EventWrite function

Use this function to write an event.

Syntax

ULONG EVNTAPI EventWrite(
  REGHANDLE              RegHandle,
  PCEVENT_DESCRIPTOR     EventDescriptor,
  ULONG                  UserDataCount,
  PEVENT_DATA_DESCRIPTOR UserData
);

Parameters

RegHandle

Registration handle of the provider. The handle comes from EventRegister.

EventDescriptor

Metadata that identifies the event to write. For details, see EVENT_DESCRIPTOR.

UserDataCount

Number of EVENT_DATA_DESCRIPTOR structures in UserData. The maximum number is 128.

UserData

The event data to write. Allocate a block of memory that contains one or more EVENT_DATA_DESCRIPTOR structures. Set this parameter to NULL if UserDataCount is zero. The data must be in the order specified in the manifest.

Return Value

Returns ERROR_SUCCESS if successful or one of the following values on error.

Return code Description
ERROR_INVALID_PARAMETER
One or more of the parameters is not valid.
ERROR_INVALID_HANDLE
The registration handle of the provider is not valid.
ERROR_ARITHMETIC_OVERFLOW
The event size is larger than the allowed maximum (64k - header).
ERROR_MORE_DATA
The session buffer size is too small for the event.
ERROR_NOT_ENOUGH_MEMORY
Occurs when filled buffers are trying to flush to disk, but disk IOs are not happening fast enough. This happens when the disk is slow and event traffic is heavy. Eventually, there are no more free (empty) buffers and the event is dropped.
STATUS_LOG_FILE_FULL
The real-time playback file is full. Events are not logged to the session until a real-time consumer consumes the events from the playback file. Do not stop logging events based on this error code.

Remarks

Event data written with this function requires a manifest to consume the data.

ETW decides based on the event descriptor if the event is written to a session (for details, see EnableTraceEx).

If you call the EventActivityIdControl function to specify an activity identifier for the event, EventWrite retrieves the identifier from thread local storage and includes it with the event.

Examples

For an example that uses EventWrite, see Writing Manifest-based Events.

Requirements

   
Windows version Windows Vista [desktop apps UWP apps] Windows Server 2008 [desktop apps UWP apps]
Target Platform Windows
Header evntprov.h
Library Advapi32.lib
DLL Advapi32.dll

See Also

EventWriteString

EventWriteTransfer