AFD_EVENT_CLOSE event

The AFD_EVENT_CLOSE event is a Winsock network tracing event for socket close operation.

const EVENT_DESCRIPTOR AFD_EVENT_CLOSE = {0x3e9, 0x0, 0x10, 0x4, 0xf, 0x3e9, 0x8000000000000004};

Parameters

EnterExit

Information on this event.

The following table lists the possible values for the EnterExit parameter:

Value	Meaning
0	The start of a Winsock request.
1	The Winsock request completed.
2	The Winsock AFD driver took an internal action (aborting a connection, for example).
3	The TCP/IP driver caused this event to occur. This usually indicates a data notification.
4	The Winsock AFD driver caused this event to occur (setting a socket option, for example).

Location

A private field used internally.

Process

The EPROCESS address of the process that owns the related socket. This is an opaque structure that serves as the process object for a process. For more information, see the Windows Driver Kit documentation for the EPROCESS structure.

Endpoint

The AFD_ENDPOINT address of the socket.

Status

The NTSTATUS code for the operation.

Remarks

The AFD_EVENT_CLOSE event is traced for a Winsock network operation to close a socket. The channel for this event is Winsock-AFD. The level for this event is informational.

Requirements

Requirement	Value
Minimum supported client	Windows 7 [desktop apps only]
Minimum supported server	Windows Server 2008 R2 [desktop apps only]

See also

Control of Winsock Tracing

EVENT_DESCRIPTOR

Winsock Tracing

Winsock Tracing Levels

Winsock Catalog Change Tracing Details