[Do not use this function; it may be unavailable in subsequent versions. Instead, filter for the event trace class in your EventRecordCallback function.]
The SetTraceCallback function specifies an EventClassCallback function to process events for the specified event trace class.
ULONG WMIAPI SetTraceCallback( LPCGUID pGuid, PEVENT_CALLBACK EventCallback );
Pointer to the class GUID of an event trace class for which you want to receive events. For a list of kernel provider class GUIDs, see NT Kernel Logger Constants.
Pointer to an EventClassCallback function used to process events belonging to the event trace class.
If the function succeeds, the return value is ERROR_SUCCESS.
If the function fails, the return value is one of the system error codes. The following table includes some common errors and their causes.
One of the following is true:
Consumers call this function.
You can only specify one callback function for an event trace class. If you specify more than one callback function for the even trace class, the last callback function receives the events for that event trace class.
To stop the callback function from receiving events for the event trace class, call the RemoveTraceCallback function. The callback automatically stops receiving callbacks when you close the trace.
You can use this function to receive events written using one of the TraceEvent functions. You cannot use this function to consume events from a provider that used one of the EventWrite functions to log events.
|Minimum supported client||Windows 2000 Professional [desktop apps only]|
|Minimum supported server||Windows 2000 Server [desktop apps only]|
|Library||Sechost.lib on Windows 8.1 and Windows Server 2012 R2; Advapi32.lib on Windows 8, Windows Server 2012, Windows 7, Windows Server 2008 R2, Windows Server 2008, Windows Vista and Windows XP|
|DLL||Sechost.dll on Windows 8.1 and Windows Server 2012 R2; Advapi32.dll on Windows 8, Windows Server 2012, Windows 7, Windows Server 2008 R2, Windows Server 2008, Windows Vista and Windows XP|