EventWriteString function

Writes an event that contains a string as its data.

Syntax

ULONG EVNTAPI EventWriteString(
  REGHANDLE RegHandle,
  UCHAR     Level,
  ULONGLONG Keyword,
  PCWSTR    String
);

Parameters

RegHandle

Registration handle of the provider. The handle comes from EventRegister.

Level

Level of detail included in the event. If the provider uses a manifest to define the event, set this value to the same level defined in the manifest. If the event is not defined in a manifest, set this value to 0 to ensure the event is written, otherwise, the event is written based on the level rule defined in EnableTraceEx.

Keyword

Bitmask that specifies the event category. If the provider uses a manifest to define the event, set this value to the same keyword mask defined in the manifest. If the event is not defined in a manifest, set this value to 0 to ensure the event is written, otherwise, the event is written based on the keyword rules defined in EnableTraceEx.

String

Null-terminated string to write as the event data.

Return Value

Returns ERROR_SUCCESS if successful or one of the following values on error.

Return code Description
ERROR_INVALID_PARAMETER
One or more of the parameters is not valid.
ERROR_INVALID_HANDLE
The registration handle of the provider is not valid.
ERROR_ARITHMETIC_OVERFLOW
The event size is larger than the allowed maximum (64k - header).
ERROR_MORE_DATA
The session buffer size is too small for the event.
ERROR_NOT_ENOUGH_MEMORY
Occurs when filled buffers are trying to flush to disk, but disk IOs are not happening fast enough. This happens when the disk is slow and event traffic is heavy. Eventually, there are no more free (empty) buffers and the event is dropped.
STATUS_LOG_FILE_FULL
The real-time playback file is full. Events are not logged to the session until a real-time consumer consumes the events from the playback file. Do not stop logging events based on this error code.

Remarks

The provider does not need a manifest to use this function to write the event, unlike the EventWrite function which does require a manifest. Consumers also do not need a manifest to consume events written with this function.

This function gets the acitivity identifier from the thread local storage, if set.

ETW decides based on the level and keyword mask whether the event is written to a session (for details, see EnableTraceEx).

This function cannot be used to write events to the Admin or Operational channels.

Requirements

   
Minimum supported client Windows Vista [desktop apps | UWP apps]
Minimum supported server Windows Server 2008 [desktop apps | UWP apps]
Target Platform Windows
Header evntprov.h
Library Advapi32.lib
DLL Advapi32.dll

See Also

EnableTraceEx

EventWrite

EventWriteTransfer