EVENT_DATA_DESCRIPTOR structure

The EVENT_DATA_DESCRIPTOR structure defines one of the data items of the event data.

Syntax

typedef struct _EVENT_DATA_DESCRIPTOR {
  ULONGLONG Ptr;
  ULONG     Size;
  union {
    ULONG Reserved;
    struct {
      UCHAR  Type;
      UCHAR  Reserved1;
      USHORT Reserved2;
    } DUMMYSTRUCTNAME;
  } DUMMYUNIONNAME;
} EVENT_DATA_DESCRIPTOR, *PEVENT_DATA_DESCRIPTOR;

Members

Ptr

A pointer to the data.

Size

The size, in bytes, of the data.

DUMMYUNIONNAME

DUMMYUNIONNAME.Reserved

DUMMYUNIONNAME.DUMMYSTRUCTNAME

DUMMYUNIONNAME.DUMMYSTRUCTNAME.Type

Reserved.

DUMMYUNIONNAME.DUMMYSTRUCTNAME.Reserved1

DUMMYUNIONNAME.DUMMYSTRUCTNAME.Reserved2

Remarks

If your event data consists of multiple data items, you would create an array of EVENT_DATA_DESCRIPTOR structures and call the EventDataDescCreate macro to initialize each element with this information. For an example, see Writing Manifest-based Events.

Note that the total data size of the event (not just this data item) is the lesser of

  • 64 KB
And
  • The session's buffer size minus the size of the buffer's header (0x48 bytes) minus the sum of the size of the EVENT_HEADER structure and each extended data item (the EVENT_HEADER_EXTENDED_DATA_ITEM structure) that the controller wants to include in the event data.

Requirements

   
Minimum supported client Windows Vista [desktop apps only]
Minimum supported server Windows Server 2008 [desktop apps only]
Header evntprov.h

See Also

EVENT_HEADER

EVENT_HEADER_EXTENDED_DATA_ITEM

EventDataDescCreate

EventWrite

EventWriteTransfer

Writing Manifest-based Events