EVENT_FILTER_LEVEL_KW structure (evntprov.h)

The EVENT_FILTER_LEVEL_KW structure defines event IDs used in an EVENT_FILTER_DESCRIPTOR structure for a stack walk level-keyword filter.

This filter is only applied to events that are otherwise enabled on the logging session, via a level/keyword in the enable call.

Syntax

typedef struct _EVENT_FILTER_LEVEL_KW {
  ULONGLONG MatchAnyKeyword;
  ULONGLONG MatchAllKeyword;
  UCHAR     Level;
  BOOLEAN   FilterIn;
} EVENT_FILTER_LEVEL_KW, *PEVENT_FILTER_LEVEL_KW;

Members

MatchAnyKeyword

Bitmask of keywords that determine the category of events to filter on.

MatchAllKeyword

This bitmask is optional. This mask further restricts the category of events that you want to filter on. If the event's keyword meets the MatchAnyKeyword condition, the provider will filter the event only if all of the bits in this mask exist in the event's keyword. This mask is not used if MatchAnyKeyword is zero.

Level

Defines the severity level of the event to filter on.

FilterIn

true to filter the events matching the provided names in; false to filter them out.

If set to true, the filtered events will have stacks collected.

Requirements

Requirement	Value
Minimum supported client	Windows 10, version 1709 [desktop apps only]
Minimum supported server	Windows Server 2016 [desktop apps only]
Header	evntprov.h