ETW_PROCESS_HANDLE_INFO_TYPE enumeration

  • 2 minutes to read

[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]

Specifies what kind of operation will be done on a handle. currently used with the QueryTraceProcessingHandle function.

Syntax

typedef enum _ETW_PROCESS_HANDLE_INFO_TYPE {
  EtwQueryPartitionInformation,
  EtwQueryProcessHandleInfoMax,
  EtwQueryPartitionInformationV2,
  EtwQueryLastDroppedTimes
} ETW_PROCESS_HANDLE_INFO_TYPE;

Constants

EtwQueryPartitionInformation Used to query partition identifying information. InBuffer should be Null. OutBuffer should be large enough to hold the returned ETW_TRACE_PARTITION_INFORMATION structure. Note that this will only return a non-zero structure when the queried handle is for a trace file generated from a non-host partition on Windows 10, version 1709.
EtwQueryProcessHandleInfoMax Marks the last value in the enumeration for testing purposes. Should not be used.

Requirements

   
Minimum supported client Windows 10, version 1709 [desktop apps only]
Minimum supported server Windows Server 2016 [desktop apps only]
Header evntrace.h