EVENT_HEADER_EXTENDED_DATA_ITEM structure

The EVENT_HEADER_EXTENDED_DATA_ITEM structure defines the extended data that ETW collects as part of the event data.

Syntax

typedef struct _EVENT_HEADER_EXTENDED_DATA_ITEM {
  USHORT    Reserved1;
  USHORT    ExtType;
  USHORT    Linkage;
  USHORT    DataSize;
  ULONGLONG DataPtr;
} EVENT_HEADER_EXTENDED_DATA_ITEM, *PEVENT_HEADER_EXTENDED_DATA_ITEM;

Members

Reserved1

Reserved.

ExtType

Type of extended data. The following are possible values.

Value Meaning
EVENT_HEADER_EXT_TYPE_RELATED_ACTIVITYID
The DataPtr member points to an EVENT_EXTENDED_ITEM_RELATED_ACTIVITYID structure that contains the related activity identifier if you called EventWriteTransfer to write the event.
EVENT_HEADER_EXT_TYPE_SID
The DataPtr member points to a SID structure that contains the security identifier (SID) of the user that logged the event. ETW includes the SID if you set the EnableProperty parameter of EnableTraceEx to EVENT_ENABLE_PROPERTY_SID.
EVENT_HEADER_EXT_TYPE_TS_ID
The DataPtr member points to an EVENT_EXTENDED_ITEM_TS_ID structure that contains the terminal session identifier. ETW includes the terminal session identifier if you set the EnableProperty parameter of EnableTraceEx to EVENT_ENABLE_PROPERTY_TS_ID.
EVENT_HEADER_EXT_TYPE_INSTANCE_INFO
The DataPtr member points to an EVENT_EXTENDED_ITEM_INSTANCE structure that contains the activity identifier if you called TraceEventInstance to write the event.
EVENT_HEADER_EXT_TYPE_STACK_TRACE32
The DataPtr member points to an EVENT_EXTENDED_ITEM_STACK_TRACE32 structure that contains the call stack if the event is captured on a 32-bit computer.
EVENT_HEADER_EXT_TYPE_STACK_TRACE64
The DataPtr member points to an EVENT_EXTENDED_ITEM_STACK_TRACE64 structure that contains the call stack if the event is captured on a 64-bit computer.
EVENT_HEADER_EXT_TYPE_EVENT_SCHEMA_TL
The DataPtr member points to an extended header item that contains TraceLogging event metadata information.
EVENT_HEADER_EXT_TYPE_PROV_TRAITS
The DataPtr member points to an extended header item that contains provider traits data, for example traits set through EventSetInformation(EventProviderSetTraits) or specified through EVENT_DATA_DESCRIPTOR_TYPE_PROVIDER_METADATA.
EVENT_HEADER_EXT_TYPE_EVENT_KEY
The DataPtr member points to an EVENT_EXTENDED_ITEM_EVENT_KEY structure that contains a unique event identifier which is a 64-bit scalar.

The EnablePropertyEVENT_ENABLE_PROPERTY_EVENT_KEY needs to be passed in for the EnableTrace call for a given provider to enable this feature.

EVENT_HEADER_EXT_TYPE_PROCESS_START_KEY
The DataPtr member points to an EVENT_EXTENDED_ITEM_PROCESS_START_KEY structure that contains a unique process identifier (unique across the boot session). This identifier is a 64-bit scalar.

The EnablePropertyEVENT_ENABLE_PROPERTY_PROCESS_START_KEY needs to be passed in for the EnableTrace call for a given provider to enable this feature.

Linkage

Reserved.

DataSize

Size, in bytes, of the extended data that DataPtr points to.

DataPtr

Pointer to the extended data. The ExtType member determines the type of extended data to which this member points.

Requirements

   
Minimum supported client Windows Vista [desktop apps only]
Minimum supported server Windows Server 2008 [desktop apps only]
Header relogger.h (include Evntcons.h)

See Also

EVENT_RECORD