ETW_TRACE_PARTITION_INFORMATION structure

• 05/31/2018
• 2 minutes to read

Contains partition information pulled from an ETW trace. Most commonly used as a return structure for QueryTraceProcessingHandle.

Syntax

typedef struct _ETW_TRACE_PARTITION_INFORMATION {
  GUID    PartitionId;
  GUID    ParentId;
  ULONG64 Reserved;
  ULONG   PartitionType;
} ETW_TRACE_PARTITION_INFORMATION, *PETW_TRACE_PARTITION_INFORMATION;

Members

PartitionId

GUID to identify the machine.

ParentId

GUID that identifies the partition instance that contains the traced partition. If the traced partition is a host, then ParentId will be 0.

Reserved

Reserved for future use.

PartitionType

Enumeration value of the container type. the value may be one of the following:

Value	Meaning
Process 1	For events originating from inside a “Windows Server Container”.
VmHost 2	For events originating from inside a “Hyper-V Container”.
VmHostedUvm 3	For events originating from a “Hyper-V Container” template virtual machine.
VmDirectUvm 4	For events originating from applications running with Windows Defender Application Guard.

 

Requirements