. You can use the maximum session name (1024
/// characters) and maximum log file name (1024 characters) lengths to calculate the buffer size and offsets if not known.
/// </para>
/// <para>
/// On output, the structure receives the property settings and session statistics of the event tracing session, which reflect the
/// state of the session after the flush.
/// </para>
/// </param>
/// <returns>
/// <para>If the function succeeds, the return value is ERROR_SUCCESS.</para>
/// <para>
/// If the function fails, the return value is one of the system error codes. The following table includes some common errors and
/// their causes.
/// </para>
/// <list type="table">
/// <listheader>
/// <term>Return code</term>
/// <term>Description</term>
/// </listheader>
/// <item>
/// <term>ERROR_INVALID_PARAMETER</term>
/// <term>One of the following is true:</term>
/// </item>
/// <item>
/// <term>ERROR_BAD_LENGTH</term>
/// <term>One of the following is true:</term>
/// </item>
/// <item>
/// <term>ERROR_ACCESS_DENIED</term>
/// <term>
/// Only users with administrative privileges, users in the Performance Log Users group, and services running as LocalSystem,
/// LocalService, NetworkService can control event tracing sessions. To grant a restricted user the ability to control trace
/// sessions, add them to the Performance Log Users group. Windows XP and Windows 2000: Anyone can control a trace session.
/// </term>
/// </item>
/// </list>
/// </returns>
/// <remarks>
/// <para>Controllers call this function.</para>
/// <para>
/// Typically, you do not need to flush buffers yourself. However, you may want to flush buffers if the event rate is low and you are
/// delivering events in real time.
/// </para>
/// <para>Note that it is not safe to flush buffers from DllMain.</para>
/// </remarks>
// https://docs.microsoft.com/en-us/windows/desktop/api/evntrace/nf-evntrace-flushtracea ULONG WMIAPI FlushTraceA( TRACEHANDLE
// TraceHandle, LPCSTR InstanceName, PEVENT_TRACE_PROPERTIES Properties );
[DllImport(Lib.AdvApi32, SetLastError = false, CharSet = CharSet.Auto)]
[PInvokeData("evntrace.h", MSDNShortId = "bc7d0dac-93d9-4614-9cb6-fee99765eb39")]
public static extern Win32Error FlushTrace(TRACEHANDLE TraceHandle, string InstanceName, ref EVENT_TRACE_PROPERTIES Properties);
/// <summary>
/// <para>
/// The <c>GetTraceEnableFlags</c> function retrieves the enable flags passed by the controller to indicate which category of events
/// to trace.
/// </para>
/// <para>Providers can only call this function from their <c>ControlCallback</c> function.</para>
/// </summary>
/// <param name="SessionHandle">Handle to an event tracing session, obtained by calling the <c>GetTraceLoggerHandle</c> function.</param>
/// <returns>
/// <para>Returns the value the controller specified in the EnableFlag parameter when calling the <c>EnableTrace</c> function.</para>
/// <para>To determine if the function failed or the controller set the enable flags to 0, follow these steps:</para>
/// <list type="bullet">
/// <item>
/// <term>Call the <c>SetLastError</c> function to set the last error to <c>ERROR_SUCCESS</c>.</term>
/// </item>
/// <item>
/// <term>Call the <c>GetTraceEnableFlags</c> function to retrieve the enable flags.</term>
/// </item>
/// <item>
/// <term>If the enable flags value is 0, call the <c>GetLastError</c> function to retrieve the last known error.</term>
/// </item>
/// <item>
/// <term>
/// If the last known error is <c>ERROR_SUCCESS</c>, the controller set the enable flags to 0; otherwise, the
/// <c>GetTraceEnableFlags</c> function failed with the last known error.
/// </term>
/// </item>
/// </list>
/// </returns>
/// <remarks>
/// Providers can use this value to control which events that it generates. For example, a provider can group events into logical
/// categories of events and use this value to enable or disable their generation.
/// </remarks>
// https://docs.microsoft.com/en-us/windows/desktop/ETW/gettraceenableflags ULONG GetTraceEnableFlags( _In_ TRACEHANDLE SessionHandle );
[DllImport(Lib.AdvApi32, SetLastError = true, ExactSpelling = true)]
[PInvokeData("Evntrace.h", MSDNShortId = "e5c0f2bf-34da-4555-9556-4c79ee9a73ab")]
public static extern uint GetTraceEnableFlags(TRACEHANDLE SessionHandle);
/// <summary>
/// <para>
/// The <c>GetTraceEnableLevel</c> function retrieves the severity level passed by the controller to indicate the level of logging
/// the provider should perform.
/// </para>
/// <para>Providers can only call this function from their <c>ControlCallback</c> function.</para>
/// </summary>
/// <param name="SessionHandle">Handle to an event tracing session, obtained by calling the <c>GetTraceLoggerHandle</c> function.</param>
/// <returns>
/// <para>Returns the value the controller specified in the EnableLevel parameter when calling the <c>EnableTrace</c> function.</para>
/// <para>To determine if the function failed or the controller set the enable flags to 0, follow these steps:</para>
/// <list type="bullet">
/// <item>
/// <term>Call the <c>SetLastError</c> function to set the last error to <c>ERROR_SUCCESS</c>.</term>
/// </item>
/// <item>
/// <term>Call the <c>GetTraceEnableLevel</c> function to retrieve the enable level.</term>
/// </item>
/// <item>
/// <term>If the enable level value is 0, call the <c>GetLastError</c> function to retrieve the last known error.</term>
/// </item>
/// <item>
/// <term>
/// If the last known error is <c>ERROR_SUCCESS</c>, the controller set the enable level to 0; otherwise, the
/// <c>GetTraceEnableLevel</c> function failed with the last known error.
/// </term>
/// </item>
/// </list>
/// </returns>
/// <remarks>
/// Providers use this value to control the severity of events that it generates. For example, providers can use this value to
/// determine if it should generate informational, warning, or error events.
/// </remarks>
// https://docs.microsoft.com/en-us/windows/desktop/ETW/gettraceenablelevel UCHAR GetTraceEnableLevel( _In_ TRACEHANDLE SessionHandle );
[DllImport(Lib.AdvApi32, SetLastError = true, ExactSpelling = true)]
[PInvokeData("Evntrace.h", MSDNShortId = "22326fd9-c428-4430-8a92-978d005f6705")]
public static extern TRACE_LEVEL GetTraceEnableLevel(TRACEHANDLE SessionHandle);
/// <summary>
/// <para>The <c>GetTraceLoggerHandle</c> function retrieves the handle of the event tracing session.</para>
/// <para>Providers can only call this function from their <c>ControlCallback</c> function.</para>
/// </summary>
/// <param name="Buffer">
/// <para>
/// Pointer to a <c>WNODE_HEADER</c> structure. ETW passes this structure to the provider's <c>ControlCallback</c> function in the
/// Buffer parameter.
/// </para>
/// <para>The <c>HistoricalContext</c> member of <c>WNODE_HEADER</c> contains the session's handle.</para>
/// </param>
/// <returns>
/// <para>If the function succeeds, it returns the event tracing session handle.</para>
/// <para>
/// If the function fails, it returns <c>INVALID_HANDLE_VALUE</c>. To get extended error information, call the <c>GetLastError</c> function.
/// </para>
/// </returns>
/// <remarks>
/// You use the handle when calling the <c>GetTraceEnableFlags</c> and <c>GetTraceEnableLevel</c> functions to retrieve the enable
/// flags and level values passed to the <c>EnableTrace</c> function.
/// </remarks>
// https://docs.microsoft.com/en-us/windows/desktop/ETW/gettraceloggerhandle TRACEHANDLE GetTraceLoggerHandle( _In_ PVOID Buffer );
[DllImport(Lib.AdvApi32, SetLastError = true, ExactSpelling = true)]
[PInvokeData("Evntrace.h", MSDNShortId = "050d3a01-0087-40f1-af35-b9ceeaf47813")]
public static extern TRACEHANDLE GetTraceLoggerHandle(IntPtr Buffer);
/// <summary>The <c>OpenTrace</c> function opens a real-time trace session or log file for consuming.</summary>
/// <param name="Logfile">
/// Pointer to an EVENT_TRACE_LOGFILE structure. The structure specifies the source from which to consume events (from a log file or
/// the session in real time) and specifies the callbacks the consumer wants to use to receive the events.
/// </param>
/// <returns>
/// <para>If the function succeeds, it returns a handle to the trace.</para>
/// <para>If the function fails, it returns INVALID_PROCESSTRACE_HANDLE.</para>
/// <para>
/// <c>Note</c> If your code base supports Windows 7 and Windows Vista, and also supports earlier operating systems such as Windows
/// XP and Windows Server 2003, do not use the constants described above. Instead, determine the operating system on which you are
/// running and compare the return value to the following values.
/// </para>
/// <para>
/// If the function returns INVALID_PROCESSTRACE_HANDLE, you can use the GetLastError function to obtain extended error information.
/// The following table lists some common errors and their causes.
/// </para>
/// <list type="table">
/// <listheader>
/// <term>Return code</term>
/// <term>Description</term>
/// </listheader>
/// <item>
/// <term>ERROR_INVALID_PARAMETER</term>
/// <term>The Logfile parameter is NULL.</term>
/// </item>
/// <item>
/// <term>ERROR_BAD_PATHNAME</term>
/// <term>If you did not specify the LoggerName member of EVENT_TRACE_LOGFILE, you must specify a valid log file name.</term>
/// </item>
/// <item>
/// <term>ERROR_ACCESS_DENIED</term>
/// <term>
/// Only users with administrative privileges, users in the Performance Log Users group, and services running as LocalSystem,
/// LocalService, NetworkService can consume events in real time. To grant a restricted user the ability to consume events in real
/// time, add them to the Performance Log Users group. Windows XP and Windows 2000: Anyone can consume real time events.
/// </term>
/// </item>
/// </list>
/// </returns>
/// <remarks>
/// <para>Consumers call this function.</para>
/// <para>
/// After calling <c>OpenTrace</c>, call the ProcessTrace function to process the events. When you have finished processing events,
/// call the CloseTrace function.
/// </para>
/// <para>Note that you can process events from only one real-time session.</para>
/// <para>
/// Windows Vista and earlier: If the function fails it will returns INVALID_HANDLE_VALUE. To avoid compile-time errors, cast
/// INVALID_HANDLE_VALUE to TRACEHANDLE as follows: .
/// </para>
/// <para>Examples</para>
/// <para>
/// For an example that uses <c>OpenTrace</c>, see Using TdhFormatProperty to Consume Event Data or Retrieving Event Data Using MOF.
/// </para>
/// </remarks>
// https://docs.microsoft.com/en-us/windows/desktop/api/evntrace/nf-evntrace-opentracea TRACEHANDLE WMIAPI OpenTraceA(
// PEVENT_TRACE_LOGFILEA Logfile );
[DllImport(Lib.AdvApi32, SetLastError = true, CharSet = CharSet.Auto)]
[PInvokeData("evntrace.h", MSDNShortId = "505e643b-6b4f-4f93-96c8-7fe8abdd6234")]
public static extern TRACEHANDLE OpenTrace(ref EVENT_TRACE_LOGFILE Logfile);
/// <summary>The <c>ProcessTrace</c> function delivers events from one or more event tracing sessions to the consumer.</summary>
/// <param name="HandleArray">
/// <para>
/// Pointer to an array of trace handles obtained from earlier calls to the <c>OpenTrace</c> function. The number of handles that you
/// can specify is limited to 64.
/// </para>
/// <para>The array can contain the handles to multiple log files, but only one real-time trace session.</para>
/// </param>
/// <param name="HandleCount">Number of elements in HandleArray.</param>
/// <param name="StartTime">
/// Pointer to an optional <c>FILETIME</c> structure that specifies the beginning time period for which you want to receive events.
/// The function does not deliver events recorded prior to StartTime.
/// </param>
/// <param name="EndTime">
/// <para>
/// Pointer to an optional <c>FILETIME</c> structure that specifies the ending time period for which you want to receive events. The
/// function does not deliver events recorded after EndTime.
/// </para>
/// <para><c>Windows Server 2003:</c> This value is ignored for real-time event delivery.</para>
/// </param>
/// <returns>
/// <para>If the function succeeds, the return value is ERROR_SUCCESS.</para>
/// <para>
/// If the function fails, the return value is one of the system error codes. The following table includes some common errors and
/// their causes.
/// </para>
/// <list type="table">
/// <listheader>
/// <term>Return code</term>
/// <term>Description</term>
/// </listheader>
/// <item>
/// <term>ERROR_BAD_LENGTH</term>
/// <term>HandleCount is not valid or the number of handles is greater than 64.</term>
/// </item>
/// <item>
/// <term>ERROR_INVALID_HANDLE</term>
/// <term>An element of HandleArray is not a valid event tracing session handle.</term>
/// </item>
/// <item>
/// <term>ERROR_INVALID_TIME</term>
/// <term>EndTime is less than StartTime.</term>
/// </item>
/// <item>
/// <term>ERROR_INVALID_PARAMETER</term>
/// <term>HandleArray is NULL.</term>
/// </item>
/// <item>
/// <term>ERROR_NOACCESS</term>
/// <term>An exception occurred in one of the callback functions that receives the events.</term>
/// </item>
/// <item>
/// <term>ERROR_CANCELLED</term>
/// <term>Indicates the consumer canceled processing by returning FALSE in their BufferCallback function.</term>
/// </item>
/// <item>
/// <term>ERROR_WMI_INSTANCE_NOT_FOUND</term>
/// <term>
/// The session from which you are trying to consume events in real time is not running or does not have the real-time trace mode enabled.
/// </term>
/// </item>
/// <item>
/// <term>ERROR_WMI_ALREADY_ENABLED</term>
/// <term>The HandleArray parameter contains the handle to more than one real-time session.</term>
/// </item>
/// </list>
/// </returns>
/// <remarks>
/// <para>Consumers call this function.</para>
/// <para>You must call the <c>OpenTrace</c> function prior to calling <c>ProcessTrace</c>.</para>
/// <para>
/// The <c>ProcessTrace</c> function delivers the events to the consumer's <c>BufferCallback</c>, <c>EventCallback</c>, and
/// <c>EventClassCallback</c> callback functions.
/// </para>
/// <para>
/// The <c>ProcessTrace</c> function sorts the events chronologically and delivers all events generated between StartTime and
/// EndTime. Note that events can appear out of order if the session specifies system time as the clock (low resolution) and the
/// volume of events is high. In this case, it is possible for multiple events to contain the same time stamp. If multiple events
/// contain the same time stamp, ETW cannot guarantee the order of those events.
/// </para>
/// <para>
/// The <c>ProcessTrace</c> function blocks the thread until it delivers all events, the <c>BufferCallback</c> function returns
/// <c>FALSE</c>, or you call <c>CloseTrace</c>. If the consumer is consuming events in real time, the <c>ProcessTrace</c> function
/// returns after the controller stops the trace session. (Note that there may be a several-second delay before the function returns.)
/// </para>
/// <para><c>Windows Server 2003:</c> You can call <c>CloseTrace</c> only after <c>ProcessTrace</c> returns.</para>
/// </remarks>
// https://docs.microsoft.com/en-us/windows/desktop/ETW/processtrace ULONG ProcessTrace( _In_ PTRACEHANDLE HandleArray, _In_ ULONG
// HandleCount, _In_ LPFILETIME StartTime, _In_ LPFILETIME EndTime );
[DllImport(Lib.AdvApi32, SetLastError = false, ExactSpelling = true)]
[PInvokeData("Evntrace.h", MSDNShortId = "aea25a95-f435-4068-9b15-7473f31ebf16")]
public static extern Win32Error ProcessTrace([In, MarshalAs(UnmanagedType.LPArray, SizeParamIndex = 1)] TRACEHANDLE[] HandleArray, uint HandleCount, in FILETIME StartTime, in FILETIME EndTime);
/// <summary>The <c>ProcessTrace</c> function delivers events from one or more event tracing sessions to the consumer.</summary>
/// <param name="HandleArray">
/// <para>
/// Pointer to an array of trace handles obtained from earlier calls to the <c>OpenTrace</c> function. The number of handles that you
/// can specify is limited to 64.
/// </para>
/// <para>The array can contain the handles to multiple log files, but only one real-time trace session.</para>
/// </param>
/// <param name="HandleCount">Number of elements in HandleArray.</param>
/// <param name="StartTime">
/// Pointer to an optional <c>FILETIME</c> structure that specifies the beginning time period for which you want to receive events.
/// The function does not deliver events recorded prior to StartTime.
/// </param>
/// <param name="EndTime">
/// <para>
/// Pointer to an optional <c>FILETIME</c> structure that specifies the ending time period for which you want to receive events. The
/// function does not deliver events recorded after EndTime.
/// </para>
/// <para><c>Windows Server 2003:</c> This value is ignored for real-time event delivery.</para>
/// </param>
/// <returns>
/// <para>If the function succeeds, the return value is ERROR_SUCCESS.</para>
/// <para>
/// If the function fails, the return value is one of the system error codes. The following table includes some common errors and
/// their causes.
/// </para>
/// <list type="table">
/// <listheader>
/// <term>Return code</term>
/// <term>Description</term>
/// </listheader>
/// <item>
/// <term>ERROR_BAD_LENGTH</term>
/// <term>HandleCount is not valid or the number of handles is greater than 64.</term>
/// </item>
/// <item>
/// <term>ERROR_INVALID_HANDLE</term>
/// <term>An element of HandleArray is not a valid event tracing session handle.</term>
/// </item>
/// <item>
/// <term>ERROR_INVALID_TIME</term>
/// <term>EndTime is less than StartTime.</term>
/// </item>
/// <item>
/// <term>ERROR_INVALID_PARAMETER</term>
/// <term>HandleArray is NULL.</term>
/// </item>
/// <item>
/// <term>ERROR_NOACCESS</term>
/// <term>An exception occurred in one of the callback functions that receives the events.</term>
/// </item>
/// <item>
/// <term>ERROR_CANCELLED</term>
/// <term>Indicates the consumer canceled processing by returning FALSE in their BufferCallback function.</term>
/// </item>
/// <item>
/// <term>ERROR_WMI_INSTANCE_NOT_FOUND</term>
/// <term>
/// The session from which you are trying to consume events in real time is not running or does not have the real-time trace mode enabled.
/// </term>
/// </item>
/// <item>
/// <term>ERROR_WMI_ALREADY_ENABLED</term>
/// <term>The HandleArray parameter contains the handle to more than one real-time session.</term>
/// </item>
/// </list>
/// </returns>
/// <remarks>
/// <para>Consumers call this function.</para>
/// <para>You must call the <c>OpenTrace</c> function prior to calling <c>ProcessTrace</c>.</para>
/// <para>
/// The <c>ProcessTrace</c> function delivers the events to the consumer's <c>BufferCallback</c>, <c>EventCallback</c>, and
/// <c>EventClassCallback</c> callback functions.
/// </para>
/// <para>
/// The <c>ProcessTrace</c> function sorts the events chronologically and delivers all events generated between StartTime and
/// EndTime. Note that events can appear out of order if the session specifies system time as the clock (low resolution) and the
/// volume of events is high. In this case, it is possible for multiple events to contain the same time stamp. If multiple events
/// contain the same time stamp, ETW cannot guarantee the order of those events.
/// </para>
/// <para>
/// The <c>ProcessTrace</c> function blocks the thread until it delivers all events, the <c>BufferCallback</c> function returns
/// <c>FALSE</c>, or you call <c>CloseTrace</c>. If the consumer is consuming events in real time, the <c>ProcessTrace</c> function
/// returns after the controller stops the trace session. (Note that there may be a several-second delay before the function returns.)
/// </para>
/// <para><c>Windows Server 2003:</c> You can call <c>CloseTrace</c> only after <c>ProcessTrace</c> returns.</para>
/// </remarks>
// https://docs.microsoft.com/en-us/windows/desktop/ETW/processtrace ULONG ProcessTrace( _In_ PTRACEHANDLE HandleArray, _In_ ULONG
// HandleCount, _In_ LPFILETIME StartTime, _In_ LPFILETIME EndTime );
[DllImport(Lib.AdvApi32, SetLastError = false, ExactSpelling = true)]
[PInvokeData("Evntrace.h", MSDNShortId = "aea25a95-f435-4068-9b15-7473f31ebf16")]
public static extern Win32Error ProcessTrace([In, MarshalAs(UnmanagedType.LPArray, SizeParamIndex = 1)] TRACEHANDLE[] HandleArray, uint HandleCount, IntPtr StartTime = default, IntPtr EndTime = default);
/// <summary>
/// The <c>QueryAllTraces</c> function retrieves the properties and statistics for all event tracing sessions started on the computer
/// for which the caller has permissions to query.
/// </summary>
/// <param name="PropertyArray">
/// <para>
/// An array of pointers to EVENT_TRACE_PROPERTIES structures that receive session properties and statistics for the event tracing sessions.
/// </para>
/// <para>
/// You only need to set the <c>Wnode.BufferSize</c>, <c>LoggerNameOffset</c> , and <c>LogFileNameOffset</c> members of the
/// EVENT_TRACE_PROPERTIES structure. The other members should all be set to zero.
/// </para>
/// </param>
/// <param name="PropertyArrayCount">
/// Number of structures in the PropertyArray array. This value must be less than or equal to 64, the maximum number of event tracing
/// sessions that ETW supports.
/// </param>
/// <param name="LoggerCount">Actual number of event tracing sessions started on the computer.</param>
/// <returns>
/// <para>If the function succeeds, the return value is ERROR_SUCCESS.</para>
/// <para>
/// If the function fails, the return value is one of the system error codes. The following table includes some common errors and
/// their causes.
/// </para>
/// <list type="table">
/// <listheader>
/// <term>Return code</term>
/// <term>Description</term>
/// </listheader>
/// <item>
/// <term>ERROR_INVALID_PARAMETER</term>
/// <term>One of the following is true:</term>
/// </item>
/// <item>
/// <term>ERROR_MORE_DATA</term>
/// <term>
/// The property array is too small to receive information for all sessions (SessionCount is greater than PropertyArrayCount). The
/// function fills the property array with the number of property structures specified in PropertyArrayCount.
/// </term>
/// </item>
/// </list>
/// </returns>
/// <remarks>
/// <para>Event trace controllers call this function.</para>
/// <para>
/// This function retrieves the trace sessions that the caller has permissions to query. Users running with elevated administrative
/// privileges, users in the Performance Log Users group, and services running as LocalSystem, LocalService, NetworkService can view
/// all tracing sessions.
/// </para>
/// <para>This function does not return private logging sessions.</para>
/// <para>To retrieve information for a single session, use the ControlTrace function and set the ControlCode parameter to <c>EVENT_TRACE_CONTROL_QUERY</c>.</para>
/// <para>Examples</para>
/// <para>The following example shows how to call this function.</para>
/// </remarks>
// https://docs.microsoft.com/en-us/windows/desktop/api/evntrace/nf-evntrace-queryalltracesa ULONG WMIAPI QueryAllTracesA(
// PEVENT_TRACE_PROPERTIES *PropertyArray, ULONG PropertyArrayCount, PULONG LoggerCount );
[DllImport(Lib.AdvApi32, SetLastError = false, CharSet = CharSet.Auto)]
[PInvokeData("evntrace.h", MSDNShortId = "6b6144b0-9152-4b5e-863d-06e823fbe084")]
public static extern Win32Error QueryAllTraces([Out, MarshalAs(UnmanagedType.LPArray, SizeParamIndex = 1)] IntPtr[] PropertyArray, uint PropertyArrayCount, out uint LoggerCount);
/// <summary>
/// <para>
/// The <c>QueryTrace</c> function retrieves the property settings and session statistics for the specified event tracing session.
/// </para>
/// <para>The ControlTrace function supersedes this function.</para>
/// </summary>
/// <param name="TraceHandle">TBD</param>
/// <param name="InstanceName">TBD</param>
/// <param name="Properties">TBD</param>
/// <returns>
/// <para>If the function succeeds, the return value is ERROR_SUCCESS.</para>
/// <para>
/// If the function fails, the return value is one of the system error codes. The following table includes some common errors and
/// their causes.
/// </para>
/// <list type="table">
/// <listheader>
/// <term>Return code</term>
/// <term>Description</term>
/// </listheader>
/// <item>
/// <term>ERROR_BAD_LENGTH</term>
/// <term>One of the following is true:</term>
/// </item>
/// <item>
/// <term>ERROR_INVALID_PARAMETER</term>
/// <term>One of the following is true:</term>
/// </item>
/// <item>
/// <term>ERROR_ACCESS_DENIED</term>
/// <term>
/// Only users running with elevated administrative privileges, users in the Performance Log Users group, and services running as
/// LocalSystem, LocalService, NetworkService can query event tracing sessions. To grant a restricted user the ability to query trace
/// sessions, add them to the Performance Log Users group or see EventAccessControl. Windows XP and Windows 2000: Anyone can control
/// a trace session.
/// </term>
/// </item>
/// <item>
/// <term>ERROR_WMI_INSTANCE_NOT_FOUND</term>
/// <term>The given session is not running.</term>
/// </item>
/// </list>
/// </returns>
/// <remarks>
/// <para>Controllers call this function.</para>
/// <para>To update the property settings and session statistics for an event tracing session, call the UpdateTrace function.</para>
/// </remarks>
// https://docs.microsoft.com/en-us/windows/desktop/api/evntrace/nf-evntrace-querytracea ULONG WMIAPI QueryTraceA( TRACEHANDLE
// TraceHandle, LPCSTR InstanceName, PEVENT_TRACE_PROPERTIES Properties );
[DllImport(Lib.AdvApi32, SetLastError = false, CharSet = CharSet.Auto)]
[PInvokeData("evntrace.h", MSDNShortId = "8ad0f4f6-902c-490e-b26e-7499dd99fc95")]
public static extern Win32Error QueryTrace(TRACEHANDLE TraceHandle, string InstanceName, ref EVENT_TRACE_PROPERTIES Properties);
/// <summary>Queries the system for the trace processing handle.</summary>
/// <param name="ProcessingHandle">A valid handle created with <c>OpenTrace</c> that the data should be queried from.</param>
/// <param name="InformationClass">
/// An <c>ETW_PROCESS_HANDLE_INFO_TYPE</c> value that specifies what kind of operation will be done on the handle.
/// </param>
/// <param name="InBuffer">Reserved for future use. May be null.</param>
/// <param name="InBufferSize">Size in bytes of the InBuffer.</param>
/// <param name="OutBuffer">Buffer provided by the caller to contain output data.</param>
/// <param name="OutBufferSize">Size in bytes of OutBuffer.</param>
/// <param name="ReturnLength">The size in bytes of the data that the API wrote into OutBuffer. Important for variable length returns.</param>
/// <returns>
/// <para>If the function succeeds, the return value is ERROR_SUCCESS.</para>
/// <para>If the function fails, the return value is one of the system error codes.</para>
/// </returns>
// https://docs.microsoft.com/en-us/windows/desktop/ETW/querytraceprocessinghandle ULONG WINAPI QueryTraceProcessingHandle( _In_
// TRACEHANDLE ProcessingHandle, _In_ ETW_PROCESS_HANDLE_INFO_TYPE InformationClass, _In_opt_ PVOID InBuffer, _In_ ULONG
// InBufferSize, _Out_opt_ PVOID OutBuffer, _In_ ULONG OutBufferSize, _Out_ PULONG ReturnLength );
[DllImport(Lib.AdvApi32, SetLastError = false, ExactSpelling = true)]
[PInvokeData("evntrace.h", MSDNShortId = "87666275-8752-4EC8-9C01-16D36AE4C5E8")]
public static extern Win32Error QueryTraceProcessingHandle(TRACEHANDLE ProcessingHandle, ETW_PROCESS_HANDLE_INFO_TYPE InformationClass, [In, Optional] IntPtr InBuffer, uint InBufferSize, [Out, Optional] IntPtr OutBuffer, uint OutBufferSize, out uint ReturnLength);
/// <summary>
/// The <c>RegisterTraceGuids</c> function registers an event trace provider and the event trace classes that it uses to generate
/// events. This function also specifies the function the provider uses to enable and disable tracing.
/// </summary>
/// <param name="RequestAddress">
/// Pointer to a <c>ControlCallback</c> function that receives notification when the provider is enabled or disabled by an event
/// tracing session. The <c>EnableTrace</c> function calls the callback.
/// </param>
/// <param name="RequestContext">Pointer to an optional provider-defined context that ETW passes to the function specified by RequestAddress.</param>
/// <param name="ControlGuid">GUID of the registering provider.</param>
/// <param name="GuidCount">
/// Number of elements in the TraceGuidReg array. If TraceGuidReg is <c>NULL</c>, set this parameter to 0.
/// </param>
/// <param name="TraceGuidReg">
/// <para>
/// Pointer to an array of <c>TRACE_GUID_REGISTRATION</c> structures. Each element identifies a category of events that the provider provides.
/// </para>
/// <para>
/// On input, the <c>Guid</c> member of each structure contains an event trace class GUID assigned by the registering provider. The
/// class GUID identifies a category of events that the provider provides. Providers use the same class GUID to set the Guid member
/// of <c>EVENT_TRACE_HEADER</c> when calling the <c>TraceEvent</c> function to log the event.
/// </para>
/// <para>
/// On output, the <c>RegHandle</c> member receives a handle to the event's class GUID registration. If the provider calls the
/// <c>TraceEventInstance</c> function, use the <c>RegHandle</c> member of <c>TRACE_GUID_REGISTRATION</c> to set the <c>RegHandle</c>
/// member of <c>EVENT_INSTANCE_HEADER</c>.
/// </para>
/// <para>
/// This parameter can be <c>NULL</c> if the provider calls only the <c>TraceEvent</c> function to log events. If the provider calls
/// the <c>TraceEventInstance</c> function to log events, this parameter cannot be <c>NULL</c>.
/// </para>
/// </param>
/// <param name="MofImagePath">
/// <para>
/// This parameter is not supported, set to <c>NULL</c>. You should use Mofcomp.exe to register the MOF resource during the setup of
/// your application. For more information see, Publishing Your Event Schema.
/// </para>
/// <para>
/// <c>Windows XP with SP1, Windows XP and Windows 2000:</c> Pointer to an optional string that specifies the path of the DLL or
/// executable program that contains the resource specified by MofResourceName. This parameter can be <c>NULL</c> if the event
/// provider and consumer use another mechanism to share information about the event trace classes used by the provider.
/// </para>
/// </param>
/// <param name="MofResourceName">
/// <para>
/// This parameter is not supported, set to <c>NULL</c>. You should use Mofcomp.exe to register the MOF resource during the setup of
/// your application. For more information see, Publishing Your Event Schema.
/// </para>
/// <para>
/// <c>Windows XP with SP1, Windows XP and Windows 2000:</c> Pointer to an optional string that specifies the string resource of
/// MofImagePath. The string resource contains the name of the binary MOF file that describes the event trace classes supported by
/// the provider.
/// </para>
/// </param>
/// <param name="RegistrationHandle">
/// Pointer to the provider's registration handle. Use this handle when you call the <c>UnregisterTraceGuids</c> function.
/// </param>
/// <returns>
/// <para>If the function succeeds, the return value is ERROR_SUCCESS.</para>
/// <para>
/// If the function fails, the return value is one of the system error codes. The following table includes some common errors and
/// their causes.
/// </para>
/// <list type="table">
/// <listheader>
/// <term>Return code</term>
/// <term>Description</term>
/// </listheader>
/// <item>
/// <term>ERROR_INVALID_PARAMETER</term>
/// <term>
/// One of the following is true: Windows XP and Windows 2000: TraceGuidReg is NULL or GuidCount is less than or equal to zero.
/// </term>
/// </item>
/// </list>
/// </returns>
/// <remarks>
/// <para>Providers call this function.</para>
/// <para>
/// If the provider's ControlGuid has been previously registered and enabled, subsequent registrations that reference the same
/// ControlGuid are automatically enabled.
/// </para>
/// <para>
/// A process can register up to 1,024 provider GUIDs; however, you should limit the number of providers that your process registers
/// to one or two. This limit includes those registered using this function and the <c>EventRegister</c> function.
/// </para>
/// <para><c>Prior to Windows Vista:</c> There is no limit to the number of providers that a process can register.</para>
/// </remarks>
// https://docs.microsoft.com/en-us/windows/desktop/ETW/registertraceguids ULONG RegisterTraceGuids( _In_ WMIDPREQUEST
// RequestAddress, _In_ PVOID RequestContext, _In_ LPCGUID ControlGuid, _In_ ULONG GuidCount, _Inout_ PTRACE_GUID_REGISTRATION
// TraceGuidReg, _In_ LPCTSTR MofImagePath, _In_ LPCTSTR MofResourceName, _Out_ PTRACEHANDLE RegistrationHandle );
[DllImport(Lib.AdvApi32, SetLastError = false, CharSet = CharSet.Auto)]
[PInvokeData("evntrace.h", MSDNShortId = "c9158292-281b-4a02-b280-956e340d225c")]
public static extern Win32Error RegisterTraceGuids([MarshalAs(UnmanagedType.FunctionPtr)] TraceControlCallback RequestAddress, [In, Optional] IntPtr RequestContext, in Guid ControlGuid, uint GuidCount,
[In, Out, Optional, MarshalAs(UnmanagedType.LPArray, SizeParamIndex = 3)] TRACE_GUID_REGISTRATION[] TraceGuidReg, [In, Optional] string MofImagePath, [In, Optional] string MofResourceName, out TRACEHANDLE RegistrationHandle);
//public unsafe delegate Win32Error UnsafeTraceControlCallback([In] WMIDPREQUESTCODE RequestCode, [In] void* Context, uint* Reserved, void* Buffer);
//[DllImport(Lib.AdvApi32, SetLastError = false, CharSet = CharSet.Unicode, EntryPoint = "RegisterTraceGuidsW")]
//public static extern unsafe Win32Error UnsafeRegisterTraceGuids(UnsafeTraceControlCallback TraceRequestAddress, [In, Optional] void* RequestContext, [In] Guid* ControlGuid, uint GuidCount,
// TRACE_GUID_REGISTRATION* TraceGuidReg, [In, Optional] string MofImagePath, [In, Optional] string MofResourceName, out TRACEHANDLE RegistrationHandle);
/// <summary>
/// <para>[Do not use this function; it may be unavailable in subsequent versions.]</para>
/// <para>
/// The <c>RemoveTraceCallback</c> function stops an <c>EventClassCallback</c> function from receiving events for an event trace class.
/// </para>
/// </summary>
/// <param name="pGuid">
/// Pointer to the class GUID of the event trace class for which the callback receives events. Use the same class GUID that you
/// passed to the <c>SetTraceCallback</c> to begin receiving the events.
/// </param>
/// <returns>
/// <para>If the function succeeds, the return value is ERROR_SUCCESS.</para>
/// <para>
/// If the function fails, the return value is one of the system error codes. The following table includes some common errors and
/// their causes.
/// </para>
/// <list type="table">
/// <listheader>
/// <term>Return code</term>
/// <term>Description</term>
/// </listheader>
/// <item>
/// <term>ERROR_INVALID_PARAMETER</term>
/// <term>The pGuid parameter is NULL.</term>
/// </item>
/// <item>
/// <term>ERROR_WMI_GUID_NOT_FOUND</term>
/// <term>There is no EventClassCallback function associated with the event trace class.</term>
/// </item>
/// </list>
/// </returns>
/// <remarks>Consumers call this function.</remarks>
// https://docs.microsoft.com/en-us/windows/desktop/ETW/removetracecallback ULONG RemoveTraceCallback( _In_ LPCGUID pGuid );
[DllImport(Lib.AdvApi32, SetLastError = false, ExactSpelling = true)]
[PInvokeData("Evntrace.h", MSDNShortId = "da779e8d-4984-44e3-8731-647a422b55b2")]
public static extern Win32Error RemoveTraceCallback(in Guid pGuid);
/// <summary>
/// <para>
/// [Do not use this function; it may be unavailable in subsequent versions. Instead, filter for the event trace class in your
/// EventRecordCallback function.]
/// </para>
/// <para>
/// The <c>SetTraceCallback</c> function specifies an <c>EventClassCallback</c> function to process events for the specified event
/// trace class.
/// </para>
/// </summary>
/// <param name="pGuid">
/// Pointer to the class GUID of an event trace class for which you want to receive events. For a list of kernel provider class
/// GUIDs, see NT Kernel Logger Constants.
/// </param>
/// <param name="EventCallback">
/// Pointer to an <c>EventClassCallback</c> function used to process events belonging to the event trace class.
/// </param>
/// <returns>
/// <para>If the function succeeds, the return value is ERROR_SUCCESS.</para>
/// <para>
/// If the function fails, the return value is one of the system error codes. The following table includes some common errors and
/// their causes.
/// </para>
/// <list type="table">
/// <listheader>
/// <term>Return code</term>
/// <term>Description</term>
/// </listheader>
/// <item>
/// <term>ERROR_INVALID_PARAMETER</term>
/// <term>One of the following is true:</term>
/// </item>
/// </list>
/// </returns>
/// <remarks>
/// <para>Consumers call this function.</para>
/// <para>
/// You can only specify one callback function for an event trace class. If you specify more than one callback function for the even
/// trace class, the last callback function receives the events for that event trace class.
/// </para>
/// <para>
/// To stop the callback function from receiving events for the event trace class, call the <c>RemoveTraceCallback</c> function. The
/// callback automatically stops receiving callbacks when you close the trace.
/// </para>
/// <para>
/// You can use this function to receive events written using one of the <c>TraceEvent</c> functions. You cannot use this function to
/// consume events from a provider that used one of the <c>EventWrite</c> functions to log events.
/// </para>
/// </remarks>
// https://docs.microsoft.com/en-us/windows/desktop/ETW/settracecallback ULONG SetTraceCallback( _In_ LPCGUID pGuid, _In_
// PEVENT_CALLBACK EventCallback );
[DllImport(Lib.AdvApi32, SetLastError = false, ExactSpelling = true)]
[PInvokeData("Evntrace.h", MSDNShortId = "8663f64f-a203-43e5-94e8-337f2d81c3a0")]
public static extern Win32Error SetTraceCallback(in Guid pGuid, EventClassCallback EventCallback);
/// <summary>The <c>StartTrace</c> function registers and starts an event tracing session.</summary>
/// <param name="TraceHandle">
/// <para>Handle to the event tracing session.</para>
/// <para>
/// Do not use this handle if the function fails. Do not compare the session handle to INVALID_HANDLE_VALUE; the session handle is 0
/// if the handle is not valid.
/// </para>
/// </param>
/// <param name="InstanceName">
/// <para>
/// Null-terminated string that contains the name of the event tracing session. The session name is limited to 1,024 characters, is
/// case-insensitive, and must be unique.
/// </para>
/// <para>
/// <c>Windows 2000:</c> Session names are case-sensitive. As a result, duplicate session names are allowed. However, to reduce
/// confusion, you should make sure your session names are unique.
/// </para>
/// <para>
/// This function copies the session name that you provide to the offset that the <c>LoggerNameOffset</c> member of Properties points to.
/// </para>
/// </param>
/// <param name="Properties">
/// <para>
/// Pointer to an EVENT_TRACE_PROPERTIES structure that specifies the behavior of the session. The following are key members of the
/// structure to set:
/// </para>
/// <list type="bullet">
/// <item>
/// <term><c>Wnode.BufferSize</c></term>
/// </item>
/// <item>
/// <term><c>Wnode.Guid</c></term>
/// </item>
/// <item>
/// <term><c>Wnode.ClientContext</c></term>
/// </item>
/// <item>
/// <term><c>Wnode.Flags</c></term>
/// </item>
/// <item>
/// <term><c>LogFileMode</c></term>
/// </item>
/// <item>
/// <term><c>LogFileNameOffset</c></term>
/// </item>
/// <item>
/// <term><c>LoggerNameOffset</c></term>
/// </item>
/// </list>
/// <para>Depending on the type of log file you choose to create, you may also need to specify a value for</para>
/// <para>MaximumFileSize</para>
/// <para>. See the Remarks section for more information on setting the</para>
/// <para>Properties</para>
/// <para>parameter and the behavior of the session.</para>
/// <para>
/// <c>Starting with Windows 10, version 1703:</c> For better performance in cross process scenarios, you can now pass filtering in
/// to <c>StartTrace</c> when starting system wide private loggers. You will need to pass in the new EVENT_TRACE_PROPERTIES_V2
/// structure to include filtering information. See Configuring and Starting a Private Logger Session for more details.
/// </para>
/// </param>
/// <returns>
/// <para>If the function succeeds, the return value is ERROR_SUCCESS.</para>
/// <para>
/// If the function fails, the return value is one of the system error codes. The following table includes some common errors and
/// their causes.
/// </para>
/// <list type="table">
/// <listheader>
/// <term>Return code</term>
/// <term>Description</term>
/// </listheader>
/// <item>
/// <term>ERROR_BAD_LENGTH</term>
/// <term>One of the following is true:</term>
/// </item>
/// <item>
/// <term>ERROR_INVALID_PARAMETER</term>
/// <term>One of the following is true:</term>
/// </item>
/// <item>
/// <term>ERROR_ALREADY_EXISTS</term>
/// <term>A session with the same name or GUID is already running.</term>
/// </item>
/// <item>
/// <term>ERROR_BAD_PATHNAME</term>
/// <term>You can receive this error for one of the following reasons:</term>
/// </item>
/// <item>
/// <term>ERROR_DISK_FULL</term>
/// <term>
/// There is not enough free space on the drive for the log file. This occurs if: Choose a drive with more space, or decrease the
/// size specified in MaximumFileSize (if used). Windows 2000: Does not require an additional 200 MB available disk space.
/// </term>
/// </item>
/// <item>
/// <term>ERROR_ACCESS_DENIED</term>
/// <term>
/// Only users with administrative privileges, users in the Performance Log Users group, and services running as LocalSystem,
/// LocalService, NetworkService can control event tracing sessions. To grant a restricted user the ability to control trace
/// sessions, add them to the Performance Log Users group. Only users with administrative privileges and services running as
/// LocalSystem can control an NT Kernel Logger session. Windows XP and Windows 2000: Anyone can control a trace session. If the user
/// is a member of the Performance Log Users group, they may not have permission to create the log file in the specified folder.
/// </term>
/// </item>
/// <item>
/// <term>ERROR_NO_SYSTEM_RESOURCES</term>
/// <term>
/// The maximum number of logging sessions on the system has been reached. No new loggers can be created until a logging session has
/// been stopped. This value defaults to 64 on most systems. You can change this value by editing the REG_DWORD key at
/// HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\EtwMaxLoggers. Permissible values are 32 through 256, inclusive. A reboot
/// is required for any change to take effect. Note that Loggers use system resources. Increasing the number of loggers on the system
/// will come at a performance cost if those slots are filled. Prior to Windows 10, version 1709, this is a fixed cap of 64 loggers
/// for non-private loggers.
/// </term>
/// </item>
/// </list>
/// </returns>
/// <remarks>
/// <para>Event trace controllers call this function.</para>
/// <para>
/// The session remains active until you stop the session, the computer is restarted or the maximum file size is reached for
/// non-circular logs. To stop an event tracing session, call the ControlTrace function and set the ControlCode parameter to <c>EVENT_TRACE_CONTROL_STOP</c>.
/// </para>
/// <para>You cannot start more than one session with the same session GUID.</para>
/// <para><c>Windows Server 2003:</c> You can start more than one session with the same session GUID.</para>
/// <para>For the logger to be a system logger and receive events from SystemTraceProvider, any of the following must be true:</para>
/// <list type="bullet">
/// <item>
/// <term>The Properties member <c>Wnode.Guid</c> is set to <c>SystemTraceControlGuid</c> or <c>GlobalLoggerGuid</c>.</term>
/// </item>
/// <item>
/// <term>The Properties member <c>LogFileMode</c> includes the <c>EVENT_TRACE_SYSTEM_LOGGER_MODE</c> flag.</term>
/// </item>
/// <item>
/// <term>SessionName is set to <c>KERNEL_LOGGER_NAME</c>.</term>
/// </item>
/// </list>
/// <para>
/// <c>Note</c> A system logger must set the <c>EnableFlags</c> member of the EVENT_TRACE_PROPERTIES structure to indicate which
/// SystemTraceProvider events should be included in the trace.
/// </para>
/// <para>Because system loggers receive special kernel events, they are subject to additional restrictions:</para>
/// <list type="bullet">
/// <item>
/// <term>There can be no more than 8 system loggers active on the same system.</term>
/// </item>
/// <item>
/// <term>System loggers cannot be created within a Windows Server container.</term>
/// </item>
/// <item>
/// <term>System loggers cannot use the <c>EVENT_TRACE_USE_PAGED_MEMORY</c> flag.</term>
/// </item>
/// <item>
/// <term>
/// Prior to Windows 10, version 1703, no more than 2 distinct clock types can be used simultaneously by any system loggers. For
/// example, if one active system logger is using the "CPU cycle counter" clock type, and another active system logger is using the
/// "Query performance counter" clock type, then any attempt to start a system logger using the "System time" clock type will fail
/// because it would require the activation of a third clock type. Because of this limitation, Microsoft strongly recommends that
/// system loggers do not use the "System time" clock type.
/// </term>
/// </item>
/// <item>
/// <term>
/// Starting with Windows 10, version 1703, the clock type restriction has been removed. All three clock types can now be used
/// simultaneously by system loggers.
/// </term>
/// </item>
/// </list>
/// <para>
/// To specify an NT Kernel Logger session, set SessionName to <c>KERNEL_LOGGER_NAME</c> and the <c>Wnode.Guid</c> member of
/// Properties to <c>SystemTraceControlGuid</c>. If you do not specify the GUID as <c>SystemTraceControlGuid</c>, ETW will override
/// the GUID value and set it to <c>SystemTraceControlGuid</c>.
/// </para>
/// <para>
/// <c>Windows 2000:</c> To start the kernel session, the session name must be <c>KERNEL_LOGGER_NAME</c> and the GUID must be <c>SystemTraceControlGuid</c>.
/// </para>
/// <para>
/// To specify a private logger session, set <c>Wnode.Guid</c> member of Properties to the provider's control GUID, not the private
/// logger session's control GUID. The provider must have registered the GUID before you call <c>StartTrace</c>.
/// </para>
/// <para>
/// You do not use this function to start a global logger session. For details on starting a global logger session, see Configuring
/// and Starting the Global Logger Session.
/// </para>
/// <para>Examples</para>
/// <para>For an example that uses <c>StartTrace</c>, see Configuring and Starting an Event Tracing Session.</para>
/// </remarks>
// https://docs.microsoft.com/en-us/windows/desktop/api/evntrace/nf-evntrace-starttracea ULONG WMIAPI StartTraceA( PTRACEHANDLE
// TraceHandle, LPCSTR InstanceName, PEVENT_TRACE_PROPERTIES Properties );
[DllImport(Lib.AdvApi32, SetLastError = false, CharSet = CharSet.Auto)]
[PInvokeData("evntrace.h", MSDNShortId = "c040514a-733d-44b9-8300-a8341d2630b3")]
public static extern Win32Error StartTrace(out TRACEHANDLE TraceHandle, string InstanceName, ref EVENT_TRACE_PROPERTIES Properties);
/// <summary>
/// <para>The <c>StopTrace</c> function stops the specified event tracing session.</para>
/// <para>The <c>ControlTrace</c> function supersedes this function.</para>
/// </summary>
/// <param name="SessionHandle">
/// Handle to the event tracing session that you want to stop, or <c>NULL</c>. You must specify SessionHandle if SessionName is
/// <c>NULL</c>. However, ETW ignores the handle if SessionName is not <c>NULL</c>. The handle is returned by the <c>StartTrace</c> function.
/// </param>
/// <param name="SessionName">
/// <para>
/// Pointer to a null-terminated string that specifies the name of the event tracing session that you want to stop, or <c>NULL</c>.
/// You must specify SessionName if SessionHandle is <c>NULL</c>.
/// </para>
/// <para>To specify the NT Kernel Logger session, set SessionName to <c>KERNEL_LOGGER_NAME</c>.</para>
/// </param>
/// <param name="Properties">
/// <para>Pointer to an <c>EVENT_TRACE_PROPERTIES</c> structure that receives the final properties and statistics for the session.</para>
/// <para>
/// If you are using a newly initialized structure, you only need to set the <c>Wnode.BufferSize</c>, <c>Wnode.Guid</c>,
/// <c>LoggerNameOffset</c>, and <c>LogFileNameOffset</c> members of the structure. You can use the maximum session name (1024
/// characters) and maximum log file name (1024 characters) lengths to calculate the buffer size and offsets if not known.
/// </para>
/// <para>
/// <c>Starting with Windows 10, version 1703:</c> For better performance in cross process scenarios, you can now pass filtering in
/// to <c>StopTrace</c> for system wide private loggers. You will need to pass in the new <c>EVENT_TRACE_PROPERTIES_V2</c> structure
/// to include filtering information. See Configuring and Starting a Private Logger Session for more details.
/// </para>
/// </param>
/// <returns>
/// <para>If the function succeeds, the return value is ERROR_SUCCESS.</para>
/// <para>
/// If the function fails, the return value is one of the system error codes. The following table includes some common errors and
/// their causes.
/// </para>
/// <list type="table">
/// <listheader>
/// <term>Return code</term>
/// <term>Description</term>
/// </listheader>
/// <item>
/// <term>ERROR_BAD_LENGTH</term>
/// <term>One of the following is true:</term>
/// </item>
/// <item>
/// <term>ERROR_INVALID_PARAMETER</term>
/// <term>One of the following is true:</term>
/// </item>
/// <item>
/// <term>ERROR_ACCESS_DENIED</term>
/// <term>
/// Only users with administrative privileges, users in the Performance Log Users group, and services running as LocalSystem,
/// LocalService, NetworkService can control event tracing sessions. To grant a restricted user the ability to control trace
/// sessions, add them to the Performance Log Users group. Windows XP and Windows 2000: Anyone can control a trace session.
/// </term>
/// </item>
/// </list>
/// </returns>
/// <remarks>
/// <para>Controllers call this function.</para>
/// <para>
/// If <c>LogFileMode</c> contains <c>EVENT_TRACE_FILE_MODE_PREALLOCATE</c>, <c>StartTrace</c> extends the log file to
/// <c>MaximumFileSize</c> bytes. The file occupies the entire space during logging, for both circular and sequential logs. When you
/// stop the logger, the log file is reduced to the size needed.
/// </para>
/// <para>Note that it is not safe to stop a trace session from DllMain.</para>
/// </remarks>
// https://docs.microsoft.com/en-us/windows/desktop/ETW/stoptrace ULONG StopTrace( _In_ TRACEHANDLE SessionHandle, _In_ LPCTSTR
// SessionName, _Out_ PEVENT_TRACE_PROPERTIES Properties );
[DllImport(Lib.AdvApi32, SetLastError = false, CharSet = CharSet.Auto)]
[PInvokeData("Evntrace.h", MSDNShortId = "604274a1-c4ed-4746-b69a-e18969f969db")]
public static extern Win32Error StopTrace(TRACEHANDLE SessionHandle, [Optional] string SessionName, ref EVENT_TRACE_PROPERTIES Properties);
/// <summary>The <c>TraceEvent</c> function sends an event to an event tracing session.</summary>
/// <param name="SessionHandle">
/// Handle to the event tracing session that records the event. The provider obtains the handle when it calls the
/// <c>GetTraceLoggerHandle</c> function in its ControlCallback implementation.
/// </param>
/// <param name="EventTrace">
/// <para>
/// Pointer to an <c>EVENT_TRACE_HEADER</c> structure. Event-specific data is optionally appended to the structure. The largest event
/// you can log is 64K. You must specify values for the following members of the <c>EVENT_TRACE_HEADER</c> structure.
/// </para>
/// <list type="bullet">
/// <item>
/// <term><c>Size</c></term>
/// </item>
/// <item>
/// <term><c>Guid</c> or <c>GuidPtr</c></term>
/// </item>
/// <item>
/// <term><c>Flags</c></term>
/// </item>
/// </list>
/// <para>
/// Depending on the complexity of the information your provider provides, you should also consider specifying values for the
/// following members.
/// </para>
/// <list type="bullet">
/// <item>
/// <term><c>Class.Type</c></term>
/// </item>
/// <item>
/// <term><c>Class.Level</c></term>
/// </item>
/// </list>
/// </param>
/// <returns>
/// <para>If the function succeeds, the return value is ERROR_SUCCESS.</para>
/// <para>
/// If the function fails, the return value is one of the system error codes. The following table includes some common errors and
/// their causes.
/// </para>
/// <list type="table">
/// <listheader>
/// <term>Return code</term>
/// <term>Description</term>
/// </listheader>
/// <item>
/// <term>ERROR_INVALID_FLAG_NUMBER</term>
/// <term>The Flags member of the EVENT_TRACE_HEADER structure is incorrect.</term>
/// </item>
/// <item>
/// <term>ERROR_INVALID_HANDLE</term>
/// <term>SessionHandle is not valid or specifies the NT Kernel Logger session handle.</term>
/// </item>
/// <item>
/// <term>ERROR_NOT_ENOUGH_MEMORY</term>
/// <term>
/// The session ran out of free buffers to write to. This can occur during high event rates because the disk subsystem is overloaded
/// or the number of buffers is too small. Rather than blocking until more buffers become available, TraceEvent discards the event.
/// Consider increasing the number and size of the buffers for the session, or reducing the number of events written or the size of
/// the events. Windows 2000: Not supported.
/// </term>
/// </item>
/// <item>
/// <term>ERROR_OUTOFMEMORY</term>
/// <term>
/// The event is discarded because, although the buffer pool has not reached its maximum size, there is insufficient available memory
/// to allocate an additional buffer and there is no buffer available to receive the event.
/// </term>
/// </item>
/// <item>
/// <term>ERROR_INVALID_PARAMETER</term>
/// <term>One of the following is true:</term>
/// </item>
/// <item>
/// <term>ERROR_MORE_DATA</term>
/// <term>
/// Data from a single event cannot span multiple buffers. A trace event is limited to the size of the event tracing session's buffer
/// minus the size of the EVENT_TRACE_HEADER structure.
/// </term>
/// </item>
/// </list>
/// </returns>
/// <remarks>
/// <para>Providers call this function.</para>
/// <para>Before the provider can call this function, the provider</para>
/// <list type="bullet">
/// <item>
/// <term>Must call the <c>RegisterTraceGuids</c> function to register itself and the event trace class.</term>
/// </item>
/// <item>
/// <term>Must be enabled. A controller calls the <c>EnableTrace</c> function to enable a provider.</term>
/// </item>
/// </list>
/// <para>
/// The event is either written to a log file, sent to event trace consumers in real time, or both. The <c>LogFileMode</c> member of
/// the <c>EVENT_TRACE_PROPERTIES</c> structure passed to the <c>StartTrace</c> defines where the event is sent.
/// </para>
/// <para>The trace events are written in the order in which they occur.</para>
/// <para>To trace a set of related events, use the <c>TraceEventInstance</c> function.</para>
/// <para>On Windows Vista, you should use the <c>EventWrite</c> function to log events.</para>
/// </remarks>
// https://docs.microsoft.com/en-us/windows/desktop/etw/traceevent ULONG TraceEvent( _In_ TRACEHANDLE SessionHandle, _In_
// PEVENT_TRACE_HEADER EventTrace );
[DllImport(Lib.AdvApi32, SetLastError = false, ExactSpelling = true)]
[PInvokeData("Evntrace.h", MSDNShortId = "9b21f6f0-dd9b-4f9c-a879-846901a3bab7")]
public static extern Win32Error TraceEvent(TRACEHANDLE SessionHandle, PEVENT_TRACE_HEADER EventTrace);
/// <summary>The <c>TraceEvent</c> function sends an event to an event tracing session.</summary>
/// <param name="SessionHandle">
/// Handle to the event tracing session that records the event. The provider obtains the handle when it calls the
/// <c>GetTraceLoggerHandle</c> function in its ControlCallback implementation.
/// </param>
/// <param name="EventTrace">
/// <para>
/// Pointer to an <c>EVENT_TRACE_HEADER</c> structure. Event-specific data is optionally appended to the structure. The largest event
/// you can log is 64K. You must specify values for the following members of the <c>EVENT_TRACE_HEADER</c> structure.
/// </para>
/// <list type="bullet">
/// <item>
/// <term><c>Size</c></term>
/// </item>
/// <item>
/// <term><c>Guid</c> or <c>GuidPtr</c></term>
/// </item>
/// <item>
/// <term><c>Flags</c></term>
/// </item>
/// </list>
/// <para>
/// Depending on the complexity of the information your provider provides, you should also consider specifying values for the
/// following members.
/// </para>
/// <list type="bullet">
/// <item>
/// <term><c>Class.Type</c></term>
/// </item>
/// <item>
/// <term><c>Class.Level</c></term>
/// </item>
/// </list>
/// </param>
/// <returns>
/// <para>If the function succeeds, the return value is ERROR_SUCCESS.</para>
/// <para>
/// If the function fails, the return value is one of the system error codes. The following table includes some common errors and
/// their causes.
/// </para>
/// <list type="table">
/// <listheader>
/// <term>Return code</term>
/// <term>Description</term>
/// </listheader>
/// <item>
/// <term>ERROR_INVALID_FLAG_NUMBER</term>
/// <term>The Flags member of the EVENT_TRACE_HEADER structure is incorrect.</term>
/// </item>
/// <item>
/// <term>ERROR_INVALID_HANDLE</term>
/// <term>SessionHandle is not valid or specifies the NT Kernel Logger session handle.</term>
/// </item>
/// <item>
/// <term>ERROR_NOT_ENOUGH_MEMORY</term>
/// <term>
/// The session ran out of free buffers to write to. This can occur during high event rates because the disk subsystem is overloaded
/// or the number of buffers is too small. Rather than blocking until more buffers become available, TraceEvent discards the event.
/// Consider increasing the number and size of the buffers for the session, or reducing the number of events written or the size of
/// the events. Windows 2000: Not supported.
/// </term>
/// </item>
/// <item>
/// <term>ERROR_OUTOFMEMORY</term>
/// <term>
/// The event is discarded because, although the buffer pool has not reached its maximum size, there is insufficient available memory
/// to allocate an additional buffer and there is no buffer available to receive the event.
/// </term>
/// </item>
/// <item>
/// <term>ERROR_INVALID_PARAMETER</term>
/// <term>One of the following is true:</term>
/// </item>
/// <item>
/// <term>ERROR_MORE_DATA</term>
/// <term>
/// Data from a single event cannot span multiple buffers. A trace event is limited to the size of the event tracing session's buffer
/// minus the size of the EVENT_TRACE_HEADER structure.
/// </term>
/// </item>
/// </list>
/// </returns>
/// <remarks>
/// <para>Providers call this function.</para>
/// <para>Before the provider can call this function, the provider</para>
/// <list type="bullet">
/// <item>
/// <term>Must call the <c>RegisterTraceGuids</c> function to register itself and the event trace class.</term>
/// </item>
/// <item>
/// <term>Must be enabled. A controller calls the <c>EnableTrace</c> function to enable a provider.</term>
/// </item>
/// </list>
/// <para>
/// The event is either written to a log file, sent to event trace consumers in real time, or both. The <c>LogFileMode</c> member of
/// the <c>EVENT_TRACE_PROPERTIES</c> structure passed to the <c>StartTrace</c> defines where the event is sent.
/// </para>
/// <para>The trace events are written in the order in which they occur.</para>
/// <para>To trace a set of related events, use the <c>TraceEventInstance</c> function.</para>
/// <para>On Windows Vista, you should use the <c>EventWrite</c> function to log events.</para>
/// </remarks>
// https://docs.microsoft.com/en-us/windows/desktop/etw/traceevent ULONG TraceEvent( _In_ TRACEHANDLE SessionHandle, _In_
// PEVENT_TRACE_HEADER EventTrace );
[DllImport(Lib.AdvApi32, SetLastError = false, ExactSpelling = true)]
[PInvokeData("Evntrace.h", MSDNShortId = "9b21f6f0-dd9b-4f9c-a879-846901a3bab7")]
public static extern Win32Error TraceEvent(TRACEHANDLE SessionHandle, IntPtr EventTrace);
/// <summary>
/// The <c>TraceEventInstance</c> function sends an event to an event tracing session. The event uses an instance identifier to
/// associate the event with a transaction. This function may also be used to trace hierarchical relationships between related events.
/// </summary>
/// <param name="SessionHandle">
/// Handle to the event tracing session that records the event instance. The provider obtains the handle when it calls the
/// <c>GetTraceLoggerHandle</c> function in its ControlCallback implementation.
/// </param>
/// <param name="EventTrace">
/// <para>
/// Pointer to an <c>EVENT_INSTANCE_HEADER</c> structure. Event-specific data is optionally appended to the structure. The largest
/// event you can log is 64K. You must specify values for the following members of the <c>EVENT_INSTANCE_HEADER</c> structure.
/// </para>
/// <list type="bullet">
/// <item>
/// <term><c>Size</c></term>
/// </item>
/// <item>
/// <term><c>Flags</c></term>
/// </item>
/// <item>
/// <term><c>RegHandle</c></term>
/// </item>
/// </list>
/// <para>
/// Depending on the complexity of the information your provider provides, you should also consider specifying values for the
/// following members.
/// </para>
/// <list type="bullet">
/// <item>
/// <term><c>Class.Type</c></term>
/// </item>
/// <item>
/// <term><c>Class.Level</c></term>
/// </item>
/// </list>
/// <para>To trace hierarchical relationships between related events, also set the <c>ParentRegHandle</c> member.</para>
/// </param>
/// <param name="pInstInfo">
/// Pointer to an <c>EVENT_INSTANCE_INFO</c> structure, which contains the registration handle for this event trace class and the
/// instance identifier. Use the <c>CreateTraceInstanceId</c> function to initialize the structure.
/// </param>
/// <param name="pParentInstInfo">
/// Pointer to an <c>EVENT_INSTANCE_INFO</c> structure, which contains the registration handle for the parent event trace class and
/// its instance identifier. Use the <c>CreateTraceInstanceId</c> function to initialize the structure. Set to <c>NULL</c> if you are
/// not tracing a hierarchical relationship.
/// </param>
/// <returns>
/// <para>If the function succeeds, the return value is ERROR_SUCCESS.</para>
/// <para>
/// If the function fails, the return value is one of the system error codes. The following table includes some common errors and
/// their causes.
/// </para>
/// <list type="table">
/// <listheader>
/// <term>Return code</term>
/// <term>Description</term>
/// </listheader>
/// <item>
/// <term>ERROR_INVALID_FLAGS</term>
/// <term>The Flags member of the EVENT_INSTANCE_HEADER does not contain WNODE_FLAG_TRACED_GUID.</term>
/// </item>
/// <item>
/// <term>ERROR_OUTOFMEMORY</term>
/// <term>
/// There was insufficient memory to complete the function call. The causes for this error code are described in the following
/// Remarks section.
/// </term>
/// </item>
/// <item>
/// <term>ERROR_INVALID_PARAMETER</term>
/// <term>One of the following is true:</term>
/// </item>
/// <item>
/// <term>ERROR_INVALID_HANDLE</term>
/// <term>SessionHandle is not valid or specifies the NT Kernel Logger session handle.</term>
/// </item>
/// <item>
/// <term>ERROR_NOT_ENOUGH_MEMORY</term>
/// <term>
/// The session ran out of free buffers to write to. This can occur during high event rates because the disk subsystem is overloaded
/// or the number of buffers is too small. Rather than blocking until more buffers become available, TraceEvent discards the event.
/// Windows 2000 and Windows XP: Not supported.
/// </term>
/// </item>
/// <item>
/// <term>ERROR_OUTOFMEMORY</term>
/// <term>
/// The event is discarded because, although the buffer pool has not reached its maximum size, there is insufficient available memory
/// to allocate an additional buffer and there is no buffer available to receive the event.
/// </term>
/// </item>
/// <item>
/// <term>ERROR_MORE_DATA</term>
/// <term>
/// Data from a single event cannot span multiple buffers. A trace event is limited to the size of the event tracing session's buffer
/// minus the size of the EVENT_INSTANCE_HEADER structure.
/// </term>
/// </item>
/// </list>
/// </returns>
/// <remarks>
/// <para>Providers call this function.</para>
/// <para>Before the provider can call this function, the provider</para>
/// <list type="bullet">
/// <item>
/// <term>Must call the <c>RegisterTraceGuids</c> function to register itself and the event trace class.</term>
/// </item>
/// <item>
/// <term>Must call the <c>CreateTraceInstanceId</c> function to create an instance identifier for the registered event trace class.</term>
/// </item>
/// <item>
/// <term>Must be enabled. A controller calls the <c>EnableTrace</c> function to enable a provider.</term>
/// </item>
/// </list>
/// <para>
/// The event is either written to a log file, sent to event trace consumers in real time, or both. The <c>LogFileMode</c> member of
/// the <c>EVENT_TRACE_PROPERTIES</c> structure passed to the <c>StartTrace</c> defines where the event is sent.
/// </para>
/// <para>The trace events are written in the order in which they occur.</para>
/// <para>To trace unrelated events, use the <c>TraceEvent</c> function.</para>
/// <para><c>Windows XP:</c> Does not work correctly.</para>
/// </remarks>
// https://docs.microsoft.com/en-us/windows/desktop/etw/traceeventinstance ULONG TraceEventInstance( _In_ TRACEHANDLE SessionHandle,
// _In_ PEVENT_INSTANCE_HEADER EventTrace, _In_ PEVENT_INSTANCE_INFO pInstInfo, _In_ PEVENT_INSTANCE_INFO pParentInstInfo );
[DllImport(Lib.AdvApi32, SetLastError = false, ExactSpelling = true)]
[PInvokeData("Evntrace.h", MSDNShortId = "e8361bdc-21dd-47a0-bdbf-56f4d6195689")]
public static extern Win32Error TraceEventInstance(TRACEHANDLE SessionHandle, PEVENT_INSTANCE_HEADER EventTrace, in EVENT_INSTANCE_INFO pInstInfo, in EVENT_INSTANCE_INFO pParentInstInfo);
/// <summary>
/// The <c>TraceEventInstance</c> function sends an event to an event tracing session. The event uses an instance identifier to
/// associate the event with a transaction. This function may also be used to trace hierarchical relationships between related events.
/// </summary>
/// <param name="SessionHandle">
/// Handle to the event tracing session that records the event instance. The provider obtains the handle when it calls the
/// <c>GetTraceLoggerHandle</c> function in its ControlCallback implementation.
/// </param>
/// <param name="EventTrace">
/// <para>
/// Pointer to an <c>EVENT_INSTANCE_HEADER</c> structure. Event-specific data is optionally appended to the structure. The largest
/// event you can log is 64K. You must specify values for the following members of the <c>EVENT_INSTANCE_HEADER</c> structure.
/// </para>
/// <list type="bullet">
/// <item>
/// <term><c>Size</c></term>
/// </item>
/// <item>
/// <term><c>Flags</c></term>
/// </item>
/// <item>
/// <term><c>RegHandle</c></term>
/// </item>
/// </list>
/// <para>
/// Depending on the complexity of the information your provider provides, you should also consider specifying values for the
/// following members.
/// </para>
/// <list type="bullet">
/// <item>
/// <term><c>Class.Type</c></term>
/// </item>
/// <item>
/// <term><c>Class.Level</c></term>
/// </item>
/// </list>
/// <para>To trace hierarchical relationships between related events, also set the <c>ParentRegHandle</c> member.</para>
/// </param>
/// <param name="pInstInfo">
/// Pointer to an <c>EVENT_INSTANCE_INFO</c> structure, which contains the registration handle for this event trace class and the
/// instance identifier. Use the <c>CreateTraceInstanceId</c> function to initialize the structure.
/// </param>
/// <param name="pParentInstInfo">
/// Pointer to an <c>EVENT_INSTANCE_INFO</c> structure, which contains the registration handle for the parent event trace class and
/// its instance identifier. Use the <c>CreateTraceInstanceId</c> function to initialize the structure. Set to <c>NULL</c> if you are
/// not tracing a hierarchical relationship.
/// </param>
/// <returns>
/// <para>If the function succeeds, the return value is ERROR_SUCCESS.</para>
/// <para>
/// If the function fails, the return value is one of the system error codes. The following table includes some common errors and
/// their causes.
/// </para>
/// <list type="table">
/// <listheader>
/// <term>Return code</term>
/// <term>Description</term>
/// </listheader>
/// <item>
/// <term>ERROR_INVALID_FLAGS</term>
/// <term>The Flags member of the EVENT_INSTANCE_HEADER does not contain WNODE_FLAG_TRACED_GUID.</term>
/// </item>
/// <item>
/// <term>ERROR_OUTOFMEMORY</term>
/// <term>
/// There was insufficient memory to complete the function call. The causes for this error code are described in the following
/// Remarks section.
/// </term>
/// </item>
/// <item>
/// <term>ERROR_INVALID_PARAMETER</term>
/// <term>One of the following is true:</term>
/// </item>
/// <item>
/// <term>ERROR_INVALID_HANDLE</term>
/// <term>SessionHandle is not valid or specifies the NT Kernel Logger session handle.</term>
/// </item>
/// <item>
/// <term>ERROR_NOT_ENOUGH_MEMORY</term>
/// <term>
/// The session ran out of free buffers to write to. This can occur during high event rates because the disk subsystem is overloaded
/// or the number of buffers is too small. Rather than blocking until more buffers become available, TraceEvent discards the event.
/// Windows 2000 and Windows XP: Not supported.
/// </term>
/// </item>
/// <item>
/// <term>ERROR_OUTOFMEMORY</term>
/// <term>
/// The event is discarded because, although the buffer pool has not reached its maximum size, there is insufficient available memory
/// to allocate an additional buffer and there is no buffer available to receive the event.
/// </term>
/// </item>
/// <item>
/// <term>ERROR_MORE_DATA</term>
/// <term>
/// Data from a single event cannot span multiple buffers. A trace event is limited to the size of the event tracing session's buffer
/// minus the size of the EVENT_INSTANCE_HEADER structure.
/// </term>
/// </item>
/// </list>
/// </returns>
/// <remarks>
/// <para>Providers call this function.</para>
/// <para>Before the provider can call this function, the provider</para>
/// <list type="bullet">
/// <item>
/// <term>Must call the <c>RegisterTraceGuids</c> function to register itself and the event trace class.</term>
/// </item>
/// <item>
/// <term>Must call the <c>CreateTraceInstanceId</c> function to create an instance identifier for the registered event trace class.</term>
/// </item>
/// <item>
/// <term>Must be enabled. A controller calls the <c>EnableTrace</c> function to enable a provider.</term>
/// </item>
/// </list>
/// <para>
/// The event is either written to a log file, sent to event trace consumers in real time, or both. The <c>LogFileMode</c> member of
/// the <c>EVENT_TRACE_PROPERTIES</c> structure passed to the <c>StartTrace</c> defines where the event is sent.
/// </para>
/// <para>The trace events are written in the order in which they occur.</para>
/// <para>To trace unrelated events, use the <c>TraceEvent</c> function.</para>
/// <para><c>Windows XP:</c> Does not work correctly.</para>
/// </remarks>
// https://docs.microsoft.com/en-us/windows/desktop/etw/traceeventinstance ULONG TraceEventInstance( _In_ TRACEHANDLE SessionHandle,
// _In_ PEVENT_INSTANCE_HEADER EventTrace, _In_ PEVENT_INSTANCE_INFO pInstInfo, _In_ PEVENT_INSTANCE_INFO pParentInstInfo );
[DllImport(Lib.AdvApi32, SetLastError = false, ExactSpelling = true)]
[PInvokeData("Evntrace.h", MSDNShortId = "e8361bdc-21dd-47a0-bdbf-56f4d6195689")]
public static extern Win32Error TraceEventInstance(TRACEHANDLE SessionHandle, PEVENT_INSTANCE_HEADER EventTrace, in EVENT_INSTANCE_INFO pInstInfo, [Optional] IntPtr pParentInstInfo);
/// <summary>The <c>TraceMessage</c> function sends an informational message to an event tracing session.</summary>
/// <param name="SessionHandle">
/// Handle to the event tracing session that records the event. The provider obtains the handle when it calls the
/// <c>GetTraceLoggerHandle</c> function in its ControlCallback implementation.
/// </param>
/// <param name="MessageFlags">
/// <para>
/// Adds additional information to the beginning of the provider-specific data section of the event. The provider-specific data
/// section of the event will contain data only for those flags that are set. The variable list of argument data will follow this
/// information. This parameter can be one or more of the following values.
/// </para>
/// <list type="table">
/// <listheader>
/// <term>Flag</term>
/// <term>Meaning</term>
/// </listheader>
/// <item>
/// <term>TRACE_MESSAGE_COMPONENTID</term>
/// <term>Include the component identifier in the message. The MessageGuid parameter contains the component identifier.</term>
/// </item>
/// <item>
/// <term>TRACE_MESSAGE_GUID</term>
/// <term>Include the event trace class GUID in the message. The MessageGuid parameter contains the event trace class GUID.</term>
/// </item>
/// <item>
/// <term>TRACE_MESSAGE_SEQUENCE</term>
/// <term>
/// Include a sequence number in the message. The sequence number starts at one. To use this flag, the controller must have set the
/// EVENT_TRACE_USE_GLOBAL_SEQUENCE or EVENT_TRACE_USE_LOCAL_SEQUENCE log file mode when creating the session.
/// </term>
/// </item>
/// <item>
/// <term>TRACE_MESSAGE_SYSTEMINFO</term>
/// <term>Include the thread identifier and process identifier in the message.</term>
/// </item>
/// <item>
/// <term>TRACE_MESSAGE_TIMESTAMP</term>
/// <term>Include a time stamp in the message.</term>
/// </item>
/// </list>
/// <para><c>TRACE_MESSAGE_COMPONENTID</c> and <c>TRACE_MESSAGE_GUID</c> are mutually exclusive.</para>
/// <para>The information is included in the event data in the following order:</para>
/// <list type="bullet">
/// <item>
/// <term>Sequence number</term>
/// </item>
/// <item>
/// <term>Event trace class GUID (or component identifier)</term>
/// </item>
/// <item>
/// <term>Time stamp</term>
/// </item>
/// <item>
/// <term>Thread identifier</term>
/// </item>
/// <item>
/// <term>Process identifier</term>
/// </item>
/// </list>
/// </param>
/// <param name="MessageGuid">
/// Class GUID or component ID that identifies the message. Depends if MessageFlags contains the <c>TRACE_MESSAGE_COMPONENTID</c> or
/// <c>TRACE_MESSAGE_GUID</c> flag.
/// </param>
/// <param name="MessageNumber">
/// Number that uniquely identifies each occurrence of the message. You must define the value specified for this parameter; the value
/// should be meaningful to the application.
/// </param>
/// <returns>
/// <para>If the function succeeds, the return value is ERROR_SUCCESS.</para>
/// <para>
/// If the function fails, the return value is one of the system error codes. The following table includes some common errors and
/// their causes.
/// </para>
/// <list type="table">
/// <listheader>
/// <term>Return code</term>
/// <term>Description</term>
/// </listheader>
/// <item>
/// <term>ERROR_INVALID_HANDLE</term>
/// <term>Either the SessionHandle is NULL or specifies the NT Kernel Logger session handle.</term>
/// </item>
/// <item>
/// <term>ERROR_NOT_ENOUGH_MEMORY</term>
/// <term>
/// The session ran out of free buffers to write to. This can occur during high event rates because the disk subsystem is overloaded
/// or the number of buffers is too small. Rather than blocking until more buffers become available, TraceMessage discards the event.
/// Windows 2000 and Windows XP: Not supported.
/// </term>
/// </item>
/// <item>
/// <term>ERROR_OUTOFMEMORY</term>
/// <term>
/// The event is discarded because, although the buffer pool has not reached its maximum size, there is insufficient available memory
/// to allocate an additional buffer and there is no buffer available to receive the event.
/// </term>
/// </item>
/// <item>
/// <term>ERROR_INVALID_PARAMETER</term>
/// <term>MessageFlags contains a value that is not valid.</term>
/// </item>
/// <item>
/// <term>ERROR_MORE_DATA</term>
/// <term>
/// Data from a single event cannot span multiple buffers. A trace event is limited to the size of the event tracing session's buffer
/// minus the size of the EVENT_TRACE_HEADER structure.
/// </term>
/// </item>
/// </list>
/// </returns>
/// <remarks>
/// <para>Providers call this function.</para>
/// <para>The final __arglist parameter has the following requirements.</para>
/// <para>
/// A list of variable arguments to be appended to the message. Use this list to specify your provider-specific event data. The list
/// must be composed of pairs of arguments, as described in the following table.
/// </para>
/// <list type="table">
/// <listheader>
/// <term>Data Type</term>
/// <term>Meaning</term>
/// </listheader>
/// <item>
/// <term>PVOID</term>
/// <term>Pointer to the argument data.</term>
/// </item>
/// <item>
/// <term>size_t</term>
/// <term>The size of the argument data, in bytes.</term>
/// </item>
/// </list>
/// <para>Terminate the list using an argument pair consisting of a pointer to <c>NULL</c> and zero.</para>
/// <para>
/// The caller must ensure that the sum of the sizes of the arguments + 72 does not exceed the size of the event tracing session's buffer.
/// </para>
/// <para>
/// Using the <c>TraceEvent</c> function is the preferred way to log an event. On Windows Vista, you should use the <c>EventWrite</c>
/// function to log events.
/// </para>
/// <para>The trace events are written in the order in which they occur.</para>
/// <para>
/// If you need to access message tracing functionality from a wrapper function, call the <c>TraceMessageVa</c> version of this function.
/// </para>
/// <para>
/// Consumers will have to use the EventCallback callback to receive and process the events if the MessageFlags parameter does not
/// contain the TRACE_MESSAGE_GUID flag. If you do not specify the TRACE_MESSAGE_GUID flag, the consumer will not be able to use the
/// EventClassCallback because the <c>Header.Guid</c> member of the <c>EVENT_TRACE</c> structure will not contain the event trace
/// class GUID.
/// </para>
/// <para>
/// Note that the members of the <c>EVENT_TRACE</c> and <c>EVENT_TRACE_HEADER</c> structures that correspond to the MessageFlags
/// flags are set only if the corresponding flag is specified. For example, the <c>ThreadId</c> and <c>ProcessId</c> members of
/// <c>EVENT_TRACE_HEADER</c> are populated only if you specify the TRACE_MESSAGE_SYSTEMINFO flag.
/// </para>
/// </remarks>
// https://docs.microsoft.com/en-us/windows/desktop/etw/tracemessage ULONG TraceMessage( _In_ TRACEHANDLE SessionHandle, _In_ ULONG
// MessageFlags, _In_ LPGUID MessageGuid, _In_ USHORT MessageNumber, ... );
[DllImport(Lib.AdvApi32, SetLastError = false, ExactSpelling = true)]
[PInvokeData("Evntrace.h", MSDNShortId = "5d81c851-d47e-43f8-97b0-87156f36119a")]
public static extern Win32Error TraceMessage(TRACEHANDLE SessionHandle, TRACE_MESSAGE MessageFlags, in Guid MessageGuid, ushort MessageNumber, __arglist);
/// <summary>The <c>TraceMessageVa</c> function sends an informational message with variable arguments to an event tracing session.</summary>
/// <param name="SessionHandle">
/// Handle to the event tracing session that records the event. The provider obtains the handle when it calls the
/// <c>GetTraceLoggerHandle</c> function in its ControlCallback implementation.
/// </param>
/// <param name="MessageFlags">
/// <para>
/// Adds additional information to the beginning of the provider-specific data section of the event. The provider-specific data
/// section of the event will contain data only for those flags that are set. The variable list of argument data will follow this
/// information. This parameter can be one or more of the following values.
/// </para>
/// <list type="table">
/// <listheader>
/// <term>Flag</term>
/// <term>Meaning</term>
/// </listheader>
/// <item>
/// <term>TRACE_MESSAGE_GUID</term>
/// <term>Include the event trace class GUID in the message. The MessageGuid parameter contains the event trace class GUID.</term>
/// </item>
/// <item>
/// <term>TRACE_MESSAGE_SEQUENCE</term>
/// <term>
/// Include a sequence number in the message. The sequence number starts at one. To use this flag, the controller must have set the
/// EVENT_TRACE_USE_GLOBAL_SEQUENCE or EVENT_TRACE_USE_LOCAL_SEQUENCE log file mode when creating the session.
/// </term>
/// </item>
/// <item>
/// <term>TRACE_MESSAGE_SYSTEMINFO</term>
/// <term>Include the thread identifier and process identifier in the message.</term>
/// </item>
/// <item>
/// <term>TRACE_MESSAGE_TIMESTAMP</term>
/// <term>Include a time stamp in the message.</term>
/// </item>
/// </list>
/// <para>The information is included in the event data in the following order:</para>
/// <list type="bullet">
/// <item>
/// <term>Sequence number</term>
/// </item>
/// <item>
/// <term>Event trace class GUID</term>
/// </item>
/// <item>
/// <term>Time stamp</term>
/// </item>
/// <item>
/// <term>Thread identifier</term>
/// </item>
/// <item>
/// <term>Process identifier</term>
/// </item>
/// </list>
/// </param>
/// <param name="MessageGuid">Class GUID that identifies the event trace message.</param>
/// <param name="MessageNumber">
/// Number that uniquely identifies each occurrence of the message. You must define the value specified for this parameter; the value
/// should be meaningful to the application.
/// </param>
/// <param name="MessageArgList">
/// <para>
/// List of variable arguments to be appended to the message. The list must be composed of pairs of arguments, as described in the
/// following table.
/// </para>
/// <list type="table">
/// <listheader>
/// <term>Data Type</term>
/// <term>Meaning</term>
/// </listheader>
/// <item>
/// <term>PVOID</term>
/// <term>Pointer to the argument data.</term>
/// </item>
/// <item>
/// <term>size_t</term>
/// <term>The size of the argument data, in bytes.</term>
/// </item>
/// </list>
/// <para>Terminate the list using an argument pair consisting of a pointer to <c>NULL</c> and zero.</para>
/// <para>
/// The caller must ensure that the sum of the sizes of the arguments + 72 does not exceed the size of the event tracing session's buffer.
/// </para>
/// </param>
/// <returns>
/// <para>If the function succeeds, the return value is ERROR_SUCCESS.</para>
/// <para>
/// If the function fails, the return value is one of the system error codes. The following table includes some common errors and
/// their causes.
/// </para>
/// <list type="table">
/// <listheader>
/// <term>Return code</term>
/// <term>Description</term>
/// </listheader>
/// <item>
/// <term>ERROR_INVALID_HANDLE</term>
/// <term>Either the SessionHandle is NULL or specifies the NT Kernel Logger session handle.</term>
/// </item>
/// <item>
/// <term>ERROR_NOT_ENOUGH_MEMORY</term>
/// <term>
/// The session ran out of free buffers to write to. This can occur during high event rates because the disk subsystem is overloaded
/// or the number of buffers is too small. Rather than blocking until more buffers become available, TraceMessage discards the event.
/// Windows 2000 and Windows XP: Not supported.
/// </term>
/// </item>
/// <item>
/// <term>ERROR_OUTOFMEMORY</term>
/// <term>
/// The event is discarded because, although the buffer pool has not reached its maximum size, there is insufficient available memory
/// to allocate an additional buffer and there is no buffer available to receive the event.
/// </term>
/// </item>
/// <item>
/// <term>ERROR_INVALID_PARAMETER</term>
/// <term>MessageFlags contains a value that is not valid.</term>
/// </item>
/// <item>
/// <term>ERROR_MORE_DATA</term>
/// <term>
/// Data from a single event cannot span multiple buffers. A trace event is limited to the size of the event tracing session's buffer
/// minus the size of the EVENT_TRACE_HEADER structure.
/// </term>
/// </item>
/// </list>
/// </returns>
/// <remarks>
/// <para>Providers call this function.</para>
/// <para>
/// Using the <c>TraceEvent</c> function is the preferred way to log an event. On Windows Vista, you should use the <c>EventWrite</c>
/// function to log events.
/// </para>
/// <para>The trace events are written in the order in which they occur.</para>
/// <para>
/// If you do not need to access the message tracing functionality from a wrapper function, you can call the <c>TraceMessage</c>
/// version of this function.
/// </para>
/// <para>
/// Consumers will have to use the EventCallback callback to receive and process the events if the MessageFlags parameter does not
/// contain the TRACE_MESSAGE_GUID flag. If you do not specify the TRACE_MESSAGE_GUID flag, the consumer will not be able to use the
/// EventClassCallback because the <c>Header.Guid</c> member of the <c>EVENT_TRACE</c> structure will not contain the event trace
/// class GUID.
/// </para>
/// <para>
/// Note that the members of the <c>EVENT_TRACE</c> and <c>EVENT_TRACE_HEADER</c> structures that correspond to the MessageFlags
/// flags are set only if the corresponding flag is specified. For example, the <c>ThreadId</c> and <c>ProcessId</c> members of
/// <c>EVENT_TRACE_HEADER</c> are populated only if you specify the TRACE_MESSAGE_SYSTEMINFO flag.
/// </para>
/// </remarks>
// https://docs.microsoft.com/en-us/windows/desktop/ETW/tracemessageva ULONG TraceMessageVa( _In_ TRACEHANDLE SessionHandle, _In_
// ULONG MessageFlags, _In_ LPGUID MessageGuid, _In_ USHORT MessageNumber, _In_ va_list MessageArgList );
[DllImport(Lib.AdvApi32, SetLastError = false, ExactSpelling = true)]
[PInvokeData("Evntrace.h", MSDNShortId = "2cfb7226-fd29-432e-abfd-bd10c6344a67")]
public static extern Win32Error TraceMessageVa(TRACEHANDLE SessionHandle, TRACE_MESSAGE MessageFlags, in Guid MessageGuid, ushort MessageNumber, IntPtr MessageArgList);
/// <summary>The <c>TraceQueryInformation</c> function queries event tracing session settings for the specified information class.</summary>
/// <param name="SessionHandle">
/// A handle of the event tracing session that wants to capture the specified information. The <c>StartTrace</c> function returns
/// this handle.
/// </param>
/// <param name="InformationClass">
/// The information class to query. The information that the class captures is included in the extended data section of the event.
/// For a list of information classes that you can query, see the <c>TRACE_QUERY_INFO_CLASS</c> enumeration.
/// </param>
/// <param name="TraceInformation">
/// A pointer to a buffer to receive the returned information class specific data. The information class determines the contents of
/// this parameter. For example, for the <c>TraceStackTracingInfo</c> information class, this parameter is an array of
/// <c>CLASSIC_EVENT_ID</c> structures. The structures specify the event GUIDs for which stack tracing is enabled. The array is
/// limited to 256 elements.
/// </param>
/// <param name="InformationLength">
/// The size, in bytes, of the data returned in the TraceInformation buffer. If the function fails, this value indicates the required
/// size of the TraceInformation buffer that is needed.
/// </param>
/// <param name="ReturnLength">
/// A pointer a value that receives the size, in bytes, of the specific data returned in the TraceInformation buffer.
/// </param>
/// <returns>
/// <para>If the function succeeds, the return value is ERROR_SUCCESS.</para>
/// <para>If the function fails, the return value is one of the following error codes.</para>
/// <list type="table">
/// <listheader>
/// <term>Return code</term>
/// <term>Description</term>
/// </listheader>
/// <item>
/// <term>ERROR_BAD_LENGTH</term>
/// <term>
/// The program issued a command but the command length is incorrect. This error is returned if the InformationLength parameter is
/// less than a minimum size.
/// </term>
/// </item>
/// <item>
/// <term>ERROR_INVALID_PARAMETER</term>
/// <term>The parameter is incorrect.</term>
/// </item>
/// <item>
/// <term>ERROR_NOT_SUPPORTED</term>
/// <term>The request is not supported.</term>
/// </item>
/// <item>
/// <term>Other</term>
/// <term>Use FormatMessage to obtain the message string for the returned error.</term>
/// </item>
/// </list>
/// </returns>
/// <remarks>
/// The <c>TraceQueryInformation</c> function queries event tracing session settings for the specified information class. Call this
/// function after calling <c>StartTrace</c>.
/// </remarks>
// https://docs.microsoft.com/en-us/windows/desktop/etw/tracequeryinformation ULONG WINAPI TraceQueryInformation( _In_ TRACEHANDLE
// SessionHandle, _In_ TRACE_QUERY_INFO_CLASS InformationClass, _Out_ PVOID TraceInformation, _In_ ULONG InformationLength, _Out_opt_
// PULONG ReturnLength );
[DllImport(Lib.AdvApi32, SetLastError = false, ExactSpelling = true)]
[PInvokeData("Evntrace.h", MSDNShortId = "3CC91F7C-7F82-4B3B-AA50-FE03CFEC0278")]
public static extern Win32Error TraceQueryInformation(TRACEHANDLE SessionHandle, TRACE_QUERY_INFO_CLASS InformationClass, IntPtr TraceInformation, uint InformationLength, out uint ReturnLength);
/// <summary>
/// The <c>TraceSetInformation</c> function enables or disables event tracing session settings for the specified information class.
/// </summary>
/// <param name="SessionHandle">
/// A handle of the event tracing session that wants to capture the specified information. The <c>StartTrace</c> function returns
/// this handle.
/// </param>
/// <param name="InformationClass">
/// The information class to enable or disable. The information that the class captures is included in the extended data section of
/// the event. For a list of information classes that you can enable, see the <c>TRACE_INFO_CLASS</c> enumeration.
/// </param>
/// <param name="TraceInformation">
/// A pointer to information class specific data; the information class determines the contents of this parameter. For example, for
/// the <c>TraceStackTracingInfo</c> information class, this parameter is an array of <c>CLASSIC_EVENT_ID</c> structures. The
/// structures specify the event GUIDs for which stack tracing is enabled. The array is limited to 256 elements.
/// </param>
/// <param name="InformationLength">The size, in bytes, of the data in the TraceInformation buffer.</param>
/// <returns>
/// <para>If the function succeeds, the return value is ERROR_SUCCESS.</para>
/// <para>If the function fails, the return value is one of the following error codes.</para>
/// <list type="table">
/// <listheader>
/// <term>Return code</term>
/// <term>Description</term>
/// </listheader>
/// <item>
/// <term>ERROR_BAD_LENGTH</term>
/// <term>
/// The program issued a command but the command length is incorrect. This error is returned if the InformationLength parameter is
/// less than a minimum size.
/// </term>
/// </item>
/// <item>
/// <term>ERROR_INVALID_PARAMETER</term>
/// <term>The parameter is incorrect.</term>
/// </item>
/// <item>
/// <term>ERROR_NOT_SUPPORTED</term>
/// <term>The request is not supported.</term>
/// </item>
/// <item>
/// <term>Other</term>
/// <term>Use FormatMessage to obtain the message string for the returned error.</term>
/// </item>
/// </list>
/// </returns>
/// <remarks>
/// <para>Call this function after calling <c>StartTrace</c>.</para>
/// <para>
/// If the InformationClass parameter is set to <c>TraceStackTracingInfo</c>, calling this function enables stack tracing of the
/// specified kernel events. Subsequent calls to this function overwrites the previous list of kernel events for which stack tracing
/// is enabled. To disable stack tracing, call this function with InformationClass set to <c>TraceStackTracingInfo</c> and
/// InformationLength set to 0.
/// </para>
/// <para>
/// The extended data section of the event will include the call stack. The <c>StackWalk_Event</c> MOF class defines the layout of
/// the extended data.
/// </para>
/// <para>
/// Typically, on 64-bit computers, you cannot capture the kernel stack in certain contexts when page faults are not allowed. To
/// enable walking the kernel stack on x64, set the <c>DisablePagingExecutive</c> Memory Management registry value to 1. The
/// <c>DisablePagingExecutive</c> registry value is located under the following registry key:
/// </para>
/// <para><c>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Memory Management</c></para>
/// <para>You should consider the cost of setting this registry value before doing so.</para>
/// </remarks>
// https://docs.microsoft.com/en-us/windows/desktop/ETW/tracesetinformation ULONG WINAPI TraceSetInformation( _In_ TRACEHANDLE
// SessionHandle, _In_ TRACE_INFO_CLASS InformationClass, _In_ PVOID TraceInformation, _In_ ULONG InformationLength );
[DllImport(Lib.AdvApi32, SetLastError = false, ExactSpelling = true)]
[PInvokeData("Evntrace.h", MSDNShortId = "f4cdbe32-6885-4844-add5-560961c3dd1d")]
public static extern Win32Error TraceSetInformation(TRACEHANDLE SessionHandle, TRACE_QUERY_INFO_CLASS InformationClass, IntPtr TraceInformation, uint InformationLength);
/// <summary>The <c>UnregisterTraceGuids</c> function unregisters an event trace provider and its event trace classes.</summary>
/// <param name="RegistrationHandle">
/// Handle to the event trace provider, obtained from an earlier call to the <c>RegisterTraceGuids</c> function.
/// </param>
/// <returns>
/// <para>If the function succeeds, the return value is ERROR_SUCCESS.</para>
/// <para>
/// If the function fails, the return value is one of the system error codes. The following table includes some common errors and
/// their causes.
/// </para>
/// <list type="table">
/// <listheader>
/// <term>Return code</term>
/// <term>Description</term>
/// </listheader>
/// <item>
/// <term>ERROR_INVALID_PARAMETER</term>
/// <term>The RegistrationHandle parameter does not specify the handle to a registered provider or is NULL.</term>
/// </item>
/// </list>
/// </returns>
/// <remarks>
/// <para>Providers call this function.</para>
/// <para>The event trace provider must have been registered previously by calling the <c>RegisterTraceGuids</c> function.</para>
/// </remarks>
// https://docs.microsoft.com/en-us/windows/desktop/ETW/unregistertraceguids ULONG UnregisterTraceGuids( _In_ TRACEHANDLE
// RegistrationHandle );
[DllImport(Lib.AdvApi32, SetLastError = false, ExactSpelling = true)]
[PInvokeData("Evntrace.h", MSDNShortId = "1fa10f66-a78b-4f40-9518-72d48365246e")]
public static extern Win32Error UnregisterTraceGuids(TRACEHANDLE RegistrationHandle);
/// <summary>
/// <para>The <c>UpdateTrace</c> function updates the property setting of the specified event tracing session.</para>
/// <para>The <c>ControlTrace</c> function supersedes this function.</para>
/// </summary>
/// <param name="SessionHandle">
/// Handle to the event tracing session to update, or <c>NULL</c>. You must specify SessionHandle if SessionName is <c>NULL</c>.
/// However, ETW ignores the handle if SessionName is not <c>NULL</c>. The handle is returned by the <c>StartTrace</c> function.
/// </param>
/// <param name="SessionName">
/// <para>
/// Pointer to a null-terminated string that specifies the name of the event tracing session to update, or <c>NULL</c>. You must
/// specify SessionName if SessionHandle is <c>NULL</c>.
/// </para>
/// <para>To specify the NT Kernel Logger session, set SessionName to <c>KERNEL_LOGGER_NAME</c>.</para>
/// </param>
/// <param name="Properties">
/// <para>Pointer to an initialized <c>EVENT_TRACE_PROPERTIES</c> structure.</para>
/// <para>
/// On input, the members must specify the new values for the properties to update. For information on which properties you can
/// update, see Remarks.
/// </para>
/// <para>On output, the structure members contains the updated settings and statistics for the event tracing session.</para>
/// </param>
/// <returns>
/// <para>If the function succeeds, the return value is ERROR_SUCCESS.</para>
/// <para>
/// If the function fails, the return value is one of the system error codes. The following table includes some common errors and
/// their causes.
/// </para>
/// <list type="table">
/// <listheader>
/// <term>Return code</term>
/// <term>Description</term>
/// </listheader>
/// <item>
/// <term>ERROR_BAD_LENGTH</term>
/// <term>The BufferSize member of the Wnode member of Properties specifies an incorrect size.</term>
/// </item>
/// <item>
/// <term>ERROR_INVALID_PARAMETER</term>
/// <term>
/// One of the following is true: Windows Server 2003 and Windows XP: The Guid member of the Wnode structure is
/// SystemTraceControlGuid, but the SessionName parameter is not KERNEL_LOGGER_NAME.
/// </term>
/// </item>
/// <item>
/// <term>ERROR_ACCESS_DENIED</term>
/// <term>
/// Only users with administrative privileges, users in the Performance Log Users group, and services running as LocalSystem,
/// LocalService, NetworkService can control event tracing sessions. To grant a restricted user the ability to control trace
/// sessions, add them to the Performance Log Users group. Windows XP and Windows 2000: Anyone can control a trace session.
/// </term>
/// </item>
/// </list>
/// </returns>
/// <remarks>
/// <para>Controllers call this function.</para>
/// <para>On input, the members must specify the new values for the properties to update. You can update the following properties.</para>
/// <list type="table">
/// <listheader>
/// <term>Member</term>
/// <term>Use</term>
/// </listheader>
/// <item>
/// <term>EnableFlags</term>
/// <term>
/// Set this member to 0 to disable all kernel providers. Otherwise, you must specify the kernel providers that you want to enable or
/// keep enabled. Applies only to NT Kernel Logger sessions.
/// </term>
/// </item>
/// <item>
/// <term>FlushTimer</term>
/// <term>
/// Set this member if you want to change the time to wait before flushing buffers. If this member is 0, the member is not updated.
/// </term>
/// </item>
/// <item>
/// <term>LogFileNameOffset</term>
/// <term>
/// Set this member if you want to switch to another log file. If this member is 0, the file name is not updated. If the offset is
/// not zero and you do not change the log file name, the function returns an error.
/// </term>
/// </item>
/// <item>
/// <term>LogFileMode</term>
/// <term>
/// Set this member if you want to turn EVENT_TRACE_REAL_TIME_MODE on and off. To turn real time consuming off, set this member to 0.
/// To turn real time consuming on, set this member to EVENT_TRACE_REAL_TIME_MODE and it will be OR'd with the current modes.
/// </term>
/// </item>
/// <item>
/// <term>MaximumBuffers</term>
/// <term>
/// Set set this member if you want to change the maximum number of buffers that ETW uses. If this member is 0, the member is not updated.
/// </term>
/// </item>
/// </list>
/// <para>For private logger sessions, you can only update <c>LogFileNameOffset</c> and <c>FlushTimer</c>.</para>
/// <para>
/// If you are using a newly initialized <c>EVENT_TRACE_PROPERTIES</c> structure, the only members you need to specify, other than
/// the members you are updating, are <c>Wnode.BufferSize</c>, <c>Wnode.Guid</c>, and <c>Wnode.Flags</c>.
/// </para>
/// <para>
/// If you use the property structure you passed to <c>StartTrace</c>, make sure the <c>LogFileNameOffset</c> member is 0 unless you
/// are changing the log file name.
/// </para>
/// <para>
/// If you call the <c>ControlTrace</c> function to query the current session properties and then update those properties to update
/// the session, make sure you set <c>LogFileNameOffset</c> to 0 (unless you are changing the log file name) and set
/// <c>EVENT_TRACE_PROPERTIES.Wnode.Flags</c> to <c>WNODE_FLAG_TRACED_GUID</c>.
/// </para>
/// <para>To obtain the property settings and session statistics for an event tracing session, call the <c>ControlTrace</c> function.</para>
/// </remarks>
// https://docs.microsoft.com/en-us/windows/desktop/ETW/updatetrace ULONG UpdateTrace( _In_ TRACEHANDLE SessionHandle, _In_ LPCTSTR
// SessionName, _Inout_ PEVENT_TRACE_PROPERTIES Properties );
[DllImport(Lib.AdvApi32, SetLastError = false, CharSet = CharSet.Auto)]
[PInvokeData("Evntrace.h", MSDNShortId = "40e6deaf-7363-45eb-80d0-bc3f33760875")]
public static extern Win32Error UpdateTrace(TRACEHANDLE SessionHandle, string SessionName, ref EVENT_TRACE_PROPERTIES Properties);
// ULONG EnableTrace( _In_ ULONG Enable, _In_ ULONG EnableFlag, _In_ ULONG EnableLevel, _In_ LPCGUID ControlGuid, _In_ TRACEHANDLE
// SessionHandle );
[DllImport(Lib.AdvApi32, SetLastError = false, EntryPoint = "EnableTrace")]
private static extern Win32Error InternalEnableTrace([MarshalAs(UnmanagedType.Bool)] bool Enable, uint EnableFlag, uint EnableLevel, in Guid ControlGuid, TRACEHANDLE SessionHandle);
/// <summary>Identifies the kernel event for which you want to enable call stack tracing.</summary>
/// <remarks>
/// To enable the <c>read</c> event type for <c>disk IO</c> events, set <c>GUID</c> to 3d6fa8d4-fe05-11d0-9dda-00c04fd7ba7c and
/// <c>Type</c> to 10.
/// </remarks>
// https://docs.microsoft.com/en-us/windows/win32/etw/classic-event-id typedef struct _CLASSIC_EVENT_ID { GUID EventGuid; UCHAR Type;
// UCHAR Reserved[7]; } CLASSIC_EVENT_ID, *PCLASSIC_EVENT_ID;
[PInvokeData("Evntrace.h", MSDNShortId = "cbd77002-466b-40e6-85a5-cd872aef7d51")]
[StructLayout(LayoutKind.Sequential)]
public struct CLASSIC_EVENT_ID
{
/// <summary>The GUID that identifies the kernel event class.</summary>
public Guid EventGuid;
/// <summary>The event type that identifies the event within the kernel event class to enable.</summary>
public byte Type;
/// <summary>Reserved.</summary>
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 7)]
public byte[] Reserved;
}
/// <summary>The <c>ENABLE_TRACE_PARAMETERS</c> structure defines the information used to enable a provider.</summary>
/// <remarks>
/// <para>
/// The <c>ENABLE_TRACE_PARAMETERS</c> structure is a version 2 structure and replaces the <c>ENABLE_TRACE_PARAMETERS_V1</c>
/// structure for use with the <c>EnableTraceEx2</c> function.
/// </para>
/// <para>
/// On Windows 8.1,Windows Server 2012 R2, and later, event payload , scope, and stack walk filters can be used by the
/// <c>EnableTraceEx2</c> function and the <c>ENABLE_TRACE_PARAMETERS</c> and <c>EVENT_FILTER_DESCRIPTOR</c> structures to filter on
/// specific conditions in a logger session. For more information on event payload filters, see the <c>EnableTraceEx2</c>,
/// <c>TdhCreatePayloadFilter</c>, and <c>TdhAggregatePayloadFilters</c> functions and the <c>EVENT_FILTER_DESCRIPTOR</c> and
/// <c>PAYLOAD_FILTER_PREDICATE</c> structures.
/// </para>
/// <para>
/// Typically, on 64-bit computers, you cannot capture the kernel stack in certain contexts when page faults are not allowed. To
/// enable walking the kernel stack on x64, set the <c>DisablePagingExecutive</c> Memory Management registry value to 1. The
/// <c>DisablePagingExecutive</c> registry value is located under the following registry key:
/// </para>
/// <para><c>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Memory Management</c></para>
/// <para>You should consider the cost of setting this registry value before doing so.</para>
/// </remarks>
// https://docs.microsoft.com/en-us/windows/desktop/ETW/enable-trace-parameters typedef struct _ENABLE_TRACE_PARAMETERS { ULONG
// Version; ULONG EnableProperty; ULONG ControlFlags; GUID SourceId; PEVENT_FILTER_DESCRIPTOR EnableFilterDesc; ULONG
// FilterDescCount; } ENABLE_TRACE_PARAMETERS, *PENABLE_TRACE_PARAMETERS;
[PInvokeData("evntrace.h", MSDNShortId = "bc7cf886-f763-428a-9e75-031e8df26554")]
[StructLayout(LayoutKind.Sequential)]
public struct ENABLE_TRACE_PARAMETERS
{
/// <summary>Set to <c>ENABLE_TRACE_PARAMETERS_VERSION_2</c>.</summary>
public uint Version;
/// <summary>
/// Optional settings that ETW can include when writing the event. Some settings write extra data to the <c>extended data
/// item</c> section of each event. Other settings refine which events will be included. To use these optional settings, specify
/// one or more of the following flags; otherwise, set to zero.
/// </summary>
public uint EnableProperty;
/// <summary>Reserved. Set to 0.</summary>
public uint ControlFlags;
/// <summary>
/// A GUID that uniquely identifies the session that is enabling or disabling the provider. If the provider does not implement
/// <c>EnableCallback</c>, the GUID is not used.
/// </summary>
public Guid SourceId;
/// <summary>
/// <para>
/// A pointer to an array of <c>EVENT_FILTER_DESCRIPTOR</c> structures that points to the filter data. The number of elements in
/// the array is specified in the <c>FilterDescCount</c> member. There can only be one filter for a specific filter type as
/// specified by the <c>Type</c> member of the <c>EVENT_FILTER_DESCRIPTOR</c> structure.
/// </para>
/// <para>
/// For a schematized filter (a <c>Type</c> member equal to <c>EVENT_FILTER_TYPE_SCHEMATIZED</c>), the provider uses filter data
/// to prevent events that match the filter criteria from being written to the session. The provider determines the layout of the
/// data and how it applies the filter to the event's data. A session can pass only one schematized filter to the provider.
/// </para>
/// <para>
/// A session can call the <c>TdhEnumerateProviderFilters</c> function to determine the schematized filters that it can pass to
/// the provider.
/// </para>
/// </summary>
public IntPtr EnableFilterDesc;
/// <summary>
/// <para>
/// The number of elements (filters) in the <c>EVENT_FILTER_DESCRIPTOR</c> array pointed to by <c>EnableFilterDesc</c> member.
/// </para>
/// <para>
/// The <c>FilterDescCount</c> member should match the number of <c>EVENT_FILTER_DESCRIPTOR</c> structures in the array pointed
/// to by the <c>EnableFilterDesc</c> member.
/// </para>
/// <para>.</para>
/// </summary>
public uint FilterDescCount;
}
/// <summary>The <c>ENABLE_TRACE_PARAMETERS_V1</c> structure defines the information used to enable a provider.</summary>
/// <remarks>
/// <para>
/// The <c>ENABLE_TRACE_PARAMETERS_V1</c> structure is used with the <c>EnableTrace</c> and <c>EnableTraceEx</c> functions. The
/// <c>ENABLE_TRACE_PARAMETERS</c> structure is a version 2 structure and replaces the <c>ENABLE_TRACE_PARAMETERS_V1</c> structure
/// for use with the <c>EnableTraceEx2</c> function.
/// </para>
/// <para>
/// Typically, on 64-bit computers, you cannot capture the kernel stack in certain contexts when page faults are not allowed. To
/// enable walking the kernel stack on x64, set the <c>DisablePagingExecutive</c> Memory Management registry value to 1. The
/// <c>DisablePagingExecutive</c> registry value is located under the following registry key:
/// </para>
/// <para><c>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Memory Management</c></para>
/// <para>You should consider the cost of setting this registry value before doing so.</para>
/// </remarks>
// https://docs.microsoft.com/en-us/windows/win32/etw/enable-trace-parameters-v1 typedef struct _ENABLE_TRACE_PARAMETERS_V1 { ULONG
// Version; ULONG EnableProperty; ULONG ControlFlags; GUID SourceId; PEVENT_FILTER_DESCRIPTOR EnableFilterDesc; }
// ENABLE_TRACE_PARAMETERS_V1, *PENABLE_TRACE_PARAMETERS_V1;
[PInvokeData("evntrace.h", MSDNShortId = "6FC5EF54-2D05-4246-A8E8-7FDA0ABA0D4B")]
[StructLayout(LayoutKind.Sequential)]
public struct ENABLE_TRACE_PARAMETERS_V1
{
/// <summary>Set to <c>ENABLE_TRACE_PARAMETERS_VERSION</c>.</summary>
public uint Version;
/// <summary>
/// <para>
/// Optional information that ETW can include when writing the event. The data is written to the <c>extended data item</c>
/// section of the event. To include the optional information, specify one or more of the following flags; otherwise, set to zero.
/// </para>
/// <list type="table">
/// <listheader>
/// <term>Value</term>
/// <term>Meaning</term>
/// </listheader>
/// <item>
/// <term>EVENT_ENABLE_PROPERTY_SID</term>
/// <term>Include in the extended data the security identifier (SID) of the user.</term>
/// </item>
/// <item>
/// <term>EVENT_ENABLE_PROPERTY_TS_ID</term>
/// <term>Include in the extended data the terminal session identifier.</term>
/// </item>
/// <item>
/// <term>EVENT_ENABLE_PROPERTY_STACK_TRACE</term>
/// <term>
/// Include in the extended data a call stack trace for events written using EventWrite. If you set
/// EVENT_ENABLE_PROPERTY_STACK_TRACE, ETW will drop the event if the total event size exceeds 64K. If the provider is logging
/// events close in size to 64K maximum, it is possible that enabling stack capture will cause the event to be lost. If the stack
/// is longer than the maximum number of frames (192), the frames will be cut from the bottom of the stack. For consumers, the
/// events will include the EVENT_EXTENDED_ITEM_STACK_TRACE32 or EVENT_EXTENDED_ITEM_STACK_TRACE64 extended item. Note that on
/// 64-bit computers, 32-bit processes will receive 64-bit stack traces.
/// </term>
/// </item>
/// </list>
/// </summary>
public uint EnableProperty;
/// <summary>Reserved. Set to 0.</summary>
public uint ControlFlags;
/// <summary>
/// A GUID that uniquely identifies the session that is enabling or disabling the provider. If the provider does not implement
/// <c>EnableCallback</c>, the GUID is not used.
/// </summary>
public Guid SourceId;
/// <summary>
/// <para>
/// An <c>EVENT_FILTER_DESCRIPTOR</c> structure that points to the filter data. The provider uses filter data to prevent events
/// that match the filter criteria from being written to the session. The provider determines the layout of the data and how it
/// applies the filter to the event's data. A session can pass only one filter to the provider.
/// </para>
/// <para>
/// A session can call the <c>TdhEnumerateProviderFilters</c> function to determine the schematized filters that it can pass to
/// the provider.
/// </para>
/// </summary>
public IntPtr EnableFilterDesc;
}
/// <summary>The <c>ETW_BUFFER_CONTEXT</c> structure provides context information about the event.</summary>
// https://docs.microsoft.com/en-us/windows/desktop/api/relogger/ns-relogger-_etw_buffer_context typedef struct _ETW_BUFFER_CONTEXT {
// union { struct { UCHAR ProcessorNumber; UCHAR Alignment; } DUMMYSTRUCTNAME; USHORT ProcessorIndex; } DUMMYUNIONNAME; USHORT
// LoggerId; } ETW_BUFFER_CONTEXT, *PETW_BUFFER_CONTEXT;
[PInvokeData("relogger.h", MSDNShortId = "75577305-fb3f-40a2-8fe6-9cd82c3f4e69")]
[StructLayout(LayoutKind.Sequential)]
public struct ETW_BUFFER_CONTEXT
{
/// <summary>The number of the CPU on which the provider process was running. The number is zero on a single processor computer.</summary>
public byte ProcessorNumber;
/// <summary>Alignment between events (always eight).</summary>
public byte Alignment;
/// <summary>Identifier of the session that logged the event.</summary>
public ushort LoggerId;
}
/// <summary>Contains partition information pulled from an ETW trace. Most commonly used as a return structure for <c>QueryTraceProcessingHandle</c>.</summary>
// https://docs.microsoft.com/en-us/windows/win32/etw/etw-trace-partition-information typedef struct _ETW_TRACE_PARTITION_INFORMATION
// { GUID PartitionId; GUID ParentId; ULONG64 Reserved; ULONG PartitionType; } ETW_TRACE_PARTITION_INFORMATION, *PETW_TRACE_PARTITION_INFORMATION;
[PInvokeData("", MSDNShortId = "8D8F8E79-B273-417A-B8C2-6CE4FC454C07")]
[StructLayout(LayoutKind.Sequential)]
public struct ETW_TRACE_PARTITION_INFORMATION
{
/// <summary>GUID to identify the machine.</summary>
public Guid PartitionId;
/// <summary>
/// GUID that identifies the partition instance that contains the traced partition. If the traced partition is a host, then
/// <c>ParentId</c> will be 0.
/// </summary>
public Guid ParentId;
/// <summary>Reserved for future use.</summary>
public ulong Reserved;
/// <summary>
/// <para>Enumeration value of the container type. the value may be one of the following:</para>
/// <list type="table">
/// <listheader>
/// <term>Value</term>
/// <term>Meaning</term>
/// </listheader>
/// <item>
/// <term>Process 1</term>
/// <term>For events originating from inside a “Windows Server Container”.</term>
/// </item>
/// <item>
/// <term>VmHost 2</term>
/// <term>For events originating from inside a “Hyper-V Container”.</term>
/// </item>
/// <item>
/// <term>VmHostedUvm 3</term>
/// <term>For events originating from a “Hyper-V Container” template virtual machine.</term>
/// </item>
/// <item>
/// <term>VmDirectUvm 4</term>
/// <term>For events originating from applications running with Windows Defender Application Guard.</term>
/// </item>
/// </list>
/// </summary>
public uint PartitionType;
}
/// <summary>
/// The <c>EVENT_EXTENDED_ITEM_INSTANCE</c> structure defines the relationship between events if TraceEventInstance was used to log
/// related events.
/// </summary>
// https://docs.microsoft.com/en-us/windows/win32/api/evntcons/ns-evntcons-event_extended_item_instance typedef struct
// _EVENT_EXTENDED_ITEM_INSTANCE { ULONG InstanceId; ULONG ParentInstanceId; GUID ParentGuid; } EVENT_EXTENDED_ITEM_INSTANCE, *PEVENT_EXTENDED_ITEM_INSTANCE;
[PInvokeData("evntcons.h", MSDNShortId = "3def638b-cab2-4b5d-b409-7285caa77ae1")]
[StructLayout(LayoutKind.Sequential)]
public struct EVENT_EXTENDED_ITEM_INSTANCE
{
/// <summary>A unique transaction identifier that maps an event to a specific transaction.</summary>
public uint InstanceId;
/// <summary>A unique transaction identifier of a parent event if you are mapping a hierarchical relationship.</summary>
public uint ParentInstanceId;
/// <summary>
/// A GUID that uniquely identifies the provider that logged the event referenced by the <c>ParentInstanceId</c> member.
/// </summary>
public Guid ParentGuid;
}
/// <summary>The <c>EVENT_EXTENDED_ITEM_RELATED_ACTIVITYID</c> structure defines the parent event of this event.</summary>
// https://docs.microsoft.com/en-us/windows/win32/api/evntcons/ns-evntcons-event_extended_item_related_activityid typedef struct
// _EVENT_EXTENDED_ITEM_RELATED_ACTIVITYID { GUID RelatedActivityId; } EVENT_EXTENDED_ITEM_RELATED_ACTIVITYID, *PEVENT_EXTENDED_ITEM_RELATED_ACTIVITYID;
[PInvokeData("evntcons.h", MSDNShortId = "cabc11ca-e65e-4ffd-9832-7fb4f77417e4")]
[StructLayout(LayoutKind.Sequential)]
public struct EVENT_EXTENDED_ITEM_RELATED_ACTIVITYID
{
/// <summary>
/// A GUID that uniquely identifies the parent activity to which this activity is related. The identifier is specified in the
/// RelatedActivityId parameter passed to the EventWriteTransfer function.
/// </summary>
public Guid RelatedActivityId;
}
/// <summary>The <c>EVENT_EXTENDED_ITEM_STACK_TRACE32</c> structure defines a call stack on a 32-bit computer.</summary>
/// <remarks>
/// The <c>DataSize</c> member of EVENT_HEADER_EXTENDED_DATA_ITEM contains the size of this structure. To determine the number of
/// addresses in the array, subtract from <c>DataSize</c> and then divide by .
/// </remarks>
// https://docs.microsoft.com/en-us/windows/win32/api/evntcons/ns-evntcons-event_extended_item_stack_trace32 typedef struct
// _EVENT_EXTENDED_ITEM_STACK_TRACE32 { ULONG64 MatchId; ULONG Address[ANYSIZE_ARRAY]; } EVENT_EXTENDED_ITEM_STACK_TRACE32, *PEVENT_EXTENDED_ITEM_STACK_TRACE32;
[PInvokeData("evntcons.h", MSDNShortId = "6898951a-5719-47aa-a219-97f82095686f")]
[StructLayout(LayoutKind.Sequential)]
public struct EVENT_EXTENDED_ITEM_STACK_TRACE32
{
/// <summary>
/// <para>
/// A unique identifier that you use to match the kernel-mode calls to the user-mode calls; the kernel-mode calls and user-mode
/// calls are captured in separate events if the environment prevents both from being captured in the same event. If the
/// kernel-mode and user-mode calls were captured in the same event, the value is zero.
/// </para>
/// <para>
/// Typically, on 32-bit computers, you can always capture both the kernel-mode and user-mode calls in the same event. However,
/// if you use the frame pointer optimization compiler option, the stack may not be captured, captured incorrectly, or truncated.
/// </para>
/// </summary>
public ulong MatchId;
///// <summary>An array of call addresses on the stack.</summary>
//public uint Address[ANYSIZE_ARRAY];
}
/// <summary>The <c>EVENT_EXTENDED_ITEM_STACK_TRACE64</c> structure defines a call stack on a 64-bit computer.</summary>
/// <remarks>
/// The <c>DataSize</c> member of EVENT_HEADER_EXTENDED_DATA_ITEM contains the size of this structure. To determine the number of
/// addresses in the array, subtract from <c>DataSize</c> and then divide by .
/// </remarks>
// https://docs.microsoft.com/en-us/windows/win32/api/evntcons/ns-evntcons-event_extended_item_stack_trace64 typedef struct
// _EVENT_EXTENDED_ITEM_STACK_TRACE64 { ULONG64 MatchId; ULONG64 Address[ANYSIZE_ARRAY]; } EVENT_EXTENDED_ITEM_STACK_TRACE64, *PEVENT_EXTENDED_ITEM_STACK_TRACE64;
[PInvokeData("evntcons.h", MSDNShortId = "3c9e0dcb-1eb9-4c9f-a4c8-5a93566be303")]
[StructLayout(LayoutKind.Sequential)]
public struct EVENT_EXTENDED_ITEM_STACK_TRACE64
{
/// <summary>
/// A unique identifier that you use to match the kernel-mode calls to the user-mode calls; the kernel-mode calls and user-mode
/// calls are captured in separate events if the environment prevents both from being captured in the same event. If the
/// kernel-mode and user-mode calls were captured in the same event, the value is zero.
/// </summary>
public ulong MatchId;
///// <summary>An array of call addresses on the stack.</summary>
//public ulong Address[ANYSIZE_ARRAY];
}
/// <summary>The <c>EVENT_EXTENDED_ITEM_TS_ID</c> defines the terminal session that logged the event.</summary>
// https://docs.microsoft.com/en-us/windows/win32/api/evntcons/ns-evntcons-event_extended_item_ts_id typedef struct
// _EVENT_EXTENDED_ITEM_TS_ID { ULONG SessionId; } EVENT_EXTENDED_ITEM_TS_ID, *PEVENT_EXTENDED_ITEM_TS_ID;
[PInvokeData("evntcons.h", MSDNShortId = "fcf1252d-9730-45a2-b601-60f76decd0dd")]
[StructLayout(LayoutKind.Sequential)]
public struct EVENT_EXTENDED_ITEM_TS_ID
{
/// <summary>Identifies the terminal session that logged the event.</summary>
public uint SessionId;
}
/// <summary>
/// The <c>EVENT_FILTER_EVENT_ID</c> structure defines event IDs used in an EVENT_FILTER_DESCRIPTOR structure for an event ID or
/// stack walk filter.
/// </summary>
/// <remarks>
/// The <c>EVENT_FILTER_EVENT_ID</c> structure is used in the EVENT_FILTER_DESCRIPTOR structure when the <c>Type</c> member of the
/// <c>EVENT_FILTER_DESCRIPTOR</c> is set to <c>EVENT_FILTER_TYPE_EVENT_ID</c> or <c>EVENT_FILTER_TYPE_STACKWALK</c>. This
/// corresponds to an event ID filter (one of the possible scope filters) or a stack walk filter. The <c>EVENT_FILTER_EVENT_ID</c>
/// structure contains an array of event IDs and a Boolean value that indicates if filtering is enabled or disabled for the specified
/// event IDs.
/// </remarks>
// https://docs.microsoft.com/en-us/windows/win32/api/evntprov/ns-evntprov-event_filter_event_id typedef struct
// _EVENT_FILTER_EVENT_ID { BOOLEAN FilterIn; UCHAR Reserved; USHORT Count; USHORT Events[ANYSIZE_ARRAY]; } EVENT_FILTER_EVENT_ID, *PEVENT_FILTER_EVENT_ID;
[PInvokeData("evntprov.h", MSDNShortId = "D660D140-BE86-44F6-B1D2-E1B97300BD11")]
[StructLayout(LayoutKind.Sequential)]
public struct EVENT_FILTER_EVENT_ID
{
/// <summary>
/// <para>
/// A value that indicates whether filtering should be enabled or disabled for the event IDs passed in the <c>Events</c> member.
/// </para>
/// <para>
/// When this member is <c>TRUE</c>, filtering is enabled for the specified event IDs. When this member is <c>FALSE</c>,
/// filtering is disabled for the event IDs.
/// </para>
/// </summary>
[MarshalAs(UnmanagedType.U1)] public bool FilterIn;
/// <summary>A reserved value.</summary>
public byte Reserved;
/// <summary>The number of event IDs in the <c>Events</c> member.</summary>
public ushort Count;
///// <summary>An array of event IDs.</summary>
//public ushort Events[ANYSIZE_ARRAY];
}
/// <summary>
/// <para>
/// The <c>EVENT_FILTER_EVENT_NAME</c> structure defines event IDs used in an EVENT_FILTER_DESCRIPTOR structure for an event name or
/// stalk walk name filter.
/// </para>
/// <para>
/// This filter will only be applied to events that are otherwise enabled on the logging session, via level/keyword in the enable call.
/// </para>
/// </summary>
// https://docs.microsoft.com/en-us/windows/win32/api/evntprov/ns-evntprov-event_filter_event_name typedef struct
// _EVENT_FILTER_EVENT_NAME { ULONGLONG MatchAnyKeyword; ULONGLONG MatchAllKeyword; UCHAR Level; BOOLEAN FilterIn; USHORT NameCount;
// UCHAR Names[ANYSIZE_ARRAY]; } EVENT_FILTER_EVENT_NAME, *PEVENT_FILTER_EVENT_NAME;
[PInvokeData("evntprov.h", MSDNShortId = "85E8C8F8-31D4-42F1-9267-15F74E473D57")]
[StructLayout(LayoutKind.Sequential)]
public struct EVENT_FILTER_EVENT_NAME
{
/// <summary>Bitmask of keywords that determine the category of events to filter on.</summary>
public ulong MatchAnyKeyword;
/// <summary>
/// This bitmask is optional. This mask further restricts the category of events that you want to filter on. If the event's
/// keyword meets the <c>MatchAnyKeyword</c> condition, the provider will filter the event only if all of the bits in this mask
/// exist in the event's keyword. This mask is not used if <c>MatchAnyKeyword</c> is zero.
/// </summary>
public ulong MatchAllKeyword;
/// <summary>Defines the severity level of the event to filter on.</summary>
public TRACE_LEVEL Level;
/// <summary>
/// <para><c>True</c> to filter the events matching the provided names in; <c>false</c> to filter them out.</para>
/// <para>
/// When used for the <c>EVENT_FILTER_TYPE_STACKWALK_NAME</c> filter type, the filtered in events will have stacks collected for them.
/// </para>
/// </summary>
[MarshalAs(UnmanagedType.U1)]
public bool FilterIn;
/// <summary>The number of names in the <c>Names</c> member.</summary>
public ushort NameCount;
///// <summary>An <c>NameCount</c> long array of null-terminated, UTF-8 event names.</summary>
//public byte Names[ANYSIZE_ARRAY];
}
/// <summary>Defines the header data that must precede the filter data that is defined in the instrumentation manifest.</summary>
/// <remarks>
/// The filter data that you pass to the provider also includes a header. The following shows an example of how you would define a
/// filter that contained three integers:
/// </remarks>
// https://docs.microsoft.com/en-us/windows/win32/api/evntprov/ns-evntprov-event_filter_header typedef struct _EVENT_FILTER_HEADER {
// USHORT Id; UCHAR Version; UCHAR Reserved[5]; ULONGLONG InstanceId; ULONG Size; ULONG NextOffset; } EVENT_FILTER_HEADER, *PEVENT_FILTER_HEADER;
[PInvokeData("evntprov.h", MSDNShortId = "364a253d-f4c4-494a-af43-487c70912542")]
[StructLayout(LayoutKind.Sequential)]
public struct EVENT_FILTER_HEADER
{
/// <summary>
/// The identifier that identifies the filter in the manifest for a schematized filter. The <c>value</c> attribute of the
/// <c>filter</c> element contains the identifier.
/// </summary>
public ushort Id;
/// <summary>
/// The version number of the filter for a schematized filter. The <c>version</c> attribute of the <c>filter</c> element contains
/// the version number.
/// </summary>
public byte Version;
/// <summary>Reserved</summary>
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 5)]
public byte[] Reserved;
/// <summary>
/// <para>
/// An identifier that identifies the session that passed the filter. ETW sets this value; the session must set this member to zero.
/// </para>
/// <para>
/// Providers use this value to set the Filter parameter of EventWriteEx to prevent the event from being written to the session
/// if the event data does not match the filter criteria (the provider determines the semantics of how the filter data is used in
/// determining whether the event is written to the session).
/// </para>
/// </summary>
public ulong InstanceId;
/// <summary>The size, in bytes, of this header and the filter data that is appended to the end of this header.</summary>
public uint Size;
/// <summary>
/// The offset from the beginning of this filter object to the next filter object. The value is zero if there are no more filter
/// blocks. ETW sets this value; the session must set this member to zero.
/// </summary>
public uint NextOffset;
}
/// <summary>
/// <para>
/// The <c>EVENT_FILTER_LEVEL_KW</c> structure defines event IDs used in an EVENT_FILTER_DESCRIPTOR structure for a stack walk
/// level-keyword filter.
/// </para>
/// <para>
/// This filter is only applied to events that are otherwise enabled on the logging session, via a level/keyword in the enable call.
/// </para>
/// </summary>
// https://docs.microsoft.com/en-us/windows/win32/api/evntprov/ns-evntprov-event_filter_level_kw typedef struct
// _EVENT_FILTER_LEVEL_KW { ULONGLONG MatchAnyKeyword; ULONGLONG MatchAllKeyword; UCHAR Level; BOOLEAN FilterIn; }
// EVENT_FILTER_LEVEL_KW, *PEVENT_FILTER_LEVEL_KW;
[PInvokeData("evntprov.h", MSDNShortId = "2FE25C55-8028-4894-9DD8-FC997B7D9ADB")]
[StructLayout(LayoutKind.Sequential)]
public struct EVENT_FILTER_LEVEL_KW
{
/// <summary>Bitmask of keywords that determine the category of events to filter on.</summary>
public ulong MatchAnyKeyword;
/// <summary>
/// This bitmask is optional. This mask further restricts the category of events that you want to filter on. If the event's
/// keyword meets the <c>MatchAnyKeyword</c> condition, the provider will filter the event only if all of the bits in this mask
/// exist in the event's keyword. This mask is not used if <c>MatchAnyKeyword</c> is zero.
/// </summary>
public ulong MatchAllKeyword;
/// <summary>Defines the severity level of the event to filter on.</summary>
public TRACE_LEVEL Level;
/// <summary>
/// <para><c>true</c> to filter the events matching the provided names in; <c>false</c> to filter them out.</para>
/// <para>If set to <c>true</c>, the filtered events will have stacks collected.</para>
/// </summary>
[MarshalAs(UnmanagedType.U1)] public bool FilterIn;
}
/// <summary>Defines information about the event.</summary>
/// <remarks>
/// <para>
/// You can use the <c>KernelTime</c> and <c>UserTime</c> members to determine the CPU cost in units for a set of instructions (the
/// values indicate the CPU usage charged to that thread at the time of logging). For example, if Event A and Event B are
/// consecutively logged by the same thread and they have CPU usage numbers 150 and 175, then the activity that was performed by that
/// thread between events A and B cost 25 CPU time units (175 – 150).
/// </para>
/// <para>
/// The <c>TimerResolution</c> of the TRACE_LOGFILE_HEADER structure contains the resolution of the CPU usage timer in 100-nanosecond
/// units. You can use the timer resolution with the kernel time and user time values to determine the amount of CPU time that the
/// set of instructions used. For example, if the timer resolution is 156,250, then 25 CPU time units is 0.39 seconds (156,250 * 25 *
/// 100 / 1,000,000,000). This is the amount of CPU time (not elapsed wall clock time) used by the set of instructions between events
/// A and B.
/// </para>
/// </remarks>
// https://docs.microsoft.com/en-us/windows/desktop/api/evntcons/ns-evntcons-_event_header typedef struct _EVENT_HEADER { USHORT
// Size; USHORT HeaderType; USHORT Flags; USHORT EventProperty; ULONG ThreadId; ULONG ProcessId; LARGE_INTEGER TimeStamp; GUID
// ProviderId; EVENT_DESCRIPTOR EventDescriptor; union { struct { ULONG KernelTime; ULONG UserTime; } DUMMYSTRUCTNAME; ULONG64
// ProcessorTime; } DUMMYUNIONNAME; GUID ActivityId; } EVENT_HEADER, *PEVENT_HEADER;
[PInvokeData("evntcons.h", MSDNShortId = "479091ae-7229-433b-b93b-8da6cc18df89")]
[StructLayout(LayoutKind.Sequential)]
public struct EVENT_HEADER
{
/// <summary>Size of the event record, in bytes.</summary>
public ushort Size;
/// <summary>Reserved.</summary>
public ushort HeaderType;
/// <summary>
/// Flags that provide information about the event such as the type of session it was logged to and if the event contains
/// extended data. This member can contain one or more of the following flags.
/// </summary>
public ushort Flags;
/// <summary>Indicates the source to use for parsing the event data.</summary>
public ushort EventProperty;
/// <summary>Identifies the thread that generated the event.</summary>
public uint ThreadId;
/// <summary>Identifies the process that generated the event.</summary>
public uint ProcessId;
/// <summary>
/// Contains the time that the event occurred. The resolution is system time unless the <c>ProcessTraceMode</c> member of
/// EVENT_TRACE_LOGFILE contains the PROCESS_TRACE_MODE_RAW_TIMESTAMP flag, in which case the resolution depends on the value of
/// the <c>Wnode.ClientContext</c> member of EVENT_TRACE_PROPERTIES at the time the controller created the session.
/// </summary>
public FILETIME TimeStamp;
/// <summary>GUID that uniquely identifies the provider that logged the event.</summary>
public Guid ProviderId;
/// <summary>Defines the information about the event such as the event identifier and severity level. For details, see EVENT_DESCRIPTOR.</summary>
public EVENT_DESCRIPTOR EventDescriptor;
/// <summary/>
public DUMMYUNION Union;
/// <summary>Identifier that relates two events. For details, see EventWriteTransfer.</summary>
public Guid ActivityId;
/// <summary></summary>
[StructLayout(LayoutKind.Explicit)]
public struct DUMMYUNION
{
/// <summary>
/// Elapsed execution time for kernel-mode instructions, in CPU ticks. If you are using a private session, use the value in
/// the ProcessorTime member instead.
/// </summary>
[FieldOffset(0)]
public uint KernelTime;
/// <summary>
/// Elapsed execution time for user-mode instructions, in CPU ticks. If you are using a private session, use the value in the
/// ProcessorTime member instead.
/// </summary>
[FieldOffset(4)]
public uint UserTime;
/// <summary>For private sessions, the elapsed execution time for user-mode instructions, in CPU ticks.</summary>
[FieldOffset(0)]
public ulong ProcessorTime;
}
}
/// <summary>
/// The <c>EVENT_HEADER_EXTENDED_DATA_ITEM</c> structure defines the extended data that ETW collects as part of the event data.
/// </summary>
[PInvokeData("evntcons.h", MSDNShortId = "aa363760")]
[StructLayout(LayoutKind.Sequential)]
public struct EVENT_HEADER_EXTENDED_DATA_ITEM
{
/// <summary>Reserved.</summary>
public ushort Reserved1;
/// <summary>
/// <para>Type of extended data. The following are possible values.</para>
/// <para>
/// <list type="table">
/// <listheader>
/// <term>Value</term>
/// <term>Meaning</term>
/// </listheader>
/// <item>
/// <term>EVENT_HEADER_EXT_TYPE_RELATED_ACTIVITYID</term>
/// <term>
/// The DataPtr member points to an EVENT_EXTENDED_ITEM_RELATED_ACTIVITYID structure that contains the related activity
/// identifier if you called EventWriteTransfer to write the event.
/// </term>
/// </item>
/// <item>
/// <term>EVENT_HEADER_EXT_TYPE_SID</term>
/// <term>
/// The DataPtr member points to a SID structure that contains the security identifier (SID) of the user that logged the event.
/// ETW includes the SID if you set the EnableProperty parameter of EnableTraceEx to EVENT_ENABLE_PROPERTY_SID.
/// </term>
/// </item>
/// <item>
/// <term>EVENT_HEADER_EXT_TYPE_TS_ID</term>
/// <term>
/// The DataPtr member points to an EVENT_EXTENDED_ITEM_TS_ID structure that contains the terminal session identifier. ETW
/// includes the terminal session identifier if you set the EnableProperty parameter of EnableTraceEx to EVENT_ENABLE_PROPERTY_TS_ID.
/// </term>
/// </item>
/// <item>
/// <term>EVENT_HEADER_EXT_TYPE_INSTANCE_INFO</term>
/// <term>
/// The DataPtr member points to an EVENT_EXTENDED_ITEM_INSTANCE structure that contains the activity identifier if you called
/// TraceEventInstance to write the event.
/// </term>
/// </item>
/// <item>
/// <term>EVENT_HEADER_EXT_TYPE_STACK_TRACE32</term>
/// <term>
/// The DataPtr member points to an EVENT_EXTENDED_ITEM_STACK_TRACE32 structure that contains the call stack if the event is
/// captured on a 32-bit computer.
/// </term>
/// </item>
/// <item>
/// <term>EVENT_HEADER_EXT_TYPE_STACK_TRACE64</term>
/// <term>
/// The DataPtr member points to an EVENT_EXTENDED_ITEM_STACK_TRACE64 structure that contains the call stack if the event is
/// captured on a 64-bit computer.
/// </term>
/// </item>
/// <item>
/// <term>EVENT_HEADER_EXT_TYPE_EVENT_SCHEMA_TL</term>
/// <term>The DataPtr member points to an extended header item that contains TraceLogging event metadata information.</term>
/// </item>
/// <item>
/// <term>EVENT_HEADER_EXT_TYPE_PROV_TRAITS</term>
/// <term>
/// The DataPtr member points to an extended header item that contains provider traits data, for example traits set through
/// EventSetInformation(EventProviderSetTraits) or specified through EVENT_DATA_DESCRIPTOR_TYPE_PROVIDER_METADATA.
/// </term>
/// </item>
/// <item>
/// <term>EVENT_HEADER_EXT_TYPE_EVENT_KEY</term>
/// <term>
/// The DataPtr member points to an EVENT_EXTENDED_ITEM_EVENT_KEY structure that contains a unique event identifier which is a
/// 64-bit scalar. The EnablePropertyEVENT_ENABLE_PROPERTY_EVENT_KEY needs to be passed in for the EnableTrace call for a given
/// provider to enable this feature.
/// </term>
/// </item>
/// <item>
/// <term>EVENT_HEADER_EXT_TYPE_PROCESS_START_KEY</term>
/// <term>
/// The DataPtr member points to an EVENT_EXTENDED_ITEM_PROCESS_START_KEY structure that contains a unique process identifier
/// (unique across the boot session). This identifier is a 64-bit scalar. The
/// EnablePropertyEVENT_ENABLE_PROPERTY_PROCESS_START_KEY needs to be passed in for the EnableTrace call for a given provider to
/// enable this feature.
/// </term>
/// </item>
/// </list>
/// </para>
/// </summary>
public ushort ExtType;
/// <summary>Reserved.</summary>
public ushort Linkage;
/// <summary>Size, in bytes, of the extended data that <c>DataPtr</c> points to.</summary>
public ushort DataSize;
/// <summary>
/// Pointer to the extended data. The <c>ExtType</c> member determines the type of extended data to which this member points.
/// </summary>
public ulong DataPtr;
}
/// <summary>
/// The EVENT_INSTANCE_HEADER structure contains standard event tracing information common to all events. The structure also contains
/// registration handles for the event trace class and related parent event, which you use to trace instances of a transaction or
/// hierarchical relationships between related events.
/// </summary>
[StructLayout(LayoutKind.Sequential)]
public struct EVENT_INSTANCE_HEADER
{
/// <summary>
/// Total number of bytes of the event. Size must include the size of the EVENT_INSTANCE_HEADER structure, plus the size of any
/// event-specific data appended to this structure. The size must be less than the size of the event tracing session's buffer
/// minus 72 (0x48).
/// </summary>
public ushort Size;
/// <summary>Reserved.</summary>
public ushort FieldTypeFlags;
/// <summary/>
public CLASS Class;
/// <summary>
/// On output, identifies the thread that generated the event.
/// <para>Note that on Windows 2000, ThreadId was a ULONGLONG value.</para>
/// </summary>
public uint ThreadId;
/// <summary>
/// On output, identifies the process that generated the event.
/// <para>Windows 2000: This member is not supported.</para>
/// </summary>
public uint ProcessId;
/// <summary>On output, contains the time the event occurred, in 100-nanosecond intervals since midnight, January 1, 1601.</summary>
public FILETIME TimeStamp;
/// <summary>Handle to a registered event trace class. Set this property before calling the TraceEventInstance function.</summary>
public ulong RegHandle;
/// <summary>On output, contains the event trace instance identifier associated with RegHandle.</summary>
public uint InstanceId;
/// <summary>On output, contains the event trace instance identifier associated with ParentRegHandle.</summary>
public uint ParentInstanceId;
/// <summary>The union</summary>
public DUMMYUNION Union;
/// <summary>
/// Handle to a registered event trace class of a parent event. Set this property before calling the TraceEventInstance function
/// if you want to trace a hierarchical relationship (parent element/child element) between related events.
/// <para>The RegisterTraceGuids function creates this handle(see the TraceGuidReg parameter).</para>
/// </summary>
public ulong ParentRegHandle;
/// <summary/>
[StructLayout(LayoutKind.Sequential)]
public struct CLASS
{
/// <summary>Type of event.</summary>
public EVENT_TRACE_TYPE Type;
/// <summary>
/// Provider-defined value that defines the severity level used to generate the event. The value ranges from 0 to 255. The
/// controller specifies the severity level when it calls the EnableTrace function. The provider retrieves the severity level by
/// calling the GetTraceEnableLevel function from its ControlCallback implementation. The provider uses the value to set this member.
/// </summary>
public TRACE_LEVEL Level;
/// <summary>
/// Indicates the version of the event trace class that you are using to log the event. Specify zero if there is only one version
/// of your event trace class. The version tells the consumer which MOF class to use to decipher the event data.
/// </summary>
public ushort Version;
}
/// <summary></summary>
[StructLayout(LayoutKind.Explicit)]
public struct DUMMYUNION
{
/// <summary>
/// Elapsed execution time for kernel-mode instructions, in CPU ticks. If you are using a private session, use the value in
/// the ProcessorTime member instead.
/// </summary>
[FieldOffset(0)]
public uint KernelTime;
/// <summary>
/// Elapsed execution time for user-mode instructions, in CPU ticks. If you are using a private session, use the value in the
/// ProcessorTime member instead.
/// </summary>
[FieldOffset(4)]
public uint UserTime;
/// <summary>For private sessions, the elapsed execution time for user-mode instructions, in CPU ticks.</summary>
[FieldOffset(0)]
public ulong ProcessorTime;
/// <summary>The event identifier</summary>
[FieldOffset(0)]
public uint EventId;
/// <summary>Must contain WNODE_FLAG_TRACED_GUID, and may also contain any combination of the following.</summary>
[FieldOffset(4)]
public WNODE_FLAG Flags;
}
}
/// <summary>The <c>EVENT_INSTANCE_INFO</c> structure maps a unique transaction identifier to a registered event trace class.</summary>
/// <remarks>Be sure to initialize the memory for this structure to zero before setting any members.</remarks>
// https://docs.microsoft.com/en-us/windows/desktop/api/evntrace/ns-evntrace-event_instance_info typedef struct EVENT_INSTANCE_INFO {
// HANDLE RegHandle; ULONG InstanceId; } EVENT_INSTANCE_INFO, *PEVENT_INSTANCE_INFO;
[PInvokeData("evntrace.h", MSDNShortId = "83a3802c-b992-43a2-a98a-bdee2ecfef24")]
[StructLayout(LayoutKind.Sequential)]
public struct EVENT_INSTANCE_INFO
{
/// <summary>Handle to a registered event trace class.</summary>
public HANDLE RegHandle;
/// <summary>Unique transaction identifier that maps an event to a specific transaction.</summary>
public uint InstanceId;
}
/// <summary>Defines a single value map entry.</summary>
/// <remarks>
/// For maps defined in a manifest, the string will contain a space at the end of the string. For example, if the value is mapped to
/// "Monday" in the manifest, the string is returned as "Monday ".
/// </remarks>
// https://docs.microsoft.com/en-us/windows/win32/api/tdh/ns-tdh-event_map_entry typedef struct _EVENT_MAP_ENTRY { ULONG
// OutputOffset; union { ULONG Value; ULONG InputOffset; }; } EVENT_MAP_ENTRY;
[PInvokeData("tdh.h", MSDNShortId = "e5b12f7a-4a00-41a0-90df-7d1317d63a4a")]
[StructLayout(LayoutKind.Explicit)]
public struct EVENT_MAP_ENTRY
{
/// <summary>
/// Offset from the beginning of the EVENT_MAP_INFO structure to a null-terminated Unicode string that contains the string
/// associated with the map value in <c>Value</c> or <c>InputOffset</c>.
/// </summary>
[FieldOffset(0)]
public uint OutputOffset;
/// <summary>
/// If the <c>MapEntryValueType</c> member of EVENT_MAP_INFO is EVENTMAP_ENTRY_VALUETYPE_ULONG, use this member to access the map value.
/// </summary>
[FieldOffset(4)]
public uint Value;
/// <summary>
/// <para>
/// Offset from the beginning of the EVENT_MAP_INFO structure to the null-terminated Unicode string that contains the map value.
/// </para>
/// <para>The offset is used for pattern maps and WMI value maps that map strings to strings.</para>
/// </summary>
[FieldOffset(4)]
public uint InputOffset;
}
/// <summary>Defines the metadata about the event map.</summary>
// https://docs.microsoft.com/en-us/windows/win32/api/tdh/ns-tdh-event_map_info typedef struct _EVENT_MAP_INFO { ULONG NameOffset;
// MAP_FLAGS Flag; ULONG EntryCount; union { MAP_VALUETYPE MapEntryValueType; ULONG FormatStringOffset; }; EVENT_MAP_ENTRY
// MapEntryArray[ANYSIZE_ARRAY]; } EVENT_MAP_INFO;
[PInvokeData("tdh.h", MSDNShortId = "dc7f14e7-16d7-4dfc-8c1a-5db6fa999d98")]
[StructLayout(LayoutKind.Explicit)]
public struct EVENT_MAP_INFO
{
/// <summary>
/// Offset from the beginning of this structure to a null-terminated Unicode string that contains the name of the event map.
/// </summary>
[FieldOffset(0)]
public uint NameOffset;
/// <summary>
/// Indicates if the map is a value map, bitmap, or pattern map. This member can contain one or more flag values. For possible
/// values, see the MAP_FLAGS enumeration.
/// </summary>
[FieldOffset(4)]
public MAP_FLAGS Flag;
/// <summary>Number of map entries in <c>MapEntryArray</c>.</summary>
[FieldOffset(8)]
public uint EntryCount;
/// <summary>
/// Determines if you use the <c>Value</c> member or <c>InputOffset</c> member of EVENT_MAP_ENTRY to access the map value. For
/// possible values, see the MAP_VALUETYPE enumeration.
/// </summary>
[FieldOffset(12)]
public MAP_VALUETYPE MapEntryValueType;
/// <summary>
/// <para>
/// If the value of <c>Flag</c> is EVENTMAP_INFO_FLAG_MANIFEST_PATTERNMAP, use this offset to access the null-terminated Unicode
/// string that contains the value of the <c>format</c> attribute of the patternMap element. The offset is from the beginning of
/// this structure.
/// </para>
/// <para>
/// The EVENTMAP_INFO_FLAG_MANIFEST_PATTERNMAP also indicates that you use the <c>InputOffset</c> member of EVENT_MAP_ENTRY to
/// access the map value.
/// </para>
/// </summary>
[FieldOffset(12)]
public uint FormatStringOffset;
///// <summary>Array of map entries. For details, see the EVENT_MAP_ENTRY structure.</summary>
//public EVENT_MAP_ENTRY MapEntryArray[ANYSIZE_ARRAY];
}
/// <summary>Provides information about a single property of the event or filter.</summary>
/// <remarks>Filters do not support maps, structures, or arrays.</remarks>
// https://docs.microsoft.com/en-us/windows/win32/api/tdh/ns-tdh-event_property_info typedef struct _EVENT_PROPERTY_INFO {
// PROPERTY_FLAGS Flags; ULONG NameOffset; union { struct { USHORT InType; USHORT OutType; ULONG MapNameOffset; } nonStructType;
// struct { USHORT StructStartIndex; USHORT NumOfStructMembers; ULONG padding; } structType; struct { USHORT InType; USHORT OutType;
// ULONG CustomSchemaOffset; } customSchemaType; }; union { USHORT count; USHORT countPropertyIndex; }; union { USHORT length; USHORT
// lengthPropertyIndex; }; union { ULONG Reserved; struct { ULONG Tags : 28; }; }; } EVENT_PROPERTY_INFO;
[PInvokeData("tdh.h", MSDNShortId = "06b82b31-1f0e-45d5-88ec-9b9835af10df")]
[StructLayout(LayoutKind.Explicit)]
public struct EVENT_PROPERTY_INFO
{
/// <summary>
/// Flags that indicate if the property is contained in a structure or array. For possible values, see the PROPERTY_FLAGS enumeration.
/// </summary>
[FieldOffset(0)]
public PROPERTY_FLAGS Flags;
/// <summary>
/// Offset to a null-terminated Unicode string that contains the name of the property. If this an event property, the offset is
/// from the beginning of the TRACE_EVENT_INFO structure. If this is a filter property, the offset is from the beginning of the
/// PROVIDER_FILTER_INFO structure.
/// </summary>
[FieldOffset(4)]
public uint NameOffset;
/// <summary/>
[FieldOffset(8)]
public NONSTRUCTTYPE nonStructType;
/// <summary/>
[FieldOffset(8)]
public STRUCTTYPE structType;
/// <summary/>
[FieldOffset(8)]
public CUSTOMSCHEMATYPE customSchemaType;
/// <summary>Number of elements in the array. Note that this value is 1 for properties that are not defined as an array.</summary>
[FieldOffset(16)]
public ushort count;
/// <summary>
/// Zero-based index to the element of the property array that contains the number of elements in the array. Use this member if
/// the PropertyParamCount flag in <c>Flags</c> is set; otherwise, use the <c>count</c> member.
/// </summary>
[FieldOffset(16)]
public ushort countPropertyIndex;
/// <summary>
/// Size of the property, in bytes. Note that variable-sized types such as strings and binary data have a length of zero unless
/// the property has length attribute to explicitly indicate its real length. Structures have a length of zero.
/// </summary>
[FieldOffset(18)]
public ushort length;
/// <summary>
/// Zero-based index to the element of the property array that contains the size value of this property. Use this member if the
/// PropertyParamLength flag in <c>Flags</c> is set; otherwise, use the <c>length</c> member.
/// </summary>
[FieldOffset(18)]
public ushort lengthPropertyIndex;
/// <summary>
/// A 28-bit value associated with the field metadata. This value is valid only if the PropertyHasTags flag is set. This value
/// can be used by the event provider to associate additional semantic data with a field for use by an event processing tool. For
/// example, a tag value of 1 might indicate that the field contains a username. The semantics of any values in this field are
/// defined by the event provider.
/// </summary>
[FieldOffset(20)]
public uint Tags;
/// <summary/>
[StructLayout(LayoutKind.Sequential)]
public struct NONSTRUCTTYPE
{
/// <summary>
/// <para>Data type of this property on input. For a description of these types, see Remarks in InputType.</para>
/// <para>For descriptions of these types, see Event Tracing MOF Qualifiers.</para>
/// <para>TdhGetPropertySize TdhGetPropertySize</para>
/// </summary>
public ushort InType;
/// <summary>
/// <para>
/// Output format for this property. If the value is TDH_OUTTYPE_NULL, use the in type as the output format. For a
/// description of these types, see Remarks in InputType.
/// </para>
/// <para>For descriptions of these types, see Event Tracing MOF Qualifiers.</para>
/// </summary>
public ushort OutType;
/// <summary>
/// Offset from the beginning of the TRACE_EVENT_INFO structure to a null-terminated Unicode string that contains the name of
/// the map attribute value. You can pass this string to TdhGetEventMapInformation to retrieve information about the value map.
/// </summary>
public uint MapNameOffset;
}
/// <summary/>
[StructLayout(LayoutKind.Sequential)]
public struct STRUCTTYPE
{
/// <summary>Zero-based index to the element of the property array that contains the first member of the structure.</summary>
public ushort StructStartIndex;
/// <summary>Number of members in the structure.</summary>
public ushort NumOfStructMembers;
/// <summary>Not used.</summary>
public uint padding;
}
/// <summary/>
[StructLayout(LayoutKind.Sequential)]
public struct CUSTOMSCHEMATYPE
{
/// <summary>
/// <para>Data type of this property on input. For a description of these types, see Remarks in InputType.</para>
/// <para>For descriptions of these types, see Event Tracing MOF Qualifiers.</para>
/// <para>TdhGetPropertySize TdhGetPropertySize</para>
/// </summary>
public ushort InType;
/// <summary>
/// <para>
/// Output format for this property. If the value is TDH_OUTTYPE_NULL, use the in type as the output format. For a
/// description of these types, see Remarks in InputType.
/// </para>
/// <para>For descriptions of these types, see Event Tracing MOF Qualifiers.</para>
/// </summary>
public ushort OutType;
/// <summary>
/// Offset (in bytes) from the beginning of the TRACE_EVENT_INFO structure to the custom schema information. The custom
/// schema information will contain a 2-byte protocol identifier, followed by a 2-byte schema length, followed by the schema.
/// </summary>
public uint CustomSchemaOffset;
}
}
/// <summary>The <c>EVENT_RECORD</c> structure defines the layout of an event that ETW delivers.</summary>
/// <remarks>
/// The <c>EVENT_RECORD</c> structure is passed to the consumer's implementation of the EventRecordCallback callback .
/// </remarks>
// https://docs.microsoft.com/en-us/windows/desktop/api/evntcons/ns-evntcons-_event_record typedef struct _EVENT_RECORD {
// EVENT_HEADER EventHeader; ETW_BUFFER_CONTEXT BufferContext; USHORT ExtendedDataCount; USHORT UserDataLength;
// PEVENT_HEADER_EXTENDED_DATA_ITEM ExtendedData; PVOID UserData; PVOID UserContext; } EVENT_RECORD, *PEVENT_RECORD;
[PInvokeData("evntcons.h", MSDNShortId = "e352c1a7-39a2-43e3-a723-5fc6a3921ee8")]
[StructLayout(LayoutKind.Sequential)]
public struct EVENT_RECORD
{
/// <summary>
/// Information about the event such as the time stamp for when it was written. For details, see the EVENT_HEADER structure.
/// </summary>
public EVENT_HEADER EventHeader;
/// <summary>Defines information such as the session that logged the event. For details, see the ETW_BUFFER_CONTEXT structure.</summary>
public ETW_BUFFER_CONTEXT BufferContext;
/// <summary>The number of extended data structures in the <c>ExtendedData</c> member.</summary>
public ushort ExtendedDataCount;
/// <summary>The size, in bytes, of the data in the <c>UserData</c> member.</summary>
public ushort UserDataLength;
/// <summary>
/// One or more extended data items that ETW collects. The extended data includes some items, such as the security identifier
/// (SID) of the user that logged the event, only if the controller sets the EnableProperty parameter passed to the EnableTraceEx
/// or EnableTraceEx2 function. The extended data includes other items, such as the related activity identifier and decoding
/// information for trace logging, regardless whether the controller sets the EnableProperty parameter passed to
/// <c>EnableTraceEx</c> or <c>EnableTraceEx2</c>. For details, see the EVENT_HEADER_EXTENDED_DATA_ITEM structure .
/// </summary>
public IntPtr ExtendedData;
/// <summary>
/// Event specific data. To parse this data, see Retrieving Event Data Using TDH. If the <c>Flags</c> member of EVENT_HEADER
/// contains <c>EVENT_HEADER_FLAG_STRING_ONLY</c>, the data is a null-terminated Unicode string that you do not need TDH to parse.
/// </summary>
public IntPtr UserData;
/// <summary>
/// Th context specified in the <c>Context</c> member of the EVENT_TRACE_LOGFILE structure that is passed to the OpenTrace function.
/// </summary>
public IntPtr UserContext;
}
/// <summary>The <c>EVENT_TRACE</c> structure is used to deliver event information to an event trace consumer.</summary>
/// <remarks>ETW passes this structure to the consumer's EventCallback callback function.</remarks>
// https://docs.microsoft.com/en-us/windows/desktop/api/evntrace/ns-evntrace-event_trace typedef struct _EVENT_TRACE {
// EVENT_TRACE_HEADER Header; ULONG InstanceId; ULONG ParentInstanceId; GUID ParentGuid; PVOID MofData; ULONG MofLength; union {
// ULONG ClientContext; ETW_BUFFER_CONTEXT BufferContext; } DUMMYUNIONNAME; } EVENT_TRACE, *PEVENT_TRACE;
[PInvokeData("evntrace.h", MSDNShortId = "d8a6b63e-0cd4-4d19-b0b3-16bb0d33e4c0")]
[StructLayout(LayoutKind.Sequential)]
public struct EVENT_TRACE
{
/// <summary>An EVENT_TRACE_HEADER structure that contains standard event tracing information.</summary>
public EVENT_TRACE_HEADER Header;
/// <summary>
/// Instance identifier. Contains valid data when the provider calls the TraceEventInstance function to generate the event.
/// Otherwise, the value is zero.
/// </summary>
public uint InstanceId;
/// <summary>
/// Instance identifier for a parent event. Contains valid data when the provider calls the TraceEventInstance function to
/// generate the event. Otherwise, the value is zero.
/// </summary>
public uint ParentInstanceId;
/// <summary>
/// Class GUID of the parent event. Contains valid data when the provider calls the TraceEventInstance function to generate the
/// event. Otherwise, the value is zero.
/// </summary>
public Guid ParentGuid;
/// <summary>Pointer to the beginning of the event-specific data for this event.</summary>
public IntPtr MofData;
/// <summary>Number of bytes to which <c>MofData</c> points.</summary>
public uint MofLength;
/// <summary>
/// <para>
/// Provides information about the event such as the session identifier and processor number of the CPU on which the provider
/// process ran. For details, see the ETW_BUFFER_CONTEXT structure.
/// </para>
/// <para><c>Prior to Windows Vista:</c> Not supported.</para>
/// </summary>
public ETW_BUFFER_CONTEXT BufferContext;
}
/// <summary>The EVENT_TRACE_HEADER structure contains standard event tracing information common to all events.</summary>
[StructLayout(LayoutKind.Explicit)]
public struct EVENT_TRACE_HEADER
{
/// <summary>
/// Total number of bytes of the event. Size includes the size of the header structure, plus the size of any event-specific data
/// appended to the header.
/// <para>On input, the size must be less than the size of the event tracing session's buffer minus 72 (0x48).</para>
/// <para>On output, do not use this number in calculations.</para>
/// </summary>
[FieldOffset(0)]
public ushort Size;
/// <summary>Reserved.</summary>
[FieldOffset(2)]
public ushort FieldTypeFlags;
/// <summary>
/// This is a roll-up of the members of Class. The low-order byte contains the Type, the next byte contains the Level, and the
/// last two bytes contain the version.
/// </summary>
[FieldOffset(4)]
public uint Version;
/// <summary/>
[FieldOffset(4)]
public CLASS Class;
/// <summary>
/// On output, identifies the thread that generated the event.
/// <para>Note that on Windows 2000, ThreadId was a ULONGLONG value.</para>
/// </summary>
[FieldOffset(8)]
public uint ThreadId;
/// <summary>
/// On output, identifies the process that generated the event.
/// <para>Note that on Windows 2000, ProcessId was a ULONGLONG value.</para>
/// </summary>
[FieldOffset(12)]
public uint ProcessId;
/// <summary>
/// On output, contains the time that the event occurred. The resolution is system time unless the ProcessTraceMode member of
/// EVENT_TRACE_LOGFILE contains the PROCESS_TRACE_MODE_RAW_TIMESTAMP flag, in which case the resolution depends on the value of
/// the Wnode.ClientContext member of EVENT_TRACE_PROPERTIES at the time the controller created the session.
/// </summary>
[FieldOffset(16)]
public FILETIME TimeStamp;
/// <summary>
/// Event trace class GUID. You can use the class GUID to identify a category of events and the Class.Type member to identify an
/// event within the category of events.
/// <para>Alternatively, you can use the GuidPtr member to specify the class GUID.</para>
/// <para>Windows XP and Windows 2000: The class GUID must have been registered previously using the RegisterTraceGuids function.</para>
/// </summary>
[FieldOffset(24)]
public Guid Guid;
/// <summary>
/// Pointer to an event trace class GUID. Alternatively, you can use the Guid member to specify the class GUID. When the event is
/// written, ETW uses the pointer to copy the GUID to the event (the GUID is included in the event, not the pointer).
/// <para>If you use this member, the Flags member must also contain WNODE_FLAG_USE_GUID_PTR.</para>
/// </summary>
[FieldOffset(24)]
public GuidPtr GuidPtr;
/// <summary>
/// Elapsed execution time for kernel-mode instructions, in CPU time units. If you are using a private session, use the value in
/// the ProcessorTime member instead. For more information, see Remarks.
/// </summary>
[FieldOffset(40)]
public uint KernelTime;
/// <summary>
/// Elapsed execution time for user-mode instructions, in CPU time units. If you are using a private session, use the value in
/// the ProcessorTime member instead. For more information, see Remarks.
/// </summary>
[FieldOffset(44)]
public uint UserTime;
/// <summary>Reserved.</summary>
[FieldOffset(40)]
public uint ClientContext;
/// <summary>
/// You must set this member to WNODE_FLAG_TRACED_GUID, and may optionally specify any combination of the following.
/// <list type="table">
/// <listheader>
/// <term>Value</term>
/// <term>Meaning</term>
/// </listheader>
/// <item>
/// <description>WNODE_FLAG_USE_GUID_PTR</description>
/// <description>Specify if the GuidPtr member contains the class GUID.</description>
/// </item>
/// <item>
/// <description>WNODE_FLAG_USE_MOF_PTR</description>
/// <description>
/// Specify if an array of MOF_FIELD structures contains the event data appended to this structure. The number of elements in the
/// array is limited to MAX_MOF_FIELDS.
/// </description>
/// </item>
/// </list>
/// </summary>
[FieldOffset(44)]
public WNODE_FLAG Flags;
/// <summary>For private sessions, the elapsed execution time for user-mode instructions, in CPU ticks.</summary>
[FieldOffset(40)]
public ulong ProcessorTime;
/// <summary/>
[StructLayout(LayoutKind.Sequential)]
public struct CLASS
{
/// <summary>Type of event.</summary>
public EVENT_TRACE_TYPE Type;
/// <summary>
/// Provider-defined value that defines the severity level used to generate the event. The value ranges from 0 to 255. The
/// controller specifies the severity level when it calls the EnableTrace function. The provider retrieves the severity level by
/// calling the GetTraceEnableLevel function from its ControlCallback implementation. The provider uses the value to set this member.
/// <para>
/// ETW defines the following severity levels.Selecting a level higher than 1 will also include events for lower levels. For
/// example, if the controller specifies TRACE_LEVEL_WARNING (3), the provider also generates TRACE_LEVEL_FATAL(1) and
/// TRACE_LEVEL_ERROR(2) events.
/// </para>
/// </summary>
public TRACE_LEVEL Level;
/// <summary>
/// Indicates the version of the event trace class that you are using to log the event. Specify zero if there is only one version
/// of your event trace class. The version tells the consumer which MOF class to use to decipher the event data.
/// </summary>
public ushort Version;
}
}
/// <summary>
/// <para>
/// The <c>EVENT_TRACE_LOGFILE</c> structure specifies how the consumer wants to read events (from a log file or in real-time) and
/// the callbacks that will receive the events.
/// </para>
/// <para>
/// When ETW flushes a buffer, this structure contains information about the event tracing session and the buffer that ETW flushed.
/// </para>
/// </summary>
/// <remarks>
/// <para>Be sure to initialize the memory for this structure to zero before setting any members.</para>
/// <para>Consumers pass this structure to the <c>OpenTrace</c> function.</para>
/// <para>When ETW flushes a buffer, it passes the structure to the consumer's <c>BufferCallback</c> function.</para>
/// </remarks>
// https://docs.microsoft.com/en-us/windows/win32/etw/event-trace-logfile typedef struct _EVENT_TRACE_LOGFILE { LPTSTR LogFileName;
// LPTSTR LoggerName; LONGLONG CurrentTime; ULONG BuffersRead; union { ULONG LogFileMode; ULONG ProcessTraceMode; }; EVENT_TRACE
// CurrentEvent; TRACE_LOGFILE_HEADER LogfileHeader; PEVENT_TRACE_BUFFER_CALLBACK BufferCallback; ULONG BufferSize; ULONG Filled;
// ULONG EventsLost; union { PEVENT_CALLBACK EventCallback; PEVENT_RECORD_CALLBACK EventRecordCallback; }; ULONG IsKernelTrace; PVOID
// Context; } EVENT_TRACE_LOGFILE, *PEVENT_TRACE_LOGFILE;
[PInvokeData("Evntcons.h", MSDNShortId = "179451e9-7e3c-4d3a-bcc6-3ad9d382229a")]
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Auto)]
public struct EVENT_TRACE_LOGFILE
{
/// <summary>
/// <para>
/// Name of the log file used by the event tracing session. Specify a value for this member if you are consuming from a log file.
/// This member must be <c>NULL</c> if <c>LoggerName</c> is specified.
/// </para>
/// <para>
/// You must know the log file name the controller specified. If the controller logged events to a private session (the
/// controller set the <c>LogFileMode</c> member of <c>EVENT_TRACE_PROPERTIES</c> to <c>EVENT_TRACE_PRIVATE_LOGGER_MODE</c>), the
/// file name must include the process identifier that ETW appended to the log file name. For example, if the controller named
/// the log file xyz.etl and the process identifier is 123, ETW uses xyz.etl_123 as the file name.
/// </para>
/// <para>
/// If the controller set the <c>LogFileMode</c> member of <c>EVENT_TRACE_PROPERTIES</c> to <c>EVENT_TRACE_FILE_MODE_NEWFILE</c>,
/// the log file name must include the sequential serial number used to create each new log file.
/// </para>
/// <para>The user consuming the events must have permissions to read the file.</para>
/// </summary>
[MarshalAs(UnmanagedType.LPTStr)]
public string LogFileName;
/// <summary>
/// <para>
/// Name of the event tracing session. Specify a value for this member if you want to consume events in real time. This member
/// must be <c>NULL</c> if <c>LogFileName</c> is specified.
/// </para>
/// <para>
/// You can only consume events in real time if the controller set the <c>LogFileMode</c> member of <c>EVENT_TRACE_PROPERTIES</c>
/// to <c>EVENT_TRACE_REAL_TIME_MODE</c>.
/// </para>
/// <para>
/// Only users with administrative privileges, users in the Performance Log Users group, and applications running as LocalSystem,
/// LocalService, NetworkService can consume events in real time. To grant a restricted user the ability to consume events in
/// real time, add them to the Performance Log Users group or call <c>EventAccessControl</c>.
/// </para>
/// <para><c>Windows XP and Windows 2000:</c> Anyone can consume real time events.</para>
/// </summary>
[MarshalAs(UnmanagedType.LPTStr)]
public string LoggerName;
/// <summary>On output, the current time, in 100-nanosecond intervals since midnight, January 1, 1601.</summary>
public FILETIME CurrentTime;
/// <summary>On output, the number of buffers processed.</summary>
public uint BuffersRead;
/// <summary>
/// <para>
/// Modes for processing events. The modes are defined in the Evntcons.h header file. You can specify one or more of the
/// following modes:
/// </para>
/// <list type="table">
/// <listheader>
/// <term>Value</term>
/// <term>Meaning</term>
/// </listheader>
/// <item>
/// <term>PROCESS_TRACE_MODE_EVENT_RECORD</term>
/// <term>
/// Specify this mode if you want to receive events in the new EVENT_RECORD format. To receive events in the new format you must
/// specify a callback in the EventRecordCallback member. If you do not specify this mode, you receive events in the old format
/// through the callback specified in the EventCallback member. Prior to Windows Vista: Not supported.
/// </term>
/// </item>
/// <item>
/// <term>PROCESS_TRACE_MODE_RAW_TIMESTAMP</term>
/// <term>
/// Specify this mode if you do not want the time stamp value in the TimeStamp member of EVENT_HEADER and EVENT_TRACE_HEADER
/// converted to system time (leaves the time stamp value in the resolution that the controller specified in the
/// Wnode.ClientContext member of EVENT_TRACE_PROPERTIES). Prior to Windows Vista: Not supported.
/// </term>
/// </item>
/// <item>
/// <term>PROCESS_TRACE_MODE_REAL_TIME</term>
/// <term>Specify this mode to receive events in real time (you must specify this mode if LoggerName is not NULL).</term>
/// </item>
/// </list>
/// </summary>
public PROCESS_TRACE_MODE ProcessTraceMode;
/// <summary>On output, an <c>EVENT_TRACE</c> structure that contains the last event processed.</summary>
public EVENT_TRACE CurrentEvent;
/// <summary>
/// On output, a <c>TRACE_LOGFILE_HEADER</c> structure that contains general information about the session and the computer on
/// which the session ran.
/// </summary>
public TRACE_LOGFILE_HEADER LogfileHeader;
/// <summary>
/// Pointer to the <c>BufferCallback</c> function that receives buffer-related statistics for each buffer ETW flushes. ETW calls
/// this callback after it delivers all the events in the buffer. This callback is optional.
/// </summary>
[MarshalAs(UnmanagedType.FunctionPtr)]
public BufferCallback BufferCallback;
/// <summary>On output, contains the size of each buffer, in bytes.</summary>
public uint BufferSize;
/// <summary>On output, contains the number of bytes in the buffer that contain valid information.</summary>
public uint Filled;
/// <summary>Not used.</summary>
public uint EventsLost;
/// <summary>A callback function associated with the type of events being written.</summary>
public CALLBACK_UNION Callback;
/// <summary>
/// On output, if this member is <c>TRUE</c>, the event tracing session is the NT Kernel Logger. Otherwise, it is another event
/// tracing session.
/// </summary>
[MarshalAs(UnmanagedType.Bool)]
public bool IsKernelTrace;
/// <summary>
/// <para>
/// Context data that a consumer can specify when calling <c>OpenTrace</c>. If the consumer uses <c>EventRecordCallback</c> to
/// consume events, ETW sets the <c>UserContext</c> member of the <c>EVENT_RECORD</c> structure to this value.
/// </para>
/// <para><c>Prior to Windows Vista:</c> Not supported.</para>
/// </summary>
public IntPtr Context;
/// <summary/>
[StructLayout(LayoutKind.Explicit, CharSet = CharSet.Auto)]
public struct CALLBACK_UNION
{
/// <summary>
/// <para>Pointer to the <c>EventCallback</c> function that ETW calls for each event in the buffer.</para>
/// <para>
/// Specify this callback if you are consuming events from a provider that used one of the <c>TraceEvent</c> functions to log events.
/// </para>
/// </summary>
[FieldOffset(0)]
[MarshalAs(UnmanagedType.FunctionPtr)]
public EventClassCallback EventCallback;
/// <summary>
/// <para>Pointer to the <c>EventRecordCallback</c> function that ETW calls for each event in the buffer.</para>
/// <para>
/// Specify this callback if you are consuming events from a provider that used one of the <c>EventWrite</c> functions to log events.
/// </para>
/// <para><c>Prior to Windows Vista:</c> Not supported.</para>
/// </summary>
[FieldOffset(0)]
[MarshalAs(UnmanagedType.FunctionPtr)]
public EventRecordCallback EventRecordCallback;
}
}
/// <summary>
/// The <c>EVENT_TRACE_PROPERTIES</c> structure contains information about an event tracing session. You use this structure when you
/// define a session, change the properties of a session, or query for the properties of a session.
/// </summary>
/// <remarks>
/// <para>Be sure to initialize the memory for this structure to zero before setting any members.</para>
/// <para>
/// Events from providers are written to a session's buffers. When a buffer is full, the session flushes the buffer either by writing
/// the events to a log file, delivering them to a real-time consumer, or both. If the session's buffers are filled faster than they
/// can be flushed, new buffers are allocated and added to the session's buffer pool, up to the maximum number specified. Beyond this
/// limit, the session discards incoming events until a buffer becomes available. Each session keeps a record of the number of events
/// discarded (see the <c>EventsLost</c> member).
/// </para>
/// <para>ETW does not free unused buffers.</para>
/// <para><c>Windows 2000:</c> ETW frees unused buffers based on the <c>AgeLimit</c> member value.</para>
/// <para>
/// You use the <c>BufferSize</c>, <c>MinimumBuffers</c>, and <c>MaximumBuffers</c> members to configure the buffers for an event
/// tracing session when you define the session or anytime during the tracing session. ETW uses the physical memory and number of
/// processors available on the computer to determine if the values are reasonable. If ETW determines the values are not reasonable,
/// ETW will determine the correct size and overwrite the values.
/// </para>
/// <para>Typically, you should not set these values and instead let ETW determine the size and number of buffers.</para>
/// <para>
/// To view session statistics, such as <c>EventsLost</c> while the session is running, call the <c>ControlTrace</c> function and set
/// the ControlCode parameter to EVENT_TRACE_CONTROL_QUERY.
/// </para>
/// </remarks>
// https://docs.microsoft.com/en-us/windows/desktop/ETW/event-trace-properties typedef struct _EVENT_TRACE_PROPERTIES { WNODE_HEADER
// Wnode; ULONG BufferSize; ULONG MinimumBuffers; ULONG MaximumBuffers; ULONG MaximumFileSize; ULONG LogFileMode; ULONG FlushTimer;
// ULONG EnableFlags; LONG AgeLimit; ULONG NumberOfBuffers; ULONG FreeBuffers; ULONG EventsLost; ULONG BuffersWritten; ULONG
// LogBuffersLost; ULONG RealTimeBuffersLost; HANDLE LoggerThreadId; ULONG LogFileNameOffset; ULONG LoggerNameOffset; }
// EVENT_TRACE_PROPERTIES, *PEVENT_TRACE_PROPERTIES;
[PInvokeData("evntrace.h", MSDNShortId = "0c967971-8df1-4679-a8a9-a783f5b35860")]
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Auto)]
public struct EVENT_TRACE_PROPERTIES
{
/// <summary/>
public const int MaxLoggerNameLength = 1024;
/// <summary/>
public const int MaxLogFileNameLength = 1024;
private static readonly uint SizeOf = (uint)Marshal.SizeOf(typeof(EVENT_TRACE_PROPERTIES));
private static readonly uint StrLen = SizeOf > 4096 ? 2048U : 1024U;
/// <summary>
/// A <c>WNODE_HEADER</c> structure. You must specify the <c>BufferSize</c>, <c>Flags</c>, and <c>Guid</c> members, and
/// optionally the <c>ClientContext</c> member.
/// </summary>
public WNODE_HEADER Wnode;
/// <summary>
/// <para>
/// Amount of memory allocated for each event tracing session buffer, in kilobytes. The maximum buffer size is 1 MB. ETW uses the
/// size of physical memory to calculate this value. For more information, see Remarks.
/// </para>
/// <para>
/// If an application expects a relatively low event rate, the buffer size should be set to the memory page size. If the event
/// rate is expected to be relatively high, the application should specify a larger buffer size, and should increase the maximum
/// number of buffers.
/// </para>
/// <para>
/// The buffer size affects the rate at which buffers fill and must be flushed. Although a small buffer size requires less
/// memory, it increases the rate at which buffers must be flushed.
/// </para>
/// </summary>
public uint BufferSize;
/// <summary>
/// Minimum number of buffers allocated for the event tracing session's buffer pool. The minimum number of buffers that you can
/// specify is two buffers per processor. For example, on a single processor computer, the minimum number of buffers is two. Note
/// that if you use the EVENT_TRACE_NO_PER_PROCESSOR_BUFFERING logging mode, the number of processors is assumed to be 1.
/// </summary>
public uint MinimumBuffers;
/// <summary>
/// Maximum number of buffers allocated for the event tracing session's buffer pool. Typically, this value is the minimum number
/// of buffers plus twenty. ETW uses the buffer size and the size of physical memory to calculate this value. This value must be
/// greater than or equal to the value for <c>MinimumBuffers</c>. Note that you do not need to set this value if
/// <c>LogFileMode</c> contains <c>EVENT_TRACE_BUFFERING_MODE</c>; instead, the total memory buffer size is instead the product
/// of <c>MinimumBuffers</c> and <c>BufferSize</c>.
/// </summary>
public uint MaximumBuffers;
/// <summary>
/// <para>
/// Maximum size of the file used to log events, in megabytes. Typically, you use this member to limit the size of a circular log
/// file when you set <c>LogFileMode</c> to <c>EVENT_TRACE_FILE_MODE_CIRCULAR</c>. This member must be specified if
/// <c>LogFileMode</c> contains <c>EVENT_TRACE_FILE_MODE_PREALLOCATE</c>, <c>EVENT_TRACE_FILE_MODE_CIRCULAR</c> or <c>EVENT_TRACE_FILE_MODE_NEWFILE</c>
/// </para>
/// <para>
/// If you are using the system drive (the drive that contains the operating system) for logging, ETW checks for an additional
/// 200MB of disk space, regardless of whether you are using the maximum file size parameter. Therefore, if you specify 100MB as
/// the maximum file size for the trace file in the system drive, you need to have 300MB of free space on the drive.
/// </para>
/// </summary>
public uint MaximumFileSize;
/// <summary>
/// <para>
/// Logging modes for the event tracing session. You use this member to specify that you want events written to a log file, a
/// real-time consumer, or both. You can also use this member to specify that the session is a private logger session. You can
/// specify one or more modes. For a list of possible modes, see Logging Mode Constants.
/// </para>
/// <para>
/// Do not specify real-time logging unless there are real-time consumers ready to consume the events. If there are no real-time
/// consumers, ETW writes the events to a playback file. However, the size of the playback file is limited. If the limit is
/// reached, no new events are logged (to the log file or playback file) and the logging functions fail with STATUS_LOG_FILE_FULL.
/// </para>
/// <para><c>Prior to Windows Vista:</c> If there was no real-time consumer, the events were discarded and logging continues.</para>
/// <para>
/// If a consumer begins processing real-time events, the events in the playback file are consumed first. After all events in the
/// playback file are consumed, the session will begin logging new events.
/// </para>
/// </summary>
public LogFileMode LogFileMode;
/// <summary>
/// <para>
/// How often, in seconds, the trace buffers are forcibly flushed. The minimum flush time is 1 second. This forced flush is in
/// addition to the automatic flush that occurs whenever a buffer is full and when the trace session stops.
/// </para>
/// <para>
/// If zero, ETW flushes buffers as soon as they become full. If nonzero, ETW flushes all buffers that contain events based on
/// the timer value. Typically, you want to flush buffers only when they become full. Forcing the buffers to flush (either by
/// setting this member to a nonzero value or by calling <c>FlushTrace</c>) can increase the file size of the log file with
/// unfilled buffer space.
/// </para>
/// <para>
/// If the consumer is consuming events in real time, you may want to set this member to a nonzero value if the event rate is low
/// to force events to be delivered before the buffer is full.
/// </para>
/// <para>
/// For the case of a realtime logger, a value of zero (the default value) means that the flush time will be set to 1 second. A
/// realtime logger is when <c>LogFileMode</c> is set to <c>EVENT_TRACE_REAL_TIME_MODE</c>.
/// </para>
/// </summary>
public uint FlushTimer;
/// <summary>
/// A system logger must set <c>EnableFlags</c> to indicate which SystemTraceProvider events should be included in the trace.
/// This is also used for NT Kernel Logger sessions. This member can contain one or more of the following values. In addition to
/// the events you specify, the kernel logger also logs hardware configuration events on Windows XP or system configuration
/// events on Windows Server 2003.
/// </summary>
public EVENT_TRACE_FLAG EnableFlags;
/// <summary>
/// <para>Not used.</para>
/// <para><c>Windows 2000:</c> Time delay before unused buffers are freed, in minutes. The default is 15 minutes.</para>
/// </summary>
public int AgeLimit;
/// <summary>On output, the number of buffers allocated for the event tracing session's buffer pool.</summary>
public uint NumberOfBuffers;
/// <summary>On output, the number of buffers that are allocated but unused in the event tracing session's buffer pool.</summary>
public uint FreeBuffers;
/// <summary>On output, the number of events that were not recorded.</summary>
public uint EventsLost;
/// <summary>On output, the number of buffers written.</summary>
public uint BuffersWritten;
/// <summary>On output, the number of buffers that could not be written to the log file.</summary>
public uint LogBuffersLost;
/// <summary>On output, the number of buffers that could not be delivered in real-time to the consumer.</summary>
public uint RealTimeBuffersLost;
/// <summary>On output, the thread identifier for the event tracing session.</summary>
public HANDLE LoggerThreadId;
/// <summary>
/// <para>
/// Offset from the start of the structure's allocated memory to beginning of the null-terminated string that contains the log
/// file name.
/// </para>
/// <para>
/// The file name should use the .etl extension. All folders in the path must exist. The path can be relative, absolute, local,
/// or remote. The path cannot contain environment variables (they are not expanded). The user must have permission to write to
/// the folder.
/// </para>
/// <para>
/// The log file name is limited to 1,024 characters. If you set <c>LogFileMode</c> to <c>EVENT_TRACE_PRIVATE_LOGGER_MODE</c> or
/// <c>EVENT_TRACE_FILE_MODE_NEWFILE</c>, be sure to allocate enough memory to include the process identifier that is appended to
/// the file name for private loggers sessions, and the sequential number that is added to log files created using the new file
/// log mode.
/// </para>
/// <para>
/// If you do not want to log events to a log file (for example, you specify <c>EVENT_TRACE_REAL_TIME_MODE</c> only), set
/// LogFileNameOffset to 0. If you specify only real-time logging and also provide an offset with a valid log file name, ETW will
/// use the log file name to create a sequential log file and log events to the log file. ETW also creates the sequential log
/// file if <c>LogFileMode</c> is 0 and you provide an offset with a valid log file name.
/// </para>
/// <para>
/// If you want to log events to a log file, you must allocate enough memory for this structure to include the log file name and
/// session name following the structure. The log file name must follow the session name in memory.
/// </para>
/// <para>
/// Trace files are created using the default security descriptor, meaning that the log file will have the same ACL as the parent
/// directory. If you want access to the files restricted, create a parent directory with the appropriate ACLs.
/// </para>
/// </summary>
public uint LogFileNameOffset;
/// <summary>
/// <para>
/// Offset from the start of the structure's allocated memory to beginning of the null-terminated string that contains the
/// session name.
/// </para>
/// <para>The session name is limited to 1,024 characters. The session name is case-insensitive and must be unique.</para>
/// <para>
/// <c>Windows 2000:</c> Session names are case-sensitive. As a result, duplicate session names are allowed. However, to reduce
/// confusion, you should make sure your session names are unique.
/// </para>
/// <para>
/// When you allocate the memory for this structure, you must allocate enough memory to include the session name and log file
/// name following the structure. The session name must come before the log file name in memory. You must copy the log file name
/// to the offset but you do not copy the session name to the offset—the <c>StartTrace</c> function copies the name for you.
/// </para>
/// </summary>
public uint LoggerNameOffset;
/// <summary>
/// <para>A string that contains the log file name.</para>
/// <para>
/// The file name should use the .etl extension. All folders in the path must exist. The path can be relative, absolute, local,
/// or remote. The path cannot contain environment variables (they are not expanded). The user must have permission to write to
/// the folder.
/// </para>
/// <para>
/// The log file name is limited to 1,024 characters. If you set <c>LogFileMode</c> to <c>EVENT_TRACE_PRIVATE_LOGGER_MODE</c> or
/// <c>EVENT_TRACE_FILE_MODE_NEWFILE</c>, be sure to allocate enough memory to include the process identifier that is appended to
/// the file name for private loggers sessions, and the sequential number that is added to log files created using the new file
/// log mode.
/// </para>
/// <para>
/// If you do not want to log events to a log file (for example, you specify <c>EVENT_TRACE_REAL_TIME_MODE</c> only), set
/// LogFileNameOffset to 0. If you specify only real-time logging and also provide an offset with a valid log file name, ETW will
/// use the log file name to create a sequential log file and log events to the log file. ETW also creates the sequential log
/// file if <c>LogFileMode</c> is 0 and you provide an offset with a valid log file name.
/// </para>
/// <para>
/// If you want to log events to a log file, you must allocate enough memory for this structure to include the log file name and
/// session name following the structure. The log file name must follow the session name in memory.
/// </para>
/// <para>
/// Trace files are created using the default security descriptor, meaning that the log file will have the same ACL as the parent
/// directory. If you want access to the files restricted, create a parent directory with the appropriate ACLs.
/// </para>
/// </summary>
[MarshalAs(UnmanagedType.ByValTStr, SizeConst = MaxLogFileNameLength)]
public string LogFileName;
/// <summary>Reserve buffer space so the ETW system can fill this with the logger name</summary>
[MarshalAs(UnmanagedType.ByValTStr, SizeConst = MaxLoggerNameLength)]
public string LoggerName;
/// <summary>Creates a <see cref="EVENT_TRACE_PROPERTIES"/> with default properties set.</summary>
/// <param name="sessionId">The session identifier.</param>
/// <param name="createForQuery">if set to <c>true</c> creating for a query.</param>
/// <returns>An initialized instance of <see cref="EVENT_TRACE_PROPERTIES"/>.</returns>
public static EVENT_TRACE_PROPERTIES Create(Guid sessionId, bool createForQuery = false)
{
var output = Create();
output.Wnode.Guid = sessionId;
output.Wnode.ClientContext = 1;
output.LogFileMode = createForQuery ? 0 : LogFileMode.EVENT_TRACE_REAL_TIME_MODE;
return output;
}
/// <summary>Creates a <see cref="EVENT_TRACE_PROPERTIES"/> with default properties set.</summary>
/// <param name="logFileName">Name of the log file.</param>
/// <param name="providerName">Name of the provider.</param>
/// <returns>An initialized instance of <see cref="EVENT_TRACE_PROPERTIES"/>.</returns>
public static EVENT_TRACE_PROPERTIES Create(string logFileName = null, string providerName = null)
{
var output = new EVENT_TRACE_PROPERTIES
{
Wnode = new WNODE_HEADER
{
BufferSize = SizeOf,
Flags = WNODE_FLAG.WNODE_FLAG_TRACED_GUID,
},
LoggerNameOffset = SizeOf - StrLen,
LogFileNameOffset = SizeOf - StrLen * 2
};
if (!string.IsNullOrEmpty(logFileName))
output.LogFileName = logFileName;
if (!string.IsNullOrEmpty(providerName))
output.LoggerName = providerName;
return output;
}
}
/// <summary>
/// The <c>EVENT_TRACE_PROPERTIES_V2</c> structure contains information about an event tracing session. You use this structure when
/// you define a session, change the properties of a session, or query for the properties of a session. This is extended from the
/// <c>EVENT_TRACE_PROPERTIES</c> structure.
/// </summary>
/// <remarks>
/// <para>This structure behaves similarly to <c>EVENT_TRACE_PROPERTIES</c> with a few exceptions.</para>
/// <para>
/// The beginning of the structure is defined exactly as <c>EVENT_TRACE_PROPERTIES</c> to allow this new structure to be compatible
/// with systems running versions of Windows before Windows 10, version 1703 and will be treated as <c>EVENT_TRACE_PROPERTIES</c>.
/// </para>
/// <para>
/// When using this structure, be sure to include WNODE_FLAG_VERSIONED_PROPERTIES in Wnode.Flags to indicate that this is the version
/// two structure.
/// </para>
/// <para>
/// Note that the filters passed into <c>ControlTrace</c>, <c>QueryTrace</c>, <c>StartTrace</c>, and <c>StopTrace</c> by this
/// structure are the same format as filters consumed by the <c>EnableTraceEx2</c> function.
/// </para>
/// </remarks>
// https://docs.microsoft.com/en-us/windows/win32/etw/event-trace-properties-v2 typedef struct EVENT_TRACE_PROPERTIES_V2 {
// WNODE_HEADER Wnode; ULONG BufferSize; ULONG MinimumBuffers; ULONG MaximumBuffers; ULONG MaximumFileSize; ULONG LogFileMode; ULONG
// FlushTimer; ULONG EnableFlags; LONG AgeLimit; ULONG NumberOfBuffers; ULONG FreeBuffers; ULONG EventsLost; ULONG BuffersWritten;
// ULONG LogBuffersLost; ULONG RealTimeBuffersLost; HANDLE LoggerThreadId; ULONG LogFileNameOffset; ULONG LoggerNameOffset; ULONG
// VersionNumber; PEVENT_FILTER_DESCRIPTOR FilterDesc; ULONG FilterDescCount; union { struct { ULONG Wow : 1; ULONG QpcDeltaTracking
// : 1; } ULONG V2Options; }; } EVENT_TRACE_PROPERTIES_V2, *PEVENT_TRACE_PROPERTIES_V2;
[PInvokeData("Evntrace.h", MSDNShortId = "2EEDB53B-75BC-48AC-A70D-9AEAED526C40")]
[StructLayout(LayoutKind.Sequential)]
public struct EVENT_TRACE_PROPERTIES_V2
{
/// <summary>
/// A <c>WNODE_HEADER</c> structure. You must specify the <c>BufferSize</c>, <c>Flags</c>, and <c>Guid</c> members, and
/// optionally the <c>ClientContext</c> member.
/// </summary>
public WNODE_HEADER Wnode;
/// <summary>
/// <para>
/// Amount of memory allocated for each event tracing session buffer, in kilobytes. The maximum buffer size is 1 MB. ETW uses the
/// size of physical memory to calculate this value. For more information, see Remarks.
/// </para>
/// <para>
/// If an application expects a relatively low event rate, the buffer size should be set to the memory page size. If the event
/// rate is expected to be relatively high, the application should specify a larger buffer size, and should increase the maximum
/// number of buffers.
/// </para>
/// <para>
/// The buffer size affects the rate at which buffers fill and must be flushed. Although a small buffer size requires less
/// memory, it increases the rate at which buffers must be flushed.
/// </para>
/// </summary>
public uint BufferSize;
/// <summary>
/// Minimum number of buffers allocated for the event tracing session's buffer pool. The minimum number of buffers that you can
/// specify is two buffers per processor. For example, on a single processor computer, the minimum number of buffers is two. Note
/// that if you use the EVENT_TRACE_NO_PER_PROCESSOR_BUFFERING logging mode, the number of processors is assumed to be 1.
/// </summary>
public uint MinimumBuffers;
/// <summary>
/// Maximum number of buffers allocated for the event tracing session's buffer pool. Typically, this value is the minimum number
/// of buffers plus twenty. ETW uses the buffer size and the size of physical memory to calculate this value. This value must be
/// greater than or equal to the value for <c>MinimumBuffers</c>. Note that you do not need to set this value if
/// <c>LogFileMode</c> contains <c>EVENT_TRACE_BUFFERING_MODE</c>; instead, the total memory buffer size is instead the product
/// of <c>MinimumBuffers</c> and <c>BufferSize</c>.
/// </summary>
public uint MaximumBuffers;
/// <summary>
/// <para>
/// Maximum size of the file used to log events, in megabytes. Typically, you use this member to limit the size of a circular log
/// file when you set <c>LogFileMode</c> to <c>EVENT_TRACE_FILE_MODE_CIRCULAR</c>. This member must be specified if
/// <c>LogFileMode</c> contains <c>EVENT_TRACE_FILE_MODE_PREALLOCATE</c>, <c>EVENT_TRACE_FILE_MODE_CIRCULAR</c> or <c>EVENT_TRACE_FILE_MODE_NEWFILE</c>
/// </para>
/// <para>
/// If you are using the system drive (the drive that contains the operating system) for logging, ETW checks for an additional
/// 200MB of disk space, regardless of whether you are using the maximum file size parameter. Therefore, if you specify 100MB as
/// the maximum file size for the trace file in the system drive, you need to have 300MB of free space on the drive.
/// </para>
/// </summary>
public uint MaximumFileSize;
/// <summary>
/// <para>
/// Logging modes for the event tracing session. You use this member to specify that you want events written to a log file, a
/// real-time consumer, or both. You can also use this member to specify that the session is a private logger session. You can
/// specify one or more modes. For a list of possible modes, see Logging Mode Constants.
/// </para>
/// <para>
/// Do not specify real-time logging unless there are real-time consumers ready to consume the events. If there are no real-time
/// consumers, ETW writes the events to a playback file. However, the size of the playback file is limited. If the limit is
/// reached, no new events are logged (to the log file or playback file) and the logging functions fail with STATUS_LOG_FILE_FULL.
/// </para>
/// <para><c>Prior to Windows Vista:</c> If there was no real-time consumer, the events were discarded and logging continues.</para>
/// <para>
/// If a consumer begins processing real-time events, the events in the playback file are consumed first. After all events in the
/// playback file are consumed, the session will begin logging new events.
/// </para>
/// </summary>
public uint LogFileMode;
/// <summary>
/// <para>
/// How often, in seconds, the trace buffers are forcibly flushed. The minimum flush time is 1 second. This forced flush is in
/// addition to the automatic flush that occurs whenever a buffer is full and when the trace session stops.
/// </para>
/// <para>
/// If zero, ETW flushes buffers as soon as they become full. If nonzero, ETW flushes all buffers that contain events based on
/// the timer value. Typically, you want to flush buffers only when they become full. Forcing the buffers to flush (either by
/// setting this member to a nonzero value or by calling <c>FlushTrace</c>) can increase the file size of the log file with
/// unfilled buffer space.
/// </para>
/// <para>
/// If the consumer is consuming events in real time, you may want to set this member to a nonzero value if the event rate is low
/// to force events to be delivered before the buffer is full.
/// </para>
/// <para>
/// For the case of a realtime logger, a value of zero (the default value) means that the flush time will be set to 1 second. A
/// realtime logger is when <c>LogFileMode</c> is set to <c>EVENT_TRACE_REAL_TIME_MODE</c>.
/// </para>
/// </summary>
public uint FlushTimer;
/// <summary>
/// <para>
/// A system logger must set <c>EnableFlags</c> to indicate which SystemTraceProvider events should be included in the trace.
/// This is also used for NT Kernel Logger sessions. This member can contain one or more of the following values. In addition to
/// the events you specify, the kernel logger also logs hardware configuration events on Windows XP or system configuration
/// events on Windows Server 2003.
/// </para>
/// <list type="table">
/// <listheader>
/// <term>Flag</term>
/// <term>Meaning</term>
/// </listheader>
/// <item>
/// <term>EVENT_TRACE_FLAG_ALPC 0x00100000</term>
/// <term>Enables the ALPC event types. This value is supported on Windows Vista and later.</term>
/// </item>
/// <item>
/// <term>EVENT_TRACE_FLAG_CSWITCH 0x00000010</term>
/// <term>Enables the following Thread event type: This value is supported on Windows Vista and later.</term>
/// </item>
/// <item>
/// <term>EVENT_TRACE_FLAG_DBGPRINT 0x00040000</term>
/// <term>Enables the DbgPrint and DbgPrintEx calls to be converted to ETW events.</term>
/// </item>
/// <item>
/// <term>EVENT_TRACE_FLAG_DISK_FILE_IO 0x00000200</term>
/// <term>Enables the following FileIo event type (you must also enable EVENT_TRACE_FLAG_DISK_IO):</term>
/// </item>
/// <item>
/// <term>EVENT_TRACE_FLAG_DISK_IO 0x00000100</term>
/// <term>Enables the following DiskIo event types:</term>
/// </item>
/// <item>
/// <term>EVENT_TRACE_FLAG_DISK_IO_INIT 0x00000400</term>
/// <term>Enables the following DiskIo event type: This value is supported on Windows Vista and later.</term>
/// </item>
/// <item>
/// <term>EVENT_TRACE_FLAG_DISPATCHER 0x00000800</term>
/// <term>Enables the following Thread event type: This value is supported on Windows 7, Windows Server 2008 R2, and later.</term>
/// </item>
/// <item>
/// <term>EVENT_TRACE_FLAG_DPC 0x00000020</term>
/// <term>Enables the following PerfInfo event type: This value is supported on Windows Vista and later.</term>
/// </item>
/// <item>
/// <term>EVENT_TRACE_FLAG_DRIVER 0x00800000</term>
/// <term>Enables the following DiskIo event types: This value is supported on Windows Vista and later.</term>
/// </item>
/// <item>
/// <term>EVENT_TRACE_FLAG_FILE_IO 0x02000000</term>
/// <term>Enables the following FileIo event types: This value is supported on Windows Vista and later.</term>
/// </item>
/// <item>
/// <term>EVENT_TRACE_FLAG_FILE_IO_INIT 0x04000000</term>
/// <term>Enables the following FileIo event type: This value is supported on Windows Vista and later.</term>
/// </item>
/// <item>
/// <term>EVENT_TRACE_FLAG_IMAGE_LOAD 0x00000004</term>
/// <term>Enables the following Image event type:</term>
/// </item>
/// <item>
/// <term>EVENT_TRACE_FLAG_INTERRUPT 0x00000040</term>
/// <term>Enables the following PerfInfo event type: This value is supported on Windows Vista and later.</term>
/// </item>
/// <item>
/// <term>EVENT_TRACE_FLAG_JOB 0x00080000</term>
/// <term>This value is supported on Windows 10</term>
/// </item>
/// <item>
/// <term>EVENT_TRACE_FLAG_MEMORY_HARD_FAULTS 0x00002000</term>
/// <term>Enables the following PageFault_V2 event type:</term>
/// </item>
/// <item>
/// <term>EVENT_TRACE_FLAG_MEMORY_PAGE_FAULTS 0x00001000</term>
/// <term>Enables the following PageFault_V2 event type:</term>
/// </item>
/// <item>
/// <term>EVENT_TRACE_FLAG_NETWORK_TCPIP 0x00010000</term>
/// <term>Enables the TcpIp and UdpIp event types.</term>
/// </item>
/// <item>
/// <term>EVENT_TRACE_FLAG_NO_SYSCONFIG 0x10000000</term>
/// <term>Do not do a system configuration rundown. This value is supported on Windows 8, Windows Server 2012, and later.</term>
/// </item>
/// <item>
/// <term>EVENT_TRACE_FLAG_PROCESS 0x00000001</term>
/// <term>Enables the following Process event type:</term>
/// </item>
/// <item>
/// <term>EVENT_TRACE_FLAG_PROCESS_COUNTERS 0x00000008</term>
/// <term>Enables the following Process_V2 event type: This value is supported on Windows Vista and later.</term>
/// </item>
/// <item>
/// <term>EVENT_TRACE_FLAG_PROFILE 0x01000000</term>
/// <term>Enables the following PerfInfo event type: This value is supported on Windows Vista and later.</term>
/// </item>
/// <item>
/// <term>EVENT_TRACE_FLAG_REGISTRY 0x00020000</term>
/// <term>Enables the Registry event types.</term>
/// </item>
/// <item>
/// <term>EVENT_TRACE_FLAG_SPLIT_IO 0x00200000</term>
/// <term>Enables the SplitIo event types. This value is supported on Windows Vista and later.</term>
/// </item>
/// <item>
/// <term>EVENT_TRACE_FLAG_SYSTEMCALL 0x00000080</term>
/// <term>Enables the following PerfInfo event type: This value is supported on Windows Vista and later.</term>
/// </item>
/// <item>
/// <term>EVENT_TRACE_FLAG_THREAD 0x00000002</term>
/// <term>Enables the following Thread event type:</term>
/// </item>
/// <item>
/// <term>EVENT_TRACE_FLAG_VAMAP 0x00008000</term>
/// <term>
/// Enables the map and unmap (excluding image files) event type. This value is supported on Windows 8, Windows Server 2012, and later.
/// </term>
/// </item>
/// <item>
/// <term>EVENT_TRACE_FLAG_VIRTUAL_ALLOC 0x00004000</term>
/// <term>Enables the following PageFault_V2 event type: This value is supported on Windows 7, Windows Server 2008 R2, and later.</term>
/// </item>
/// </list>
/// </summary>
public uint EnableFlags;
/// <summary>
/// <para>Not used.</para>
/// <para><c>Windows 2000:</c> Time delay before unused buffers are freed, in minutes. The default is 15 minutes.</para>
/// </summary>
public int AgeLimit;
/// <summary>On output, the number of buffers allocated for the event tracing session's buffer pool.</summary>
public uint NumberOfBuffers;
/// <summary>On output, the number of buffers that are allocated but unused in the event tracing session's buffer pool.</summary>
public uint FreeBuffers;
/// <summary>On output, the number of events that were not recorded.</summary>
public uint EventsLost;
/// <summary>On output, the number of buffers written.</summary>
public uint BuffersWritten;
/// <summary>On output, the number of buffers that could not be written to the log file.</summary>
public uint LogBuffersLost;
/// <summary>On output, the number of buffers that could not be delivered in real-time to the consumer.</summary>
public uint RealTimeBuffersLost;
/// <summary>On output, the thread identifier for the event tracing session.</summary>
public HANDLE LoggerThreadId;
/// <summary>
/// <para>
/// Offset from the start of the structure's allocated memory to beginning of the null-terminated string that contains the log
/// file name.
/// </para>
/// <para>
/// The file name should use the .etl extension. All folders in the path must exist. The path can be relative, absolute, local,
/// or remote. The path cannot contain environment variables (they are not expanded). The user must have permission to write to
/// the folder.
/// </para>
/// <para>
/// The log file name is limited to 1,024 characters. If you set <c>LogFileMode</c> to <c>EVENT_TRACE_PRIVATE_LOGGER_MODE</c> or
/// <c>EVENT_TRACE_FILE_MODE_NEWFILE</c>, be sure to allocate enough memory to include the process identifier that is appended to
/// the file name for private loggers sessions, and the sequential number that is added to log files created using the new file
/// log mode.
/// </para>
/// <para>
/// If you do not want to log events to a log file (for example, you specify <c>EVENT_TRACE_REAL_TIME_MODE</c> only), set
/// LogFileNameOffset to 0. If you specify only real-time logging and also provide an offset with a valid log file name, ETW will
/// use the log file name to create a sequential log file and log events to the log file. ETW also creates the sequential log
/// file if <c>LogFileMode</c> is 0 and you provide an offset with a valid log file name.
/// </para>
/// <para>
/// If you want to log events to a log file, you must allocate enough memory for this structure to include the log file name and
/// session name following the structure. The log file name must follow the session name in memory.
/// </para>
/// <para>
/// Trace files are created using the default security descriptor, meaning that the log file will have the same ACL as the parent
/// directory. If you want access to the files restricted, create a parent directory with the appropriate ACLs.
/// </para>
/// </summary>
public uint LogFileNameOffset;
/// <summary>
/// <para>
/// Offset from the start of the structure's allocated memory to beginning of the null-terminated string that contains the
/// session name.
/// </para>
/// <para>The session name is limited to 1,024 characters. The session name is case-insensitive and must be unique.</para>
/// <para>
/// <c>Windows 2000:</c> Session names are case-sensitive. As a result, duplicate session names are allowed. However, to reduce
/// confusion, you should make sure your session names are unique.
/// </para>
/// <para>
/// When you allocate the memory for this structure, you must allocate enough memory to include the session name and log file
/// name following the structure. The session name must come before the log file name in memory. You must copy the log file name
/// to the offset but you do not copy the session name to the offset—the <c>StartTrace</c> function copies the name for you.
/// </para>
/// </summary>
public uint LoggerNameOffset;
/// <summary>The version of the structure. This should be set to "2" for this version.</summary>
public uint VersionNumber;
/// <summary>
/// <para>
/// Supported <c>EVENT_FILTER_DESCRIPTOR</c> filter types for system wide private loggers:
/// <c>EVENT_FILTER_TYPE_EXECUTABLE_NAME</c> and <c>EVENT_FILTER_TYPE_PID</c>
/// </para>
/// <para>
/// A pointer to an array of <c>EVENT_FILTER_DESCRIPTOR</c> structures that points to the filter data. The number of elements in
/// the array is specified in the <c>FilterDescCount</c> member. There can only be one filter for a specific filter type as
/// specified by the <c>Type</c> member of the <c>EVENT_FILTER_DESCRIPTOR</c> structure.
/// </para>
/// <para>
/// This is only applicable to Private Loggers. The only time this should not be null is when it is used for system wide Private Loggers.
/// </para>
/// </summary>
public IntPtr FilterDesc;
/// <summary>
/// The number of filters that the <c>FilterDesc</c> points to. The only time this should not be zero is for system wide Private Loggers.
/// </summary>
public uint FilterDescCount;
/// <summary>
/// <para>An extended set of configuration options:</para>
/// <para>
/// <c>Wow</c>: Marks whether or not this logger was created by a Wow64 process. This should never be set on input as it is
/// reserved for internal use.
/// </para>
/// <para>
/// <c>QpcDeltaTracking</c>: When set, this turns on QPC Delta Tracking events for use in Container scenarios. When a Container's
/// QPC clock is not synchronized with the QPC clock of its host, this feature will insert QPC Delta events into the trace to
/// allow the parsing engine to correlate a Container's trace with traces from the host. This is supported beginning in the next
/// major release of Windows 10.
/// </para>
/// </summary>
public uint V2Options;
}
/// <summary>
/// You may use the <c>MOF_FIELD</c> structures to append event data to the EVENT_TRACE_HEADER or EVENT_INSTANCE_HEADER structures.
/// </summary>
/// <remarks>
/// <para>Be sure to initialize the memory for this structure to zero before setting any members.</para>
/// <para>
/// If you use <c>MOF_FIELD</c> structures, you must set the <c>WNODE_FLAG_USE_MOF_PTR</c> flag in the <c>Flags</c> member of the
/// EVENT_TRACE_HEADER or EVENT_INSTANCE_HEADER structure.
/// </para>
/// <para>
/// The event tracing session automatically dereferences <c>MOF_FIELD</c> data pointers before passing the data to event trace
/// consumers using EVENT_TRACE structures.
/// </para>
/// </remarks>
// https://docs.microsoft.com/en-us/windows/win32/api/evntrace/ns-evntrace-mof_field typedef struct _MOF_FIELD { ULONG64 DataPtr;
// ULONG Length; ULONG DataType; } MOF_FIELD, *PMOF_FIELD;
[PInvokeData("evntrace.h", MSDNShortId = "64ff1191-2177-4d51-afcd-b58d510e9ae8")]
[StructLayout(LayoutKind.Sequential)]
public struct MOF_FIELD
{
/// <summary>Pointer to a event data item.</summary>
public ulong DataPtr;
/// <summary>Length of the item pointed to by <c>DataPtr</c>, in bytes.</summary>
public uint Length;
/// <summary>Reserved.</summary>
public uint DataType;
}
/// <summary>
/// The <c>PAYLOAD_FILTER_PREDICATE</c> structure defines an event payload filter predicate that describes how to filter on a single
/// field in a trace session.
/// </summary>
/// <remarks>
/// <para>
/// On Windows 8.1,Windows Server 2012 R2, and later, event payload filters can be used by the EnableTraceEx2 function and the
/// ENABLE_TRACE_PARAMETERS and EVENT_FILTER_DESCRIPTOR structures to filter on the specific content of the event in a logger session.
/// </para>
/// <para>
/// The <c>PAYLOAD_FILTER_PREDICATE</c> structure is used with the TdhCreatePayloadFilter function to create a single payload filter
/// for a single payload to be used with the EnableTraceEx2 function. A single payload filter can also be aggregated with other
/// single payload filters using the TdhAggregatePayloadFilters function.
/// </para>
/// <para>
/// Each field has a type specified in the provider manifest that can be used in the <c>Fieldname</c> member of the
/// <c>PAYLOAD_FILTER_PREDICATE</c> structure to filter on that field.
/// </para>
/// <para>
/// The <c>CompareOp</c> member specifies that operator to use for payload filtering. Payload filtering supports filtering on a
/// string (including a <c>GUID</c>) and integers (including <c>TDH_INTYPE_FILETIME</c>). Filtering on floating-point numbers, a
/// binary blob (including <c>TDH_INTYPE_POINTER</c>), and structured data ( <c>SID</c> and <c>SYSTEMTIME</c>) are not supported.
/// </para>
/// <para>
/// The <c>Value</c> member contains a string of the value or values to compare with the value of the <c>Fieldname</c> member. The
/// <c>Value</c> member is converted from a string to the type of the <c>Fieldname</c> member as specified in the manifest.
/// </para>
/// <para>
/// All string comparisons are case-insensitive. The string in the <c>Value</c> member is UNICODE, but it will be converted to ANSI
/// if the type specified in the manifest is ANSI.
/// </para>
/// <para>
/// A <c>Fieldname</c> member that contains a <c>GUID</c> can only be compared when the <c>CompareOp</c> member contains either the
/// <c>PAYLOADFIELD_IS</c> or <c>PAYLOADFIELD_ISNOT</c> for the payload operator. The string that represents a <c>GUID</c> in the
/// <c>Value</c> member must contain the curly brackets ({00000000-0000-0000-0000-000000000000}, for example).
/// </para>
/// <para>Examples</para>
/// <para>
/// For an example that uses the <c>PAYLOAD_FILTER_PREDICATE</c> structure and the TdhCreatePayloadFilter function to create payload
/// filters to use in filtering on specific conditions in a logger session, see the example for the EnableTraceEx2 function.
/// </para>
/// </remarks>
// https://docs.microsoft.com/en-us/windows/win32/api/tdh/ns-tdh-payload_filter_predicate typedef struct _PAYLOAD_FILTER_PREDICATE {
// LPWSTR FieldName; USHORT CompareOp; LPWSTR Value; } PAYLOAD_FILTER_PREDICATE, *PPAYLOAD_FILTER_PREDICATE;
[PInvokeData("tdh.h", MSDNShortId = "6B8C03C9-2936-4FEE-AEF4-ABC368B1CB75")]
[StructLayout(LayoutKind.Sequential)]
public struct PAYLOAD_FILTER_PREDICATE
{
/// <summary>The name of the field to filter in package manifest.</summary>
[MarshalAs(UnmanagedType.LPWStr)] public string FieldName;
/// <summary>
/// <para>The payload operator to use for the comparison.</para>
/// <para>This member can be one of the values for the <c>PAYLOAD_OPERATOR</c> enumeration defined in the Tdh.h header file.</para>
/// <list type="table">
/// <listheader>
/// <term>Value</term>
/// <term>Meaning</term>
/// </listheader>
/// <item>
/// <term>PAYLOADFIELD_EQ 0</term>
/// <term>
/// The value of the FieldName parameter is equal to the numeric value of the string in the Value member. This operator is for
/// comparing integers and requires one value in the Value member.
/// </term>
/// </item>
/// <item>
/// <term>PAYLOADFIELD_NE 1</term>
/// <term>
/// The value of the FieldName parameter is not equal to the numeric value of the string in the Value member. This operator is
/// for comparing integers and requires one value in the Value member.
/// </term>
/// </item>
/// <item>
/// <term>PAYLOADFIELD_LE 2</term>
/// <term>
/// The value of the FieldName parameter is less than or equal to the numeric value of the string in the Value member. This
/// operator is for comparing integers and requires one value in the Value member.
/// </term>
/// </item>
/// <item>
/// <term>PAYLOADFIELD_GT 3</term>
/// <term>
/// The value of the FieldName parameter is greater than the numeric value of the string in the Value member. This operator is
/// for comparing integers and requires one value in the Value member.
/// </term>
/// </item>
/// <item>
/// <term>PAYLOADFIELD_LT 4</term>
/// <term>
/// The value of the FieldName parameter is less than the numeric value of the string in the Value member. This operator is for
/// comparing integers and requires one value in the Value member.
/// </term>
/// </item>
/// <item>
/// <term>PAYLOADFIELD_GE 5</term>
/// <term>
/// The value of the FieldName parameter is greater than or equal to the numeric value of the string in the Value member. This
/// operator is for comparing integers and requires one value in the Value member.
/// </term>
/// </item>
/// <item>
/// <term>PAYLOADFIELD_BETWEEN 6</term>
/// <term>
/// The value of the FieldName parameter is between the two numeric values in the string in the Value member. The
/// PAYLOADFIELD_BETWEEN operator uses a closed interval (LowerBound &lt;= FieldValue &lt;= UpperBound). This operator is for
/// comparing integers and requires two values in the Value member. The two values should be separated by a comma character (',').
/// </term>
/// </item>
/// <item>
/// <term>PAYLOADFIELD_NOTBETWEEN 7</term>
/// <term>
/// The value of the FieldName parameter is not between the two numeric values in the string in the Value member. This operator
/// is for comparing integers and requires two values in the Value member. The two values should be separated by a comma
/// character (',').
/// </term>
/// </item>
/// <item>
/// <term>PAYLOADFIELD_MODULO 8</term>
/// <term>
/// The value of the FieldName parameter is the modulo of the numeric value in the string in the Value member. The operator can
/// be used for periodic sampling. This operator is for comparing integers and requires one value in the Value member.
/// </term>
/// </item>
/// <item>
/// <term>PAYLOADFIELD_CONTAINS 20</term>
/// <term>
/// The value of the FieldName parameter contains the substring value in the Value member. String comparisons are case
/// insensitive. This operator is for comparing strings and requires one value in the Value member.
/// </term>
/// </item>
/// <item>
/// <term>PAYLOADFIELD_DOESNTCONTAIN 21</term>
/// <term>
/// The value of the FieldName parameter does not contain the substring in the Value member. String comparisons are case
/// insensitive. This operator is for comparing strings and requires one value in the Value member.
/// </term>
/// </item>
/// <item>
/// <term>PAYLOADFIELD_IS 30</term>
/// <term>
/// The value of the FieldName parameter is identical to the value of the string in the Value member. String comparisons are case
/// insensitive. This operator is for comparing strings or other non-integer values and requires one value in the Value member.
/// </term>
/// </item>
/// <item>
/// <term>PAYLOADFIELD_ISNOT 31</term>
/// <term>
/// The value of the FieldName parameter is not identical to the value of the string in the Value member. String comparisons are
/// case insensitive. This operator is for comparing strings or other non-integer values and requires one value in the Value member.
/// </term>
/// </item>
/// <item>
/// <term>PAYLOADFIELD_INVALID 32</term>
/// <term>A value of the payload operator that is not valid.</term>
/// </item>
/// </list>
/// </summary>
public ushort CompareOp;
/// <summary>The string that contains one or values to compare depending on the <c>CompareOp</c> member.</summary>
[MarshalAs(UnmanagedType.LPWStr)] public string Value;
}
/// <summary/>
[PInvokeData("evntrace.h")]
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct PROFILE_SOURCE_INFO
{
/// <summary/>
public uint NextEntryOffset;
/// <summary/>
public uint Source;
/// <summary/>
public uint MinInterval;
/// <summary/>
public uint MaxInterval;
/// <summary/>
public ulong Reserved;
/// <summary/>
public ushort _Description;
/// <summary/>
public string Description
{
get
{
unsafe
{
fixed (void* desc = &_Description)
{
return Marshal.PtrToStringUni((IntPtr)desc);
}
}
}
}
}
/// <summary>Defines the property to retrieve.</summary>
/// <remarks>
/// <para>To describe a structure, set PropertyName to the name of the structure and ArrayIndex to ULONG_MAX.</para>
/// <para>
/// To describe a member of a structure, define an array of two <c>PROPERTY_DATA_DESCRIPTOR</c> structures. In the first descriptor,
/// set PropertyName to the name of the structure and ArrayIndex to 0. In the second descriptor, set PropertyName to the name of the
/// member and ArrayIndex to ULONG_MAX.
/// </para>
/// <para>
/// If the structure is an element of an array of structures, set ArrayIndex in the first descriptor to the zero-based index of the
/// structure in the array.
/// </para>
/// </remarks>
// https://docs.microsoft.com/en-us/windows/win32/api/tdh/ns-tdh-property_data_descriptor typedef struct _PROPERTY_DATA_DESCRIPTOR {
// ULONGLONG PropertyName; ULONG ArrayIndex; ULONG Reserved; } PROPERTY_DATA_DESCRIPTOR;
[PInvokeData("tdh.h", MSDNShortId = "38e6f5b1-fce5-45e4-ac7a-09ba40d29837")]
[StructLayout(LayoutKind.Sequential)]
public struct PROPERTY_DATA_DESCRIPTOR
{
/// <summary>
/// <para>
/// Pointer to a null-terminated Unicode string that contains the case-sensitive property name. You can use the <c>NameOffset</c>
/// member of the EVENT_PROPERTY_INFO structure to get the property name.
/// </para>
/// <para>
/// The following table lists the possible values of PropertyName for WPP events. Use the suggested TDH data type when formatting
/// the returned buffer from TdhGetProperty.
/// </para>
/// <list type="table">
/// <listheader>
/// <term>Name</term>
/// <term>TDH Data Type</term>
/// <term>Description</term>
/// </listheader>
/// <item>
/// <term>FormattedString</term>
/// <term>TDH_INTYPE_UNICODESTRING</term>
/// <term>The formatted WPP trace message.</term>
/// </item>
/// <item>
/// <term>SequenceNum</term>
/// <term>TDH_INTYPE_UINT32</term>
/// <term>
/// The local or global sequence number of the trace message. Local sequence numbers, which are unique only to this trace
/// session, are the default.
/// </term>
/// </item>
/// <item>
/// <term>FunctionName</term>
/// <term>TDH_INTYPE_UNICODESTRING</term>
/// <term>The name of the function that generated the trace message.</term>
/// </item>
/// <item>
/// <term>ComponentName</term>
/// <term>TDH_INTYPE_UNICODESTRING</term>
/// <term>
/// The name of the component of the provider that generated the trace message. The component name appears only if it is
/// specified in the tracing code.
/// </term>
/// </item>
/// <item>
/// <term>SubComponentName</term>
/// <term>TDH_INTYPE_UNICODESTRING</term>
/// <term>
/// The name of the subcomponent of the provider that generated the trace message. The subcomponent name appears only if it is
/// specified in the tracing code.
/// </term>
/// </item>
/// <item>
/// <term>TraceGuid</term>
/// <term>TDH_INTYPE_GUID</term>
/// <term>The GUID associated with the WPP trace message.</term>
/// </item>
/// <item>
/// <term>GuidTypeName</term>
/// <term>TDH_INTYPE_UNICODESTRING</term>
/// <term>The file name concatenated with the line number from the source code from which the WPP trace message was traced.</term>
/// </item>
/// <item>
/// <term>SystemTime</term>
/// <term>TDH_INTYPE_SYSTEMTIME</term>
/// <term>The time when the WPP trace message was generated.</term>
/// </item>
/// <item>
/// <term>FlagsName</term>
/// <term>TDH_INTYPE_UNICODESTRING</term>
/// <term>The names of the trace flags enabling the trace message.</term>
/// </item>
/// <item>
/// <term>LevelName</term>
/// <term>TDH_INTYPE_UNICODESTRING</term>
/// <term>The value of the trace level enabling the trace message.</term>
/// </item>
/// </list>
/// </summary>
public ulong PropertyName;
/// <summary>
/// Zero-based index for accessing elements of a property array. If the property data is not an array or if you want to address
/// the entire array, specify ULONG_MAX (0xFFFFFFFF).
/// </summary>
public uint ArrayIndex;
/// <summary>Reserved.</summary>
public uint Reserved;
}
/// <summary>Defines the array of providers that have registered a MOF or manifest on the computer.</summary>
// https://docs.microsoft.com/en-us/windows/win32/api/tdh/ns-tdh-provider_enumeration_info typedef struct _PROVIDER_ENUMERATION_INFO
// { ULONG NumberOfProviders; ULONG Reserved; TRACE_PROVIDER_INFO TraceProviderInfoArray[ANYSIZE_ARRAY]; } PROVIDER_ENUMERATION_INFO;
[PInvokeData("tdh.h", MSDNShortId = "bb4548fb-70e5-4726-bc92-adb7ba7be0e4")]
[StructLayout(LayoutKind.Sequential)]
public struct PROVIDER_ENUMERATION_INFO
{
/// <summary>Number of elements in the <c>TraceProviderInfoArray</c> array.</summary>
public uint NumberOfProviders;
/// <summary/>
public uint Reserved;
///// <summary>
///// Array of TRACE_PROVIDER_INFO structures that contain information about each provider such as its name and unique identifier.
///// </summary>
//public TRACE_PROVIDER_INFO TraceProviderInfoArray[ANYSIZE_ARRAY];
}
/// <summary>The <c>PROVIDER_EVENT_INFO</c> structure defines an array of events in a provider manifest.</summary>
// https://docs.microsoft.com/en-us/windows/win32/api/tdh/ns-tdh-provider_event_info typedef struct _PROVIDER_EVENT_INFO { ULONG
// NumberOfEvents; ULONG Reserved; EVENT_DESCRIPTOR EventDescriptorsArray[ANYSIZE_ARRAY]; } PROVIDER_EVENT_INFO;
[PInvokeData("tdh.h", MSDNShortId = "CC392841-7436-4543-A846-FB5A27D9A014")]
[StructLayout(LayoutKind.Sequential)]
public struct PROVIDER_EVENT_INFO
{
/// <summary>The number of elements in the <c>EventDescriptorsArray</c> array.</summary>
public uint NumberOfEvents;
/// <summary>Reserved.</summary>
public uint Reserved;
///// <summary>An array of EVENT_DESCRIPTOR structures that contain information about each event.</summary>
//public EVENT_DESCRIPTOR EventDescriptorsArray[ANYSIZE_ARRAY];
}
/// <summary>Defines the field information.</summary>
// https://docs.microsoft.com/en-us/windows/win32/api/tdh/ns-tdh-provider_field_info typedef struct _PROVIDER_FIELD_INFO { ULONG
// NameOffset; ULONG DescriptionOffset; ULONGLONG Value; } PROVIDER_FIELD_INFO;
[PInvokeData("tdh.h", MSDNShortId = "a7c88c25-3acc-42aa-bf2b-bc7651e84f8c")]
[StructLayout(LayoutKind.Sequential)]
public struct PROVIDER_FIELD_INFO
{
/// <summary>Offset to the null-terminated Unicode string that contains the name of the field, in English only.</summary>
public uint NameOffset;
/// <summary>
/// Offset to the null-terminated Unicode string that contains the localized description of the field. The value is zero if the
/// description does not exist.
/// </summary>
public uint DescriptionOffset;
/// <summary>Field value.</summary>
public ulong Value;
}
/// <summary>Defines metadata information about the requested field.</summary>
// https://docs.microsoft.com/en-us/windows/win32/api/tdh/ns-tdh-provider_field_infoarray typedef struct _PROVIDER_FIELD_INFOARRAY {
// ULONG NumberOfElements; EVENT_FIELD_TYPE FieldType; PROVIDER_FIELD_INFO FieldInfoArray[ANYSIZE_ARRAY]; } PROVIDER_FIELD_INFOARRAY;
[PInvokeData("tdh.h", MSDNShortId = "c3755ca2-7b17-4f86-9ae8-34621f8b8c1b")]
[StructLayout(LayoutKind.Sequential)]
public struct PROVIDER_FIELD_INFOARRAY
{
/// <summary>Number of elements in the <c>FieldInfoArray</c> array.</summary>
public uint NumberOfElements;
/// <summary>
/// Type of field information in the <c>FieldInfoArray</c> array. For possible values, see the EVENT_FIELD_TYPE enumeration.
/// </summary>
public EVENT_FIELD_TYPE FieldType;
///// <summary>Array of PROVIDER_FIELD_INFO structures that define the field's name, description and value.</summary>
//public PROVIDER_FIELD_INFO FieldInfoArray[ANYSIZE_ARRAY];
}
/// <summary>Defines a filter and its data.</summary>
// https://docs.microsoft.com/en-us/windows/win32/api/tdh/ns-tdh-provider_filter_info typedef struct _PROVIDER_FILTER_INFO { UCHAR
// Id; UCHAR Version; ULONG MessageOffset; ULONG Reserved; ULONG PropertyCount; EVENT_PROPERTY_INFO
// EventPropertyInfoArray[ANYSIZE_ARRAY]; } PROVIDER_FILTER_INFO, *PPROVIDER_FILTER_INFO;
[PInvokeData("tdh.h", MSDNShortId = "0541b24a-8531-4828-8c3b-d889e58b0b38")]
[StructLayout(LayoutKind.Sequential)]
public struct PROVIDER_FILTER_INFO
{
/// <summary>
/// The filter identifier that identifies the filter in the manifest. This is the same value as the <c>value</c> attribute of the
/// FilterType complex type.
/// </summary>
public byte Id;
/// <summary>
/// The version number that identifies the version of the filter definition in the manifest. This is the same value as the
/// <c>version</c> attribute of the FilterType complex type.
/// </summary>
public byte Version;
/// <summary>
/// Offset from the beginning of this structure to the message string that describes the filter. This is the same value as the
/// <c>message</c> attribute of the FilterType complex type.
/// </summary>
public uint MessageOffset;
/// <summary>Reserved.</summary>
public uint Reserved;
/// <summary>The number of elements in the EventPropertyInfoArray array.</summary>
public uint PropertyCount;
///// <summary>An array of EVENT_PROPERTY_INFO structures that define the filter data.</summary>
//public EVENT_PROPERTY_INFO EventPropertyInfoArray[ANYSIZE_ARRAY];
}
/// <summary>Defines the additional information required to parse an event.</summary>
// https://docs.microsoft.com/en-us/windows/win32/api/tdh/ns-tdh-tdh_context typedef struct _TDH_CONTEXT { ULONGLONG ParameterValue;
// TDH_CONTEXT_TYPE ParameterType; ULONG ParameterSize; } TDH_CONTEXT;
[PInvokeData("tdh.h", MSDNShortId = "184df0af-3ac5-406f-a298-4f23826ad85e")]
[StructLayout(LayoutKind.Sequential)]
public struct TDH_CONTEXT
{
/// <summary>
/// Context value cast to a ULONGLONG. The context value is determined by the context type specified in <c>ParameterType</c>. For
/// example, if the context type is TDH_CONTEXT_WPP_TMFFILE, the context value is a Unicode string that contains the name of the
/// .tmf file.
/// </summary>
public ulong ParameterValue;
/// <summary>Context type. For a list of types, see the TDH_CONTEXT_TYPE enumeration.</summary>
public TDH_CONTEXT_TYPE ParameterType;
/// <summary>Reserved for future use.</summary>
public uint ParameterSize;
}
/// <summary>Defines the session and the information that the session used to enable the provider.</summary>
/// <remarks>The <c>TRACE_PROVIDER_INSTANCE_INFO</c> block contains one or more of these structures.</remarks>
// https://docs.microsoft.com/en-us/windows/win32/etw/trace-enable-info typedef struct _TRACE_ENABLE_INFO { ULONG IsEnabled; UCHAR
// Level; UCHAR Reserved1; USHORT LoggerId; ULONG EnableProperty; ULONG Reserved2; ULONGLONG MatchAnyKeyword; ULONGLONG
// MatchAllKeyword; } TRACE_ENABLE_INFO, *PTRACE_ENABLE_INFO;
[PInvokeData("evntrace.h", MSDNShortId = "999dd102-5937-4b1e-b841-623dddaa0df9")]
[StructLayout(LayoutKind.Sequential)]
public struct TRACE_ENABLE_INFO
{
/// <summary>
/// Indicates if the provider is enabled to the session. The value is <c>TRUE</c> if the provider is enabled to the session,
/// otherwise, the value is <c>FALSE</c>. This value should always be <c>TRUE</c>.
/// </summary>
[MarshalAs(UnmanagedType.Bool)]
public bool IsEnabled;
/// <summary>
/// Level of detail that the session asked the provider to include in the events. For details, see the Level parameter of the
/// <c>EnableTraceEx</c> function.
/// </summary>
public TRACE_LEVEL Level;
/// <summary>Reserved.</summary>
public byte Reserved1;
/// <summary>Identifies the session that enabled the provider.</summary>
public ushort LoggerId;
/// <summary>
/// Additional information that the session wants ETW to include in the log file. For details, see the EnableProperty parameter
/// of the <c>EnableTraceEx</c> function.
/// </summary>
public uint EnableProperty;
/// <summary>Reserved.</summary>
public uint Reserved2;
/// <summary>
/// Keywords specify which events the session wants the provider to write. For details, see the MatchAnyKeyword parameter of the
/// <c>EnableTraceEx</c> function.
/// </summary>
public ulong MatchAnyKeyword;
/// <summary>
/// Keywords specify which events the session wants the provider to write. For details, see the MatchAllKeyword parameter of the
/// <c>EnableTraceEx</c> function.
/// </summary>
public ulong MatchAllKeyword;
}
/// <summary>Defines the information about the event.</summary>
/// <remarks>The value of an offset is zero if the member is not defined.</remarks>
// https://docs.microsoft.com/en-us/windows/win32/api/tdh/ns-tdh-trace_event_info typedef struct _TRACE_EVENT_INFO { GUID
// ProviderGuid; GUID EventGuid; EVENT_DESCRIPTOR EventDescriptor; DECODING_SOURCE DecodingSource; ULONG ProviderNameOffset; ULONG
// LevelNameOffset; ULONG ChannelNameOffset; ULONG KeywordsNameOffset; ULONG TaskNameOffset; ULONG OpcodeNameOffset; ULONG
// EventMessageOffset; ULONG ProviderMessageOffset; ULONG BinaryXMLOffset; ULONG BinaryXMLSize; union { ULONG EventNameOffset; ULONG
// ActivityIDNameOffset; }; union { ULONG EventAttributesOffset; ULONG RelatedActivityIDNameOffset; }; ULONG PropertyCount; ULONG
// TopLevelPropertyCount; union { TEMPLATE_FLAGS Flags; struct { ULONG Reserved : 4; ULONG Tags : 28; }; }; EVENT_PROPERTY_INFO
// EventPropertyInfoArray[ANYSIZE_ARRAY]; } TRACE_EVENT_INFO;
[PInvokeData("tdh.h", MSDNShortId = "ecf57a23-0dd2-4954-82ac-e92f651c226f")]
[StructLayout(LayoutKind.Sequential)]
public struct TRACE_EVENT_INFO
{
/// <summary>A GUID that identifies the provider.</summary>
public Guid ProviderGuid;
/// <summary>
/// A GUID that identifies the MOF class that contains the event. If the provider uses a manifest to define its events, this
/// member is GUID_NULL.
/// </summary>
public Guid EventGuid;
/// <summary>A EVENT_DESCRIPTOR structure that describes the event.</summary>
public EVENT_DESCRIPTOR EventDescriptor;
/// <summary>
/// A DECODING_SOURCE enumeration value that identifies the source used to parse the event's data (for example, an instrumenation
/// manifest of WMI MOF class).
/// </summary>
public DECODING_SOURCE DecodingSource;
/// <summary>
/// The offset from the beginning of this structure to a null-terminated Unicode string that contains the name of the provider.
/// </summary>
public uint ProviderNameOffset;
/// <summary>
/// The offset from the beginning of this structure to a null-terminated Unicode string that contains the name of the level. For
/// possible names, see Remarks in LevelType.
/// </summary>
public uint LevelNameOffset;
/// <summary>
/// The offset from the beginning of this structure to a null-terminated Unicode string that contains the name of the channel.
/// For possible names, see Remarks in ChannelType.
/// </summary>
public uint ChannelNameOffset;
/// <summary>
/// The offset from the beginning of this structure to a list of null-terminated Unicode strings that contains the names of the
/// keywords. The list is terminated with two NULL characters. For possible names, see Remarks in KeywordType.
/// </summary>
public uint KeywordsNameOffset;
/// <summary>
/// The offset from the beginning of this structure to a null-terminated Unicode string that contains the name of the task. For
/// possible names, see Remarks in TaskType.
/// </summary>
public uint TaskNameOffset;
/// <summary>
/// The offset from the beginning of this structure to a null-terminated Unicode string that contains the name of the operation.
/// For possible names, see Remarks in OpcodeType.
/// </summary>
public uint OpcodeNameOffset;
/// <summary>
/// <para>
/// The offset from the beginning of this structure to a null-terminated Unicode string that contains the event message string.
/// The offset is zero if there is no message string. For information on message strings, see the <c>message</c> attribute for EventDefinitionType.
/// </para>
/// <para>
/// The message string can contain insert sequences, for example, Unable to connect to the %1 printer. The number of the insert
/// sequence identifies the property in the event data to use for the substitution.
/// </para>
/// </summary>
public uint EventMessageOffset;
/// <summary>
/// The offset from the beginning of this structure to a null-terminated Unicode string that contains the localized provider name.
/// </summary>
public uint ProviderMessageOffset;
/// <summary>Reserved.</summary>
public uint BinaryXMLOffset;
/// <summary>Reserved.</summary>
public uint BinaryXMLSize;
/// <summary>
/// The offset from the beginning of this structure to a null-terminated Unicode string that contains the property name of the
/// activity identifier in the MOF class. Supported for classic ETW events only.
/// </summary>
public uint ActivityIDNameOffset;
/// <summary>
/// The offset from the beginning of this structure to a null-terminated Unicode string that contains the property name of the
/// related activity identifier in the MOF class. Supported for legacy ETW events only.
/// </summary>
public uint RelatedActivityIDNameOffset;
/// <summary>The number of elements in the <c>EventPropertyInfoArray</c> array.</summary>
public uint PropertyCount;
/// <summary>
/// The number of properties in the <c>EventPropertyInfoArray</c> array that are top-level properties. This number does not
/// include members of structures. Top-level properties come before all member properties in the array.
/// </summary>
public uint TopLevelPropertyCount;
/// <summary>
/// A 28-bit value associated with the event metadata. This value can be used by the event provider to associate additional
/// semantic data with an event for use by an event processing tool. For example, a tag value of 5 might indicate that the event
/// contains debugging information. The semantics of any values in this field are defined by the event provider.
/// </summary>
public uint Tags;
///// <summary>An array of EVENT_PROPERTY_INFO structures that provides information about each property of the event's user data.</summary>
//public EVENT_PROPERTY_INFO EventPropertyInfoArray[ANYSIZE_ARRAY];
}
/// <summary>Defines the header to the list of sessions that enabled the provider specified in the InBuffer parameter of <c>EnumerateTraceGuidsEx</c>.</summary>
/// <remarks>Use the size of this structure to access the first <c>TRACE_PROVIDER_INSTANCE_INFO</c> block in the list.</remarks>
// https://docs.microsoft.com/en-us/windows/win32/etw/trace-guid-info typedef struct _TRACE_GUID_INFO { ULONG InstanceCount; ULONG
// Reserved; } TRACE_GUID_INFO, *PTRACE_GUID_INFO;
[PInvokeData("evntrace.h", MSDNShortId = "2c484adf-605d-420b-8059-942b35305acd")]
[StructLayout(LayoutKind.Sequential)]
public struct TRACE_GUID_INFO
{
/// <summary>
/// The number of <c>TRACE_PROVIDER_INSTANCE_INFO</c> blocks contained in the list. You can have multiple instances of the same
/// provider if the provider lives in a DLL that is loaded by multiple processes.
/// </summary>
public uint InstanceCount;
/// <summary>Reserved.</summary>
public uint Reserved;
}
/// <summary>The <c>TRACE_GUID_PROPERTIES</c> structure contains information about an event trace provider.</summary>
/// <remarks>Be sure to initialize the memory for this structure to zero before setting any members or passing to any functions.</remarks>
// https://docs.microsoft.com/en-us/windows/desktop/etw/trace-guid-properties typedef struct _TRACE_GUID_PROPERTIES { GUID Guid;
// ULONG GuidType; ULONG LoggerId; ULONG EnableLevel; ULONG EnableFlags; BOOLEAN IsEnable; } TRACE_GUID_PROPERTIES, *PTRACE_GUID_PROPERTIES;
[PInvokeData("evntrace.h", MSDNShortId = "849f2d34-14e0-43e8-a735-d46e94671725")]
[StructLayout(LayoutKind.Sequential)]
public struct TRACE_GUID_PROPERTIES
{
/// <summary>Control GUID of the event trace provider.</summary>
public Guid Guid;
/// <summary>Not used.</summary>
public uint GuidType;
/// <summary>Session handle that identifies the event tracing session.</summary>
public uint LoggerId;
/// <summary>Value passed as the EnableLevel parameter to the EnableTrace function.</summary>
public uint EnableLevel;
/// <summary>Value passed as the EnableFlag parameter to the EnableTrace function.</summary>
public uint EnableFlags;
/// <summary>
/// If this member is TRUE, the element identified by the Guid member is currently enabled for the session identified by the
/// LoggerId member. If this member is FALSE, all other members have no meaning and should be zero.
/// </summary>
[MarshalAs(UnmanagedType.U1)] public bool IsEnable;
}
/// <summary>The <c>TRACE_GUID_REGISTRATION</c> structure is used to register event trace classes.</summary>
/// <remarks>Be sure to initialize the memory for this structure to zero before setting any members.</remarks>
// https://docs.microsoft.com/en-us/windows/desktop/ETW/trace-guid-registration typedef struct _TRACE_GUID_REGISTRATION { LPCGUID
// Guid; HANDLE RegHandle; } TRACE_GUID_REGISTRATION;
[PInvokeData("Evntrace.h", MSDNShortId = "fc7b61fb-ef1c-48ec-8523-5f3114b5407a")]
[StructLayout(LayoutKind.Sequential)]
public struct TRACE_GUID_REGISTRATION
{
/// <summary>Class GUID of an event trace class that you are registering.</summary>
public GuidPtr Guid;
/// <summary>
/// <para>Handle to the registered event trace class. The <c>RegisterTraceGuids</c> function generates this value.</para>
/// <para>
/// Use this handle when you call the <c>CreateTraceInstanceId</c> function and to set the <c>RegHandle</c> member of
/// <c>EVENT_INSTANCE_HEADER</c> when calling the <c>TraceEventInstance</c> function.
/// </para>
/// </summary>
public HANDLE RegHandle;
}
/// <summary>The TRACE_LOGFILE_HEADER structure contains information about an event tracing session and its events.</summary>
/// <remarks>
/// <para>Be sure to initialize the memory for this structure to zero before setting any members.</para>
/// <para>
/// The first event from any log file contains the data defined in this structure. You can use this structure to access the event
/// data or you can use the EventTrace_Header MOF class to decode the event data. Using this structure to read the event data may
/// return unexpected results if the consumer is on a different computer from the one that generated the log file or the log file was
/// written in a WOW (32-bit) session on a 64-bit computer. This is because the <c>LoggerName</c> and <c>LogFileName</c> members are
/// pointers and can vary in size depending on the <c>PointerSize</c> member.
/// </para>
/// </remarks>
// https://docs.microsoft.com/en-us/windows/desktop/api/evntrace/ns-evntrace-trace_logfile_header typedef struct
// _TRACE_LOGFILE_HEADER { ULONG BufferSize; union { ULONG Version; struct { UCHAR MajorVersion; UCHAR MinorVersion; UCHAR
// SubVersion; UCHAR SubMinorVersion; } VersionDetail; } DUMMYUNIONNAME; ULONG ProviderVersion; ULONG NumberOfProcessors;
// LARGE_INTEGER EndTime; ULONG TimerResolution; ULONG MaximumFileSize; ULONG LogFileMode; ULONG BuffersWritten; union { GUID
// LogInstanceGuid; struct { ULONG StartBuffers; ULONG PointerSize; ULONG EventsLost; ULONG CpuSpeedInMHz; } DUMMYSTRUCTNAME; }
// DUMMYUNIONNAME2; LARGE_INTEGER BootTime; LARGE_INTEGER PerfFreq; LARGE_INTEGER StartTime; ULONG ReservedFlags; ULONG BuffersLost;
// } TRACE_LOGFILE_HEADER, *PTRACE_LOGFILE_HEADER;
[PInvokeData("evntrace.h", MSDNShortId = "13fdabe6-c904-4546-b876-c145f6a6c345")]
[StructLayout(LayoutKind.Sequential)]
public struct TRACE_LOGFILE_HEADER
{
/// <summary>Size of the event tracing session's buffers, in bytes.</summary>
public uint BufferSize;
/// <summary>
/// Version number of the operating system. This is a roll-up of the members of <c>VersionDetail</c>. Starting with the low-order
/// bytes, the first two bytes contain <c>MajorVersion</c>, the next two bytes contain <c>MinorVersion</c>, the next two bytes
/// contain <c>SubVersion</c>, and the last two bytes contain <c>SubMinorVersion</c>.
/// </summary>
public VERSIONDETAIL VersionDetail;
/// <summary>Build number of the operating system.</summary>
public uint ProviderVersion;
/// <summary>Number of processors on the system.</summary>
public uint NumberOfProcessors;
/// <summary>
/// Time at which the event tracing session stopped, in 100-nanosecond intervals since midnight, January 1, 1601. This value may
/// be 0 if you are consuming events in real time or from a log file to which the provide is still logging events.
/// </summary>
public FILETIME EndTime;
/// <summary>Resolution of the hardware timer, in units of 100 nanoseconds. For usage, see the Remarks for EVENT_TRACE_HEADER.</summary>
public uint TimerResolution;
/// <summary>Maximum size of the log file, in megabytes.</summary>
public uint MaximumFileSize;
/// <summary>Current logging mode for the event tracing session. For a list of values, see Logging Mode Constants.</summary>
public LogFileMode LogFileMode;
/// <summary>Total number of buffers written by the event tracing session.</summary>
public uint BuffersWritten;
/// <summary>Reserved.</summary>
public uint StartBuffers;
/// <summary>Size of a pointer data type, in bytes.</summary>
public uint PointerSize;
/// <summary>
/// Number of events lost during the event tracing session. Events may be lost due to insufficient memory or a very high rate of
/// incoming events.
/// </summary>
public uint EventsLost;
/// <summary>
/// <para>CPU speed, in megahertz.</para>
/// <para><c>Windows 2000:</c> This member is not supported.</para>
/// </summary>
public uint CpuSpeedInMHz;
/// <summary>
/// Do not use.
/// <para>The name of the event tracing session is the first null-terminated string following this structure in memory.</para>
/// </summary>
public StrPtrUni LoggerName;
/// <summary>
/// Do Not use.
/// <para>
/// The name of the event tracing log file is the second null-terminated string following this structure in memory.The first
/// string is the name of the session.
/// </para>
/// </summary>
public StrPtrUni LogFileName;
/// <summary>A TIME_ZONE_INFORMATION structure that contains the time zone for the BootTime, EndTime and StartTime members.</summary>
public TIME_ZONE_INFORMATION TimeZone;
/// <summary>
/// Time at which the system was started, in 100-nanosecond intervals since midnight, January 1, 1601. <c>BootTime</c> is
/// supported only for traces written to the Global Logger session.
/// </summary>
public FILETIME BootTime;
/// <summary>Frequency of the high-resolution performance counter, if one exists.</summary>
public long PerfFreq;
/// <summary>Time at which the event tracing session started, in 100-nanosecond intervals since midnight, January 1, 1601.</summary>
public FILETIME StartTime;
/// <summary>Specifies the clock type. For details, see the <c>ClientContext</c> member of WNODE_HEADER.</summary>
public uint ReservedFlags;
/// <summary>Total number of buffers lost during the event tracing session.</summary>
public uint BuffersLost;
/// <summary>
/// Version number of the operating system. This is a roll-up of the members of <c>VersionDetail</c>. Starting with the low-order
/// bytes, the first two bytes contain <c>MajorVersion</c>, the next two bytes contain <c>MinorVersion</c>, the next two bytes
/// contain <c>SubVersion</c>, and the last two bytes contain <c>SubMinorVersion</c>.
/// </summary>
[StructLayout(LayoutKind.Sequential)]
public struct VERSIONDETAIL
{
/// <summary>Major version number of the operating system.</summary>
public byte MajorVersion;
/// <summary>Minor version number of the operating system.</summary>
public byte MinorVersion;
/// <summary>Reserved.</summary>
public byte SubVersion;
/// <summary>Reserved.</summary>
public byte SubMinorVersion;
}
}
/// <summary>Information relating to a periodic capture state.</summary>
/// <remarks>
/// <para>
/// Periodic capture state is a way to allow capture state notifications to be routinely sent to providers. When this is enabled,
/// notifications will only be sent to provider registrations that have been previously enabled to the current session. Each provider
/// can define its own response (if any) to a notification. Note that events logged by the provider in response to a notification
/// will be sent to every ETW session that the provider is enabled to, similar to a manually requested capture state.
/// </para>
/// <para>To use periodic capture state:</para>
/// <list type="bullet">
/// <item>
/// <term>
/// Allocate a buffer of type <c>TRACE_PERIODIC_CAPTURE_STATE_INFO</c>. The size of the buffer should be: sizeof(
/// <c>TRACE_PERIODIC_CAPTURE_STATE_INFO</c>) + (x * sizeof(GUID)), where x is the number of providers you would like to enable.
/// </term>
/// </item>
/// <item>
/// <term>
/// Call <c>TraceQueryInformation</c> using <c>TracePeriodicCaptureStateInfo</c> for the <c>TRACE_INFO_CLASS</c> enumeration. Pass
/// the buffer and its size as the TraceInformation and InformationLength parameters of <c>TraceQueryInformation</c>.
/// </term>
/// </item>
/// <item>
/// <term>
/// Set <c>CaptureStateFrequencyInSeconds</c> from <c>TRACE_PERIODIC_CAPTURE_STATE_INFO</c> to the minimum frequency supported by the
/// version of Windows. This value may change in the future, so hard coding it is not recommended. If the frequency is below the
/// minimum, the call to <c>TraceSetInformation</c> will fail.
/// </term>
/// </item>
/// <item>
/// <term>Set the <c>ProviderCount</c> from <c>TRACE_PERIODIC_CAPTURE_STATE_INFO</c> to the number of provider GUIDs being passed.</term>
/// </item>
/// <item>
/// <term>
/// Add the GUIDs of each provider after the end of the <c>TRACE_PERIODIC_CAPTURE_STATE_INFO</c> structure. This uses the extra space
/// allocated from (x * sizeof(GUID) from the first step.
/// </term>
/// </item>
/// <item>
/// <term>Call <c>TraceSetInformation</c> using <c>TracePeriodicCaptureStateListInfo</c> from the <c>TRACE_INFO_CLASS</c> enumeration.</term>
/// </item>
/// <item>
/// <term>
/// To turn periodic capture state off, call <c>TraceSetInformation</c> again with <c>TracePeriodicCaptureStateListInfo</c> from the
/// <c>TRACE_INFO_CLASS</c>, NULL for the <c>TraceInformation</c>, and 0 as the <c>InformationLength</c>.
/// </term>
/// </item>
/// </list>
/// </remarks>
// https://docs.microsoft.com/en-us/windows/win32/etw/trace-periodic-capture-state-info typedef struct
// _TRACE_PERIODIC_CAPTURE_STATE_INFO { ULONG CaptureStateFrequencyInSeconds; USHORT ProviderCount; USHORT Reserved; }
// TRACE_PERIODIC_CAPTURE_STATE_INFO, *PTRACE_PERIODIC_CAPTURE_STATE_INFO;
[PInvokeData("evntrace.h", MSDNShortId = "6C032D97-4B37-48D2-BD1A-35B8BA48B8AB")]
[StructLayout(LayoutKind.Sequential)]
public struct TRACE_PERIODIC_CAPTURE_STATE_INFO
{
/// <summary>The frequency of state captures in seconds.</summary>
public uint CaptureStateFrequencyInSeconds;
/// <summary>The number of providers.</summary>
public ushort ProviderCount;
/// <summary>Reserved for future use.</summary>
public ushort Reserved;
}
/// <summary/>
[PInvokeData("evntrace.h")]
[StructLayout(LayoutKind.Sequential)]
public struct TRACE_PROFILE_INTERVAL
{
/// <summary/>
public uint Source;
/// <summary/>
public uint Interval;
}
/// <summary>Defines the GUID and name for a provider.</summary>
// https://docs.microsoft.com/en-us/windows/win32/api/tdh/ns-tdh-trace_provider_info typedef struct _TRACE_PROVIDER_INFO { GUID
// ProviderGuid; ULONG SchemaSource; ULONG ProviderNameOffset; } TRACE_PROVIDER_INFO;
[PInvokeData("tdh.h", MSDNShortId = "0dbfde78-b1d4-4cc6-99aa-81de3f647cdb")]
[StructLayout(LayoutKind.Sequential)]
public struct TRACE_PROVIDER_INFO
{
/// <summary>GUID that uniquely identifies the provider.</summary>
public Guid ProviderGuid;
/// <summary>
/// Is zero if the provider uses a XML manifest to provide a description of its events. Otherwise, the value is 1 if the provider
/// uses a WMI MOF class to provide a description of its events.
/// </summary>
public uint SchemaSource;
/// <summary>
/// Offset to a null-terminated Unicode string that contains the name of the provider. The offset is from the beginning of the
/// PROVIDER_ENUMERATION_INFO buffer that TdhEnumerateProviders returns.
/// </summary>
public uint ProviderNameOffset;
}
/// <summary>Defines an instance of the provider GUID.</summary>
/// <remarks>
/// If more than one provider uses the same GUID, the <c>TRACE_GUID_INFO</c> block contains more than one
/// <c>TRACE_PROVIDER_INSTANCE_INFO</c> structure.
/// </remarks>
// https://docs.microsoft.com/en-us/windows/win32/etw/trace-provider-instance-info typedef struct _TRACE_PROVIDER_INSTANCE_INFO {
// ULONG NextOffset; ULONG EnableCount; ULONG Pid; ULONG Flags; } TRACE_PROVIDER_INSTANCE_INFO, *PTRACE_PROVIDER_INSTANCE_INFO;
[PInvokeData("evntrace.h", MSDNShortId = "49c11cd5-2cb1-474a-8b51-2d86b4501da1")]
[StructLayout(LayoutKind.Sequential)]
public struct TRACE_PROVIDER_INSTANCE_INFO
{
/// <summary>
/// Offset, in bytes, from the beginning of this structure to the next <c>TRACE_PROVIDER_INSTANCE_INFO</c> structure. The value
/// is zero if there is not another instance info block.
/// </summary>
public uint NextOffset;
/// <summary>
/// Number of <c>TRACE_ENABLE_INFO</c> structures in this block. Each structure represents a session that enabled the provider.
/// </summary>
public uint EnableCount;
/// <summary>Process identifier of the process that registered the provider.</summary>
public uint Pid;
/// <summary>
/// <para>Can be one of the following flags.</para>
/// <list type="table">
/// <listheader>
/// <term>Value</term>
/// <term>Meaning</term>
/// </listheader>
/// <item>
/// <term>TRACE_PROVIDER_FLAG_LEGACY</term>
/// <term>The provider used RegisterTraceGuids instead of EventRegister to register itself.</term>
/// </item>
/// <item>
/// <term>TRACE_PROVIDER_FLAG_PRE_ENABLE</term>
/// <term>The provider is not registered; however, one or more sessions have enabled the provider.</term>
/// </item>
/// </list>
/// </summary>
public TRACE_PROVIDER_FLAG Flags;
}
/// <summary>Determines the version information of the TraceLogging session.</summary>
// https://docs.microsoft.com/en-us/windows/win32/api/evntrace/ns-evntrace-trace_version_info typedef struct _TRACE_VERSION_INFO {
// UINT EtwTraceProcessingVersion; UINT Reserved; } TRACE_VERSION_INFO, *PTRACE_VERSION_INFO;
[PInvokeData("evntrace.h", MSDNShortId = "E2B291DB-928F-4170-8684-4B26A7E067BD")]
[StructLayout(LayoutKind.Sequential)]
public struct TRACE_VERSION_INFO
{
/// <summary>TraceLogging version information.</summary>
public uint EtwTraceProcessingVersion;
/// <summary>Not used.</summary>
public uint Reserved;
}
/// <summary>Provides a handle to an event trace.</summary>
[PInvokeData("evntrace.h")]
[StructLayout(LayoutKind.Sequential)]
public struct TRACEHANDLE
{
private readonly ulong handle;
/// <summary>Initializes a new instance of the <see cref="TRACEHANDLE"/> struct.</summary>
/// <param name="preexistingHandle">An <see cref="IntPtr"/> object that represents the pre-existing handle to use.</param>
public TRACEHANDLE(ulong preexistingHandle) => handle = preexistingHandle;
/// <summary>Returns an invalid handle by instantiating a <see cref="TRACEHANDLE"/> object with <see cref="IntPtr.Zero"/>.</summary>
public static TRACEHANDLE NULL => new TRACEHANDLE(0);
/// <summary>Gets a value indicating whether this instance is invalid.</summary>
public bool IsInvalid => handle == 0 || handle == 0x00000000FFFFFFFF;
/// <summary>Gets a value indicating whether this instance is a null handle.</summary>
public bool IsNull => handle == 0;
/// <summary>Performs an explicit conversion from <see cref="TRACEHANDLE"/> to <see cref="IntPtr"/>.</summary>
/// <param name="h">The handle.</param>
/// <returns>The result of the conversion.</returns>
public static explicit operator ulong(TRACEHANDLE h) => h.handle;
/// <summary>Performs an implicit conversion from <see cref="IntPtr"/> to <see cref="TRACEHANDLE"/>.</summary>
/// <param name="h">The pointer to a handle.</param>
/// <returns>The result of the conversion.</returns>
public static implicit operator TRACEHANDLE(ulong h) => new TRACEHANDLE(h);
/// <summary>Implements the operator !=.</summary>
/// <param name="h1">The first handle.</param>
/// <param name="h2">The second handle.</param>
/// <returns>The result of the operator.</returns>
public static bool operator !=(TRACEHANDLE h1, TRACEHANDLE h2) => !(h1 == h2);
/// <summary>Implements the operator ==.</summary>
/// <param name="h1">The first handle.</param>
/// <param name="h2">The second handle.</param>
/// <returns>The result of the operator.</returns>
public static bool operator ==(TRACEHANDLE h1, TRACEHANDLE h2) => h1.Equals(h2);
/// <inheritdoc/>
public override bool Equals(object obj) => obj is TRACEHANDLE h ? handle == h.handle : false;
/// <inheritdoc/>
public override int GetHashCode() => handle.GetHashCode();
}
/// <summary>The <c>WNODE_HEADER</c> structure is a member of the <c>EVENT_TRACE_PROPERTIES</c> structure.</summary>
/// <remarks>
/// <para>Be sure to initialize the memory for this structure to zero before setting any members.</para>
/// <para>To convert an ETW timestamp into a FILETIME, use the following procedure:</para>
/// <para>
/// 1. For each session or log file being processed (i.e. for each EVENT\_TRACE\_LOGFILE), check the logFile.ProcessTraceMode field
/// to determine whether the PROCESS\_TRACE\_MODE\_RAW\_TIMESTAMP flag is set. By default, this flag is not set. If this flag is not
/// set, the ETW runtime will automatically convert the timestamp of each EVENT\_RECORD into a FILETIME before sending the
/// EVENT\_RECORD to your EventRecordCallback function, so no additional processing is needed. The following steps should only be
/// used if the trace is being processed with the PROCESS\_TRACE\_MODE\_RAW\_TIMESTAMP flag set. 2. For each session or log file
/// being processed (i.e. for each EVENT\_TRACE\_LOGFILE), check the logFile.LogfileHeader.ReservedFlags field to determine the time
/// stamp scale for the log file. Based on the value of ReservedFlags, follow one of these steps to determine the value to use for
/// timeStampScale in the remaining steps: 3. On the FIRST call to your EventRecordCallback function for a particular log file, use
/// data from the logFile (EVENT\_TRACE\_LOGFILE) and from the eventRecord (EVENT\_RECORD) to compute the timeStampBase that will be
/// used for the remaining events in the log file: INT64 timeStampBase = logFile.LogfileHeader.StartTime.QuadPart -
/// (INT64)(timeStampScale \* eventRecord.EventHeader.TimeStamp.QuadPart); 4. For each eventRecord (EVENT\_RECORD), convert the
/// event’s timestamp into FILETIME as follows, using the timeStampScale and timeStampBase values calculated in steps 2 and 3: INT64
/// timeStampInFileTime = timeStampBase + (INT64)(timeStampScale \* eventRecord.EventHeader.TimeStamp.QuadPart);
/// </para>
/// </remarks>
// https://docs.microsoft.com/en-us/windows/desktop/ETW/wnode-header typedef struct _WNODE_HEADER { ULONG BufferSize; ULONG
// ProviderId; union { ULONG64 HistoricalContext; struct { ULONG Version; ULONG Linkage; }; }; union { HANDLE KernelHandle;
// LARGE_INTEGER TimeStamp; }; GUID Guid; ULONG ClientContext; ULONG Flags; } WNODE_HEADER, *PWNODE_HEADER;
[PInvokeData("evntrace.h", MSDNShortId = "862a8f46-a326-48c6-92b7-8bb667837bb7")]
[StructLayout(LayoutKind.Sequential)]
public struct WNODE_HEADER
{
/// <summary>
/// Total size of memory allocated, in bytes, for the event tracing session properties. The size of memory must include the room
/// for the <c>EVENT_TRACE_PROPERTIES</c> structure plus the session name string and log file name string that follow the
/// structure in memory.
/// </summary>
public uint BufferSize;
/// <summary>Reserved for internal use.</summary>
public uint ProviderId;
/// <summary>On output, the handle to the event tracing session.</summary>
public TRACEHANDLE HistoricalContext;
/// <summary>
/// Time at which the information in this structure was updated, in 100-nanosecond intervals since midnight, January 1, 1601.
/// </summary>
public FILETIME TimeStamp;
/// <summary>
/// <para>The GUID that you define for the session.</para>
/// <para>For an NT Kernel Logger session, set this member to <c>SystemTraceControlGuid</c>.</para>
/// <para>If this member is set to <c>SystemTraceControlGuid</c> or <c>GlobalLoggerGuid</c>, the logger will be a system logger.</para>
/// <para>For a private logger session, set this member to the provider's GUID that you are going to enable for the session.</para>
/// <para>
/// If you start a session that is not a kernel logger or private logger session, you do not have to specify a session GUID. If
/// you do not specify a GUID, ETW creates one for you. You need to specify a session GUID only if you want to change the default
/// permissions associated with a specific session. For details, see the EventAccessControl function.
/// </para>
/// <para>You cannot start more than one session with the same session GUID.</para>
/// <para><c>Prior to Windows Vista:</c> You can start more than one session with the same session GUID.</para>
/// </summary>
public Guid Guid;
/// <summary>
/// <para>Clock resolution to use when logging the time stamp for each event. The default is Query performance counter (QPC).</para>
/// <para><c>Prior to Windows Vista:</c> The default is system time.</para>
/// <para>
/// <c>Prior to Windows 10, version 1703:</c> No more than 2 distinct clock types can be used simultaneously by any system loggers.
/// </para>
/// <para>
/// <c>Starting with Windows 10, version 1703:</c> The clock type restriction has been removed. All three clock types can now be
/// used simultaneously by system loggers.
/// </para>
/// <para>You can specify one of the following values.</para>
/// <list type="table">
/// <listheader>
/// <term>Value</term>
/// <term>Meaning</term>
/// </listheader>
/// <item>
/// <term>1</term>
/// <term>
/// Query performance counter (QPC). The QPC counter provides a high-resolution time stamp that is not affected by adjustments to
/// the system clock. The time stamp stored in the event is equivalent to the value returned from the QueryPerformanceCounter
/// API. For more information on the characteristics of this time stamp, see Acquiring high-resolution time stamps. You should
/// use this resolution if you have high event rates or if the consumer merges events from different buffers. In these cases, the
/// precision and stability of the QPC time stamp allows for better accuracy in ordering the events from different buffers.
/// However, the QPC time stamp will not reflect updates to the system clock, e.g. if the system clock is adjusted forward due to
/// synchronization with an NTP server while the trace is in progress, the QPC time stamps in the trace will continue to reflect
/// time as if no update had occurred. To determine the resolution, use the PerfFreq member of TRACE_LOGFILE_HEADER when
/// consuming the event. To convert an event’s time stamp into 100-ns units, use the following conversion formula:
/// scaledTimestamp = eventRecord.EventHeader.TimeStamp.QuadPart * 10000000.0 / logfileHeader.PerfFreq.QuadPart Note that on
/// older computers, the time stamp may not be accurate because the counter sometimes skips forward due to hardware errors.
/// </term>
/// </item>
/// <item>
/// <term>2</term>
/// <term>
/// System time. The system time provides a time stamp that tracks changes to the system’s clock, e.g. if the system clock is
/// adjusted forward due to synchronization with an NTP server while the trace is in progress, the System Time time stamps in the
/// trace will also jump forward to match the new setting of the system clock. Prior to Windows 10, the resolution of this time
/// stamp was the resolution of a system clock tick, as indicated by the TimerResolution member of TRACE_LOGFILE_HEADER. Starting
/// with Windows 10, the resolution of this time stamp is the performance counter resolution, as indicated by the PerfFreq member
/// of TRACE_LOGFILE_HEADER. To convert an event’s time stamp into 100-ns units, use the following conversion formula:
/// scaledTimestamp = eventRecord.EventHeader.TimeStamp.QuadPart Note that when events are captured on a system running an OS
/// prior to Windows 10, if the volume of events is high, the resolution for system time may not be fine enough to determine the
/// sequence of events. In this case, a set of events will have the same time stamp, but the order in which ETW delivers the
/// events may not be correct. Starting with Windows 10, the time stamp is captured with additional precision, though some
/// instability may still occur in cases where the system clock was adjusted while the trace was being captured.
/// </term>
/// </item>
/// <item>
/// <term>3</term>
/// <term>
/// CPU cycle counter. The CPU counter provides the highest resolution time stamp and is the least resource-intensive to
/// retrieve. However, the CPU counter is unreliable and should not be used in production. For example, on some computers, the
/// timers will change frequency due to thermal and power changes, in addition to stopping in some states. To determine the
/// resolution, use the CpuSpeedInMHz member of TRACE_LOGFILE_HEADER when consuming the event. If your hardware does not support
/// this clock type, ETW uses system time. Windows Server 2003, Windows XP with SP1 and Windows XP: This value is not supported,
/// it was introduced in Windows Server 2003 with SP1 and Windows XP with SP2.
/// </term>
/// </item>
/// </list>
/// <para><c>Windows 2000:</c> The <c>ClientContext</c> member is not supported.</para>
/// </summary>
public uint ClientContext;
/// <summary>Must contain <c>WNODE_FLAG_TRACED_GUID</c> to indicate that the structure contains event tracing information.</summary>
public WNODE_FLAG Flags;
}
/// <summary/>
[StructLayout(LayoutKind.Sequential)]
public abstract class PEVENT_INSTANCE_HEADER
{
/// <summary/>
public EVENT_INSTANCE_HEADER Header;
}
/// <summary/>
[StructLayout(LayoutKind.Sequential)]
public abstract class PEVENT_TRACE_HEADER
{
/// <summary/>
public EVENT_TRACE_HEADER Header;
}
/// <summary>Provides a <see cref="SafeHandle"/> for <see cref="TRACEHANDLE"/> that is disposed using <see cref="CloseTrace"/>.</summary>
[StructLayout(LayoutKind.Sequential)]
public class SafeTRACEHANDLE : IDisposable
{
private readonly ulong handle;
/// <summary>Initializes a new instance of the <see cref="SafeTRACEHANDLE"/> class and assigns an existing handle.</summary>
/// <param name="preexistingHandle">An <see cref="IntPtr"/> object that represents the pre-existing handle to use.</param>
/// <param name="ownsHandle">
/// <see langword="true"/> to reliably release the handle during the finalization phase; otherwise, <see langword="false"/> (not recommended).
/// </param>
public SafeTRACEHANDLE(ulong preexistingHandle, bool ownsHandle = true) { }
/// <summary>Initializes a new instance of the <see cref="SafeTRACEHANDLE"/> class.</summary>
private SafeTRACEHANDLE() : base() { }
/// <summary>Gets a value indicating whether this instance is invalid.</summary>
/// <value><c>true</c> if this instance is invalid; otherwise, <c>false</c>.</value>
public bool IsInvalid => handle == 0 || handle == 0x00000000FFFFFFFF;
/// <summary>Performs an implicit conversion from <see cref="SafeTRACEHANDLE"/> to <see cref="TRACEHANDLE"/>.</summary>
/// <param name="h">The safe handle instance.</param>
/// <returns>The result of the conversion.</returns>
public static implicit operator TRACEHANDLE(SafeTRACEHANDLE h) => h.handle;
/// <inheritdoc/>
public void Dispose() => CloseTrace(handle);
}
}
}
Reference in New Issue View Git Blame Copy Permalink