PEVENT_CALLBACK callback function

Consumers implement this function to receive events from a session.

The PEVENT_CALLBACK type defines a pointer to this callback function. EventCallback is a placeholder for the application-defined function name.


VOID WINAPI EventCallback(
  _In_ PEVENT_TRACE pEvent


pEvent [in]

Pointer to an EVENT_TRACE structure that contains the event information.

Return value

The function does not return a value.


To specify the function that ETW calls to deliver the events, set the EventCallback member of the EVENT_TRACE_LOGFILE structure that you pass to the OpenTrace function.

This callback receives all events that the session generates from the time you call the OpenTrace function to open the trace. Call the ProcessTrace function to begin receiving the events.

The event data for the first event you always receive contains the TRACE_LOGFILE_HEADER information.

All the other events you receive contain provider-specific event data. You use the Header.Guid and Header.Class.Type members of EVENT_TRACE to determine the type of event you received. If you are consuming events from your own provider and know the layout of the data, this is not an issue. Otherwise, to interpret the event, the provider must have published their event schema in the \\root\wmi namespace. For information on using an event's MOF schema to interpret the event, see Consuming Events.


For an example implementation of an EventCallback function, see Retrieving Event Data Using MOF.


Minimum supported client
Windows 2000 Professional [desktop apps only]
Minimum supported server
Windows 2000 Server [desktop apps only]

See also