Edit

EtwWriteTransfer function (wdm.h)

  • Article

The EtwWriteTransfer function marks an event that links two activities together; this type of event is referred to as a transfer event. A transfer event can contain the same user-defined data, the same fields, and is subject to the same rules as other events.

Syntax

NTSTATUS EtwWriteTransfer(
  [in]           REGHANDLE              RegHandle,
  [in]           PCEVENT_DESCRIPTOR     EventDescriptor,
  [in, optional] LPCGUID                ActivityId,
  [in, optional] LPCGUID                RelatedActivityId,
  [in]           ULONG                  UserDataCount,
  [in, optional] PEVENT_DATA_DESCRIPTOR UserData
);

Parameters

[in] RegHandle

A pointer to the event provider registration handle, which is returned by the EtwRegister function if the event provider registration is successful.

[in] EventDescriptor

A pointer to the EVENT_DESCRIPTOR structure.

[in, optional] ActivityId

The identifier that indicates the activity associated with the event. The ActivityId provides a way to group related events and is used in end-to-end tracing. This identifier is optional and can be NULL.

[in, optional] RelatedActivityId

The identifier that indicates related activity associated with the event. The RelatedActivityID provides a way to group related events and is used in end-to-end tracing.

[in] UserDataCount

The number of elements in an array of EVENT_DATA_DESCRIPTOR structures.

[in, optional] UserData

The pointer to the first element in an array of EVENT_DATA_DESCRIPTOR structures.

Return value

EtwWriteTransfer returns STATUS_SUCCESS if the event was successfully published.

Remarks

You can call EtwWriteTransfer at any IRQL. However, when IRQL is greater than APC_LEVEL, any data passed to the EtwWrite, EtwWriteString, EtwWriteTransfer functions must not be pageable. That is, any kernel-mode routine that is running at IRQL greater than APC_LEVEL cannot access pageable memory. Data passed to the EtwWrite, EtwWriteString, EtwWriteTransfer functions must reside in system-space memory, regardless of what the IRQL is.

Requirements

Requirement Value
Target Platform Universal
Header wdm.h (include Wdm.h, Ntddk.h)
Library NtosKrnl.lib
DLL NtosKrnl.exe; Ntdll.dll
IRQL Any level (see Comments section)

See also

EtwWrite

EtwWriteString