Edit

PETW_BUFFER_CALLBACK callback function (evntrace.h)

  • Article

Function definition for the BufferCallback that will be invoked by ProcessTrace.

Syntax

PETW_BUFFER_CALLBACK PetwBufferCallback;

BOOL PetwBufferCallback(
  const ETW_BUFFER_HEADER *Buffer,
  ULONG BufferSize,
  const ETW_BUFFER_CALLBACK_INFORMATION *ConsumerInfo,
  void *CallbackContext
)
{...}

Parameters

Buffer

Pointer to the raw buffer data, which begins with an ETW_BUFFER_HEADER struct and is followed by event data.

By default this buffer is available only until the callback returns. To use the buffer after the callback returns, call ProcessTraceBufferIncrementReference. This will keep the buffer available until you call ProcessTraceBufferDecrementReference on it.

ProcessTrace will not return until all such Buffer references have been decremented.

BufferSize

Size of the provided Buffer.

ConsumerInfo

Contains information on the current state of the processing session.

CallbackContext

User-provided context from ETW_OPEN_TRACE_OPTIONS.BufferCallbackContext.

Return value

If TRUE, the processing will continue. If FALSE, trace processing will stop and ProcessTrace will return.

Requirements

Requirement Value
Minimum supported client Windows 2000 Professional [desktop apps | UWP apps]
Minimum supported server Windows 2000 Server [desktop apps | UWP apps]
Target Platform Windows
Header evntrace.h
Library Sechost.lib on Windows 8.1 and Windows Server 2012 R2; Advapi32.lib on Windows 8, Windows Server 2012, Windows 7, Windows Server 2008 R2, Windows Server 2008, Windows Vista and Windows XP
DLL Sechost.dll on Windows 8.1 and Windows Server 2012 R2; Advapi32.dll on Windows 8, Windows Server 2012, Windows 7, Windows Server 2008 R2, Windows Server 2008, Windows Vista and Windows XP