evntrace.h header

This header is used by Event Tracing. For more information, see:

  • Event Tracing evntrace.h contains the following programming interfaces:

Functions

Title Description
CloseTrace The CloseTrace function closes a trace.
ControlTraceA The ControlTrace function flushes, queries, updates, or stops the specified event tracing session.
ControlTraceW The ControlTrace function flushes, queries, updates, or stops the specified event tracing session.
CreateTraceInstanceId The CreateTraceInstanceId function creates a unique transaction identifier and maps it to a class GUID registration handle. You then use the transaction identifier when calling the TraceEventInstance function.
EnableTrace Enables or disables the specified classic event trace provider. On Windows Vista and later, call the EnableTraceEx function to enable or disable a provider.
EnableTraceEx Enables or disables the specified event trace provider. The EnableTraceEx2 function supersedes this function.
EnableTraceEx2 Enables or disables the specified event trace provider.
EnumerateTraceGuids The EnumerateTraceGuids function retrieves information about registered event trace providers that are running on the computer.
EnumerateTraceGuidsEx Use this function to retrieve information about trace providers that are registered on the computer.
FlushTraceA The FlushTrace function causes an event tracing session to immediately deliver buffered events for the specified session.
FlushTraceW The FlushTrace function causes an event tracing session to immediately deliver buffered events for the specified session.
GetTraceEnableFlags The GetTraceEnableFlags function retrieves the enable flags passed by the controller to indicate which category of events to trace.Providers can only call this function from their ControlCallback function.
GetTraceEnableLevel The GetTraceEnableLevel function retrieves the severity level passed by the controller to indicate the level of logging the provider should perform. Providers can only call this function from their ControlCallback function.
GetTraceLoggerHandle The GetTraceLoggerHandle function retrieves the handle of the event tracing session. Providers can only call this function from their ControlCallback function.
OpenTraceA The OpenTrace function opens a real-time trace session or log file for consuming.
OpenTraceW The OpenTrace function opens a real-time trace session or log file for consuming.
ProcessTrace The ProcessTrace function delivers events from one or more event tracing sessions to the consumer.
QueryAllTracesA The QueryAllTraces function retrieves the properties and statistics for all event tracing sessions started on the computer for which the caller has permissions to query.
QueryAllTracesW The QueryAllTraces function retrieves the properties and statistics for all event tracing sessions started on the computer for which the caller has permissions to query.
QueryTrace The QueryTrace function retrieves the property settings and session statistics for the specified event tracing session. The ControlTrace function supersedes this function.
QueryTraceA The QueryTrace function retrieves the property settings and session statistics for the specified event tracing session. The ControlTrace function supersedes this function.
QueryTraceProcessingHandle Queries the system for the trace processing handle.
QueryTraceW The QueryTrace function retrieves the property settings and session statistics for the specified event tracing session. The ControlTrace function supersedes this function.
RegisterTraceGuidsA The RegisterTraceGuids function registers an event trace provider and the event trace classes that it uses to generate events. This function also specifies the function the provider uses to enable and disable tracing.
RegisterTraceGuidsW The RegisterTraceGuids function registers an event trace provider and the event trace classes that it uses to generate events. This function also specifies the function the provider uses to enable and disable tracing.
RemoveTraceCallback The RemoveTraceCallback function stops an EventClassCallback function from receiving events for an event trace class.
SetTraceCallback The SetTraceCallback function specifies an EventClassCallback function to process events for the specified event trace class.
StartTraceA The StartTrace function registers and starts an event tracing session.
StartTraceW The StartTrace function registers and starts an event tracing session.
StopTrace The StopTrace function stops the specified event tracing session. The ControlTrace function supersedes this function.
StopTraceA The StopTrace function stops the specified event tracing session. The ControlTrace function supersedes this function.
StopTraceW The StopTrace function stops the specified event tracing session. The ControlTrace function supersedes this function.
TraceEvent The TraceEvent function sends an event to an event tracing session.
TraceEventInstance The TraceEventInstance function sends an event to an event tracing session. The event uses an instance identifier to associate the event with a transaction. This function may also be used to trace hierarchical relationships between related events.
TraceMessage The TraceMessage function sends an informational message to an event tracing session.
TraceMessageVa The TraceMessageVa function sends an informational message with variable arguments to an event tracing session.
TraceQueryInformation Queries event tracing session settings for the specified information class.
TraceSetInformation Enables or disables event tracing session settings for the specified information class.
UnregisterTraceGuids The UnregisterTraceGuids function unregisters an event trace provider and its event trace classes.
UpdateTrace The UpdateTrace function updates the property setting of the specified event tracing session. The ControlTrace function supersedes this function.
UpdateTraceA The UpdateTrace function updates the property setting of the specified event tracing session. The ControlTrace function supersedes this function.
UpdateTraceW The UpdateTrace function updates the property setting of the specified event tracing session. The ControlTrace function supersedes this function.

Callback functions

Title Description
PEVENT_CALLBACK Consumers implement this function to receive events from a session. The PEVENT_CALLBACK type defines a pointer to this callback function. EventCallback is a placeholder for the application-defined function name.
PEVENT_RECORD_CALLBACK Consumers implement this callback to receive events from a session. The PEVENT_RECORD_CALLBACK type defines a pointer to this callback function. EventRecordCallback is a placeholder for the application-defined function name.
PEVENT_TRACE_BUFFER_CALLBACKA Consumers implement this function to receive statistics about each buffer of events that ETW delivers to an event trace consumer.
PEVENT_TRACE_BUFFER_CALLBACKW Consumers implement this function to receive statistics about each buffer of events that ETW delivers to an event trace consumer.
WMIDPREQUEST Providers implement this function to receive enable or disable notification requests from controllers. The WMIDPREQUEST type defines a pointer to this callback function. ControlCallback is a placeholder for the application-defined function name.

Structures

Title Description
CLASSIC_EVENT_ID Identifies the kernel event for which you want to enable call stack tracing.
ENABLE_TRACE_PARAMETERS Defines the information used to enable a provider.
ENABLE_TRACE_PARAMETERS_V1 Defines the information used to enable a provider.
ETW_BUFFER_CONTEXT Provides context information about the event.
ETW_TRACE_PARTITION_INFORMATION Contains partition information pulled from an ETW trace.
EVENT_INSTANCE_HEADER The EVENT_INSTANCE_HEADER structure contains standard event tracing information common to all events.
EVENT_INSTANCE_INFO The EVENT_INSTANCE_INFO structure maps a unique transaction identifier to a registered event trace class.
EVENT_TRACE The EVENT_TRACE structure is used to deliver event information to an event trace consumer.
EVENT_TRACE_HEADER The EVENT_TRACE_HEADER structure contains standard event tracing information common to all events.
EVENT_TRACE_LOGFILEA The EVENT_TRACE_LOGFILE structure specifies how the consumer wants to read events (from a log file or in real-time) and the callbacks that will receive the events.
EVENT_TRACE_LOGFILEW The EVENT_TRACE_LOGFILE structure specifies how the consumer wants to read events (from a log file or in real-time) and the callbacks that will receive the events.
EVENT_TRACE_PROPERTIES The EVENT_TRACE_PROPERTIES structure contains information about an event tracing session. You use this structure when you define a session, change the properties of a session, or query for the properties of a session.
EVENT_TRACE_PROPERTIES_V2 The EVENT_TRACE_PROPERTIES_V2 structure contains information about an event tracing session.
MOF_FIELD You may use the MOF_FIELD structures to append event data to the EVENT_TRACE_HEADER or EVENT_INSTANCE_HEADER structures.
TRACE_ENABLE_INFO Defines the session and the information that the session used to enable the provider.
TRACE_GUID_INFO Defines the header to the list of sessions that enabled the provider specified in the InBuffer parameter of EnumerateTraceGuidsEx.
TRACE_GUID_PROPERTIES The TRACE_GUID_PROPERTIES structure contains information about an event trace provider.
TRACE_GUID_REGISTRATION The TRACE_GUID_REGISTRATION structure is used to register event trace classes.
TRACE_LOGFILE_HEADER The TRACE_LOGFILE_HEADER structure contains information about an event tracing session and its events.
TRACE_PERIODIC_CAPTURE_STATE_INFO Information relating to a periodic capture state.
TRACE_PROVIDER_INSTANCE_INFO Defines an instance of the provider GUID.
TRACE_VERSION_INFO Determines the version information of the TraceLogging session.

Enumerations

Title Description
ETW_PROCESS_HANDLE_INFO_TYPE Specifies what kind of operation will be done on a handle.
TRACE_QUERY_INFO_CLASS Determines the type of information to include with the trace.