EtwWriteTransfer function (wdm.h)

The EtwWriteTransfer function marks an event that links two activities together; this type of event is referred to as a transfer event. A transfer event can contain the same user-defined data, the same fields, and is subject to the same rules as other events.

Syntax

NTSTATUS EtwWriteTransfer(
  [in]           REGHANDLE              RegHandle,
  [in]           PCEVENT_DESCRIPTOR     EventDescriptor,
  [in, optional] LPCGUID                ActivityId,
  [in, optional] LPCGUID                RelatedActivityId,
  [in]           ULONG                  UserDataCount,
  [in, optional] PEVENT_DATA_DESCRIPTOR UserData
);

Parameters

[in] RegHandle

A pointer to the event provider registration handle, which is returned by the EtwRegister function if the event provider registration is successful.

[in] EventDescriptor

A pointer to the EVENT_DESCRIPTOR structure.

[in, optional] ActivityId

The identifier that indicates the activity associated with the event. The ActivityId provides a way to group related events and is used in end-to-end tracing. This identifier is optional and can be NULL.

[in, optional] RelatedActivityId

The identifier that indicates related activity associated with the event. The RelatedActivityID provides a way to group related events and is used in end-to-end tracing.

[in] UserDataCount

The number of elements in an array of EVENT_DATA_DESCRIPTOR structures.

[in, optional] UserData

The pointer to the first element in an array of EVENT_DATA_DESCRIPTOR structures.

Return value

EtwWriteTransfer returns STATUS_SUCCESS if the event was successfully published.

Remarks

You can call EtwWriteTransfer at any IRQL. However, when IRQL is greater than APC_LEVEL, any data passed to the EtwWrite, EtwWriteString, EtwWriteTransfer functions must not be pageable. That is, any kernel-mode routine that is running at IRQL greater than APC_LEVEL cannot access pageable memory. Data passed to the EtwWrite, EtwWriteString, EtwWriteTransfer functions must reside in system-space memory, regardless of what the IRQL is.

Requirements

   
Minimum supported client Available in Windows Vista and later versions of Windows.
Target Platform Universal
Header wdm.h (include Wdm.h, Ntddk.h)
Library NtosKrnl.lib
DLL NtosKrnl.exe
IRQL Any level (See Comments section.)

See also

EtwWrite

EtwWriteString