able/windows-nt
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity
windows-nt/Source/XPSP1/NT/base/published/evntrace.h
CryptoAlgo Inc b3cac27891 Add source files
2020-09-26 16:20:57 +08:00

1080 lines
30 KiB
C
Raw Permalink Blame History

/*++
Copyright (c) Microsoft Corporation. All rights reserved.
Module Name:
EvnTrace.h
Abstract:
Public headers for event tracing control applications,
consumers and providers
--*/
#ifndef _EVNTRACE_
#define _EVNTRACE_
#if defined(_WINNT_) || defined(WINNT)
#ifndef WMIAPI
#ifndef MIDL_PASS
#ifdef _WMI_SOURCE_
#define WMIAPI __stdcall
#else
#define WMIAPI DECLSPEC_IMPORT __stdcall
#endif // _WMI_SOURCE
#endif // MIDL_PASS
#endif // WMIAPI
#include <guiddef.h>
//
// EventTraceGuid is used to identify a event tracing session
//
DEFINE_GUID ( /* 68fdd900-4a3e-11d1-84f4-0000f80464e3 */
EventTraceGuid,
0x68fdd900,
0x4a3e,
0x11d1,
0x84, 0xf4, 0x00, 0x00, 0xf8, 0x04, 0x64, 0xe3
);
//
// SystemTraceControlGuid. Used to specify event tracing for kernel
//
DEFINE_GUID ( /* 9e814aad-3204-11d2-9a82-006008a86939 */
SystemTraceControlGuid,
0x9e814aad,
0x3204,
0x11d2,
0x9a, 0x82, 0x00, 0x60, 0x08, 0xa8, 0x69, 0x39
);
//
//EventTraceConfigGuid. Used to report hardware configuration records
//
DEFINE_GUID ( /* 01853a65-418f-4f36-aefc-dc0f1d2fd235 */
EventTraceConfigGuid,
0x01853a65,
0x418f,
0x4f36,
0xae, 0xfc, 0xdc, 0x0f, 0x1d, 0x2f, 0xd2, 0x35
);
#define KERNEL_LOGGER_NAMEW L"NT Kernel Logger"
#define GLOBAL_LOGGER_NAMEW L"GlobalLogger"
#define EVENT_LOGGER_NAMEW L"Event Log"
#define KERNEL_LOGGER_NAMEA "NT Kernel Logger"
#define GLOBAL_LOGGER_NAMEA "GlobalLogger"
#define EVENT_LOGGER_NAMEA "Event Log"
#define MAX_MOF_FIELDS 16 // Limit of USE_MOF_PTR fields
typedef ULONG64 TRACEHANDLE, *PTRACEHANDLE;
//
// predefined generic event types (0x00 to 0x09 reserved).
//
#define EVENT_TRACE_TYPE_INFO 0x00 // Info or point event
#define EVENT_TRACE_TYPE_START 0x01 // Start event
#define EVENT_TRACE_TYPE_END 0x02 // End event
#define EVENT_TRACE_TYPE_DC_START 0x03 // Collection start marker
#define EVENT_TRACE_TYPE_DC_END 0x04 // Collection end marker
#define EVENT_TRACE_TYPE_EXTENSION 0x05 // Extension/continuation
#define EVENT_TRACE_TYPE_REPLY 0x06 // Reply event
#define EVENT_TRACE_TYPE_DEQUEUE 0x07 // De-queue event
#define EVENT_TRACE_TYPE_CHECKPOINT 0x08 // Generic checkpoint event
#define EVENT_TRACE_TYPE_RESERVED9 0x09
//
// Event types for Process & Threads
//
#define EVENT_TRACE_TYPE_LOAD 0x0A // Load image
//
// Event types for IO subsystem
//
#define EVENT_TRACE_TYPE_IO_READ 0x0A
#define EVENT_TRACE_TYPE_IO_WRITE 0x0B
//
// Event types for Memory subsystem
//
#define EVENT_TRACE_TYPE_MM_TF 0x0A // Transition fault
#define EVENT_TRACE_TYPE_MM_DZF 0x0B // Demand Zero fault
#define EVENT_TRACE_TYPE_MM_COW 0x0C // Copy on Write
#define EVENT_TRACE_TYPE_MM_GPF 0x0D // Guard Page fault
#define EVENT_TRACE_TYPE_MM_HPF 0x0E // Hard page fault
//
// Event types for Network subsystem, all protocols
//
#define EVENT_TRACE_TYPE_SEND 0x0A // Send
#define EVENT_TRACE_TYPE_RECEIVE 0x0B // Receive
#define EVENT_TRACE_TYPE_CONNECT 0x0C // Connect
#define EVENT_TRACE_TYPE_DISCONNECT 0x0D // Disconnect
#define EVENT_TRACE_TYPE_RETRANSMIT 0x0E // ReTransmit
#define EVENT_TRACE_TYPE_ACCEPT 0x0F // Accept
#define EVENT_TRACE_TYPE_RECONNECT 0x10 // ReConnect
//
// Event Types for the Header (to handle internal event headers)
//
#define EVENT_TRACE_TYPE_GUIDMAP 0x0A
#define EVENT_TRACE_TYPE_CONFIG 0x0B
#define EVENT_TRACE_TYPE_SIDINFO 0x0C
#define EVENT_TRACE_TYPE_SECURITY 0x0D
//
// Event types for Registry subsystem
//
#define EVENT_TRACE_TYPE_REGCREATE 0x0A // NtCreateKey
#define EVENT_TRACE_TYPE_REGOPEN 0x0B // NtOpenKey
#define EVENT_TRACE_TYPE_REGDELETE 0x0C // NtDeleteKey
#define EVENT_TRACE_TYPE_REGQUERY 0x0D // NtQueryKey
#define EVENT_TRACE_TYPE_REGSETVALUE 0x0E // NtSetValueKey
#define EVENT_TRACE_TYPE_REGDELETEVALUE 0x0F // NtDeleteValueKey
#define EVENT_TRACE_TYPE_REGQUERYVALUE 0x10 // NtQueryValueKey
#define EVENT_TRACE_TYPE_REGENUMERATEKEY 0x11 // NtEnumerateKey
#define EVENT_TRACE_TYPE_REGENUMERATEVALUEKEY 0x12 // NtEnumerateValueKey
#define EVENT_TRACE_TYPE_REGQUERYMULTIPLEVALUE 0x13 // NtQueryMultipleValueKey
#define EVENT_TRACE_TYPE_REGSETINFORMATION 0x14 // NtSetInformationKey
#define EVENT_TRACE_TYPE_REGFLUSH 0x15 // NtFlushKey
#define EVENT_TRACE_TYPE_REGKCBDMP 0x16 // KcbDump/create
//
// Event types for system configuration records
//
#define EVENT_TRACE_TYPE_CONFIG_CPU 0x0A // CPU Configuration
#define EVENT_TRACE_TYPE_CONFIG_PHYSICALDISK 0x0B // Physical Disk Configuration
#define EVENT_TRACE_TYPE_CONFIG_LOGICALDISK 0x0C // Logical Disk Configuration
#define EVENT_TRACE_TYPE_CONFIG_NIC 0x0D // NIC Configuration
#define EVENT_TRACE_TYPE_CONFIG_VIDEO 0x0E // Video Adapter Configuration
#define EVENT_TRACE_TYPE_CONFIG_SERVICES 0x0F // Active Services
#define EVENT_TRACE_TYPE_CONFIG_POWER 0x10 // ACPI Configuration
//
// Enable flags for SystemControlGuid only
//
#define EVENT_TRACE_FLAG_PROCESS 0x00000001 // process start & end
#define EVENT_TRACE_FLAG_THREAD 0x00000002 // thread start & end
#define EVENT_TRACE_FLAG_IMAGE_LOAD 0x00000004 // image load
#define EVENT_TRACE_FLAG_DISK_IO 0x00000100 // physical disk IO
#define EVENT_TRACE_FLAG_DISK_FILE_IO 0x00000200 // requires disk IO
#define EVENT_TRACE_FLAG_MEMORY_PAGE_FAULTS 0x00001000 // all page faults
#define EVENT_TRACE_FLAG_MEMORY_HARD_FAULTS 0x00002000 // hard faults only
#define EVENT_TRACE_FLAG_NETWORK_TCPIP 0x00010000 // tcpip send & receive
#define EVENT_TRACE_FLAG_REGISTRY 0x00020000 // registry calls
#define EVENT_TRACE_FLAG_DBGPRINT 0x00040000 // DbgPrint(ex) Calls
//
// Pre-defined Enable flags for everybody else
//
#define EVENT_TRACE_FLAG_EXTENSION 0x80000000 // indicates more flags
#define EVENT_TRACE_FLAG_FORWARD_WMI 0x40000000 // Can forward to WMI
#define EVENT_TRACE_FLAG_ENABLE_RESERVE 0x20000000 // Reserved
//
// Logger Mode flags
//
#define EVENT_TRACE_FILE_MODE_NONE 0x00000000 // logfile is off
#define EVENT_TRACE_FILE_MODE_SEQUENTIAL 0x00000001 // log sequentially
#define EVENT_TRACE_FILE_MODE_CIRCULAR 0x00000002 // log in circular manner
#define EVENT_TRACE_FILE_MODE_APPEND 0x00000004 // append sequential log
#define EVENT_TRACE_FILE_MODE_NEWFILE 0x00000008 // auto-switch log file
#define EVENT_TRACE_FILE_MODE_PREALLOCATE 0x00000020 // pre-allocate mode
#define EVENT_TRACE_REAL_TIME_MODE 0x00000100 // real time mode on
#define EVENT_TRACE_DELAY_OPEN_FILE_MODE 0x00000200 // delay opening file
#define EVENT_TRACE_BUFFERING_MODE 0x00000400 // buffering mode only
#define EVENT_TRACE_PRIVATE_LOGGER_MODE 0x00000800 // Process Private Logger
#define EVENT_TRACE_ADD_HEADER_MODE 0x00001000 // Add a logfile header
#define EVENT_TRACE_USE_GLOBAL_SEQUENCE 0x00004000 // Use global sequence no.
#define EVENT_TRACE_USE_LOCAL_SEQUENCE 0x00008000 // Use local sequence no.
#define EVENT_TRACE_RELOG_MODE 0x00010000 // Relogger
#define EVENT_TRACE_USE_PAGED_MEMORY 0x01000000 // Use pageable buffers
//
// internal control codes used.
//
#define EVENT_TRACE_CONTROL_QUERY 0
#define EVENT_TRACE_CONTROL_STOP 1
#define EVENT_TRACE_CONTROL_UPDATE 2
#define EVENT_TRACE_CONTROL_FLUSH 3 // Flushes all the buffers
//
// Flags used by WMI Trace Message
// Note that the order or value of these flags should NOT be changed as they are processed
// in this order.
//
#define TRACE_MESSAGE_SEQUENCE 1 // Message should include a sequence number
#define TRACE_MESSAGE_GUID 2 // Message includes a GUID
#define TRACE_MESSAGE_COMPONENTID 4 // Message has no GUID, Component ID instead
#define TRACE_MESSAGE_TIMESTAMP 8 // Message includes a timestamp
#define TRACE_MESSAGE_PERFORMANCE_TIMESTAMP 16 // Timestamp is the Performance Counter not the system clock
#define TRACE_MESSAGE_SYSTEMINFO 32 // Message includes system information TID,PID
#define TRACE_MESSAGE_FLAG_MASK 0xFFFF // Only the lower 16 bits of flags are placed in the message
// those above 16 bits are reserved for local processing
#define TRACE_MESSAGE_MAXIMUM_SIZE 8*1024 // the maximum size allowed for a single trace message
// longer messages will return ERROR_BUFFER_OVERFLOW
//
// Flags to indicate to consumer which fields
// in the EVENT_TRACE_HEADER are valid
//
#define EVENT_TRACE_USE_PROCTIME 0x0001 // ProcessorTime field is valid
#define EVENT_TRACE_USE_NOCPUTIME 0x0002 // No Kernel/User/Processor Times
#if _MSC_VER >= 1200
#pragma warning(push)
#endif
#pragma warning (disable:4201)
//
// Trace header for all (except kernel) events. This is used to overlay
// to bottom part of WNODE_HEADER to conserve space.
//
typedef struct _EVENT_TRACE_HEADER { // overlays WNODE_HEADER
USHORT Size; // Size of entire record
union {
USHORT FieldTypeFlags; // Indicates valid fields
struct {
UCHAR HeaderType; // Header type - internal use only
UCHAR MarkerFlags; // Marker - internal use only
};
};
union {
ULONG Version;
struct {
UCHAR Type; // event type
UCHAR Level; // trace instrumentation level
USHORT Version; // version of trace record
} Class;
};
ULONG ThreadId; // Thread Id
ULONG ProcessId; // Process Id
LARGE_INTEGER TimeStamp; // time when event happens
union {
GUID Guid; // Guid that identifies event
ULONGLONG GuidPtr; // use with WNODE_FLAG_USE_GUID_PTR
};
union {
struct {
ULONG ClientContext; // Reserved
ULONG Flags; // Flags for header
};
struct {
ULONG KernelTime; // Kernel Mode CPU ticks
ULONG UserTime; // User mode CPU ticks
};
ULONG64 ProcessorTime; // Processor Clock
};
} EVENT_TRACE_HEADER, *PEVENT_TRACE_HEADER;
//
// This header is used to trace and track transaction co-relations
//
typedef struct _EVENT_INSTANCE_HEADER {
USHORT Size;
union {
USHORT FieldTypeFlags; // Indicates valid fields
struct {
UCHAR HeaderType; // Header type - internal use only
UCHAR MarkerFlags; // Marker - internal use only
};
};
union {
ULONG Version;
struct {
UCHAR Type;
UCHAR Level;
USHORT Version;
} Class;
};
ULONG ThreadId;
ULONG ProcessId;
LARGE_INTEGER TimeStamp;
ULONGLONG RegHandle;
ULONG InstanceId;
ULONG ParentInstanceId;
union {
struct {
ULONG ClientContext; // Reserved
ULONG Flags; // Flags for header
};
struct {
ULONG KernelTime; // Kernel Mode CPU ticks
ULONG UserTime; // User mode CPU ticks
};
ULONG64 ProcessorTime; // Processor Clock
};
ULONGLONG ParentRegHandle;
} EVENT_INSTANCE_HEADER, *PEVENT_INSTANCE_HEADER;
//
// Following are structures and macros for use with USE_MOF_PTR
//
#define DEFINE_TRACE_MOF_FIELD(MOF, ptr, length, type) \
(MOF)->DataPtr = (ULONG64) ptr; \
(MOF)->Length = (ULONG) length; \
(MOF)->DataType = (ULONG) type;
typedef struct _MOF_FIELD {
ULONG64 DataPtr; // Pointer to the field. Up to 64-bits only
ULONG Length; // Length of the MOF field
ULONG DataType; // Type of data
} MOF_FIELD, *PMOF_FIELD;
#if !defined(_NTDDK_) || defined(_WMIKM_)
//
// This is the header for every logfile. The memory for LoggerName
// and LogFileName must be contiguous adjacent to this structure
// Allows both user-mode and kernel-mode to understand the header
//
typedef struct _TRACE_LOGFILE_HEADER {
ULONG BufferSize; // Logger buffer size in Kbytes
union {
ULONG Version; // Logger version
struct {
UCHAR MajorVersion;
UCHAR MinorVersion;
UCHAR SubVersion;
UCHAR SubMinorVersion;
} VersionDetail;
};
ULONG ProviderVersion; // defaults to NT version
ULONG NumberOfProcessors; // Number of Processors
LARGE_INTEGER EndTime; // Time when logger stops
ULONG TimerResolution; // assumes timer is constant!!!
ULONG MaximumFileSize; // Maximum in Mbytes
ULONG LogFileMode; // specify logfile mode
ULONG BuffersWritten; // used to file start of Circular File
union {
GUID LogInstanceGuid; // For RealTime Buffer Delivery
struct {
ULONG StartBuffers; // Count of buffers written at start.
ULONG PointerSize; // Size of pointer type in bits
ULONG EventsLost; // Events losts during log session
ULONG CpuSpeedInMHz; // Cpu Speed in MHz
};
};
#if defined(_WMIKM_)
PWCHAR LoggerName;
PWCHAR LogFileName;
RTL_TIME_ZONE_INFORMATION TimeZone;
#else
LPWSTR LoggerName;
LPWSTR LogFileName;
TIME_ZONE_INFORMATION TimeZone;
#endif
LARGE_INTEGER BootTime;
LARGE_INTEGER PerfFreq; // Reserved
LARGE_INTEGER StartTime; // Reserved
ULONG ReservedFlags; // Reserved
ULONG BuffersLost;
} TRACE_LOGFILE_HEADER, *PTRACE_LOGFILE_HEADER;
#endif // !_NTDDK_ || _WMIKM_
//
// Instance Information to track parent child relationship of Instances.
//
typedef struct EVENT_INSTANCE_INFO {
HANDLE RegHandle;
ULONG InstanceId;
} EVENT_INSTANCE_INFO, *PEVENT_INSTANCE_INFO;
#if !defined(_WMIKM_) && !defined(_NTDDK_)
//
// Structures that have UNICODE and ANSI versions are defined here
//
//
// Logger configuration and running statistics. This structure is used
// by user-mode callers, such as PDH library
//
typedef struct _EVENT_TRACE_PROPERTIES {
WNODE_HEADER Wnode;
//
// data provided by caller
ULONG BufferSize; // buffer size for logging (kbytes)
ULONG MinimumBuffers; // minimum to preallocate
ULONG MaximumBuffers; // maximum buffers allowed
ULONG MaximumFileSize; // maximum logfile size (in MBytes)
ULONG LogFileMode; // sequential, circular
ULONG FlushTimer; // buffer flush timer, in seconds
ULONG EnableFlags; // trace enable flags
LONG AgeLimit; // age decay time, in minutes
// data returned to caller
ULONG NumberOfBuffers; // no of buffers in use
ULONG FreeBuffers; // no of buffers free
ULONG EventsLost; // event records lost
ULONG BuffersWritten; // no of buffers written to file
ULONG LogBuffersLost; // no of logfile write failures
ULONG RealTimeBuffersLost; // no of rt delivery failures
HANDLE LoggerThreadId; // thread id of Logger
ULONG LogFileNameOffset; // Offset to LogFileName
ULONG LoggerNameOffset; // Offset to LoggerName
} EVENT_TRACE_PROPERTIES, *PEVENT_TRACE_PROPERTIES;
// NOTE:
// If AgeLimit is 0, default is used
// If AgeLimit is < 0, buffer aging is turned off
typedef struct _TRACE_GUID_PROPERTIES {
GUID Guid;
ULONG GuidType;
ULONG LoggerId;
ULONG EnableLevel;
ULONG EnableFlags;
BOOLEAN IsEnable;
} TRACE_GUID_PROPERTIES, *PTRACE_GUID_PROPERTIES;
//
// Data Provider structures
//
// Used by RegisterTraceGuids()
typedef struct _TRACE_GUID_REGISTRATION {
LPCGUID Guid; // Guid of data block being registered or updated.
HANDLE RegHandle; // Guid Registration Handle is returned.
} TRACE_GUID_REGISTRATION, *PTRACE_GUID_REGISTRATION;
//
// Data consumer structures
//
// An EVENT_TRACE consists of a fixed header (EVENT_TRACE_HEADER) and
// optionally a variable portion pointed to by MofData. The datablock
// layout of the variable portion is unknown to the Logger and must
// be obtained from WBEM CIMOM database.
//
typedef struct _EVENT_TRACE {
EVENT_TRACE_HEADER Header; // Event trace header
ULONG InstanceId; // Instance Id of this event
ULONG ParentInstanceId; // Parent Instance Id.
GUID ParentGuid; // Parent Guid;
PVOID MofData; // Pointer to Variable Data
ULONG MofLength; // Variable Datablock Length
ULONG ClientContext; // Reserved
} EVENT_TRACE, *PEVENT_TRACE;
typedef struct _EVENT_TRACE_LOGFILEW
EVENT_TRACE_LOGFILEW, *PEVENT_TRACE_LOGFILEW;
typedef struct _EVENT_TRACE_LOGFILEA
EVENT_TRACE_LOGFILEA, *PEVENT_TRACE_LOGFILEA;
typedef ULONG (WINAPI * PEVENT_TRACE_BUFFER_CALLBACKW)
(PEVENT_TRACE_LOGFILEW Logfile);
typedef ULONG (WINAPI * PEVENT_TRACE_BUFFER_CALLBACKA)
(PEVENT_TRACE_LOGFILEA Logfile);
typedef VOID (WINAPI *PEVENT_CALLBACK)( PEVENT_TRACE pEvent );
//
// Prototype for service request callback. Data providers register with WMI
// by passing a service request callback function that is called for all
// wmi requests.
typedef ULONG (
#ifndef MIDL_PASS
WINAPI
#endif
*WMIDPREQUEST)(
IN WMIDPREQUESTCODE RequestCode,
IN PVOID RequestContext,
IN OUT ULONG *BufferSize,
IN OUT PVOID Buffer
);
struct _EVENT_TRACE_LOGFILEW {
LPWSTR LogFileName; // Logfile Name
LPWSTR LoggerName; // LoggerName
LONGLONG CurrentTime; // timestamp of last event
ULONG BuffersRead; // buffers read to date
ULONG LogFileMode; // Mode of the logfile
EVENT_TRACE CurrentEvent; // Current Event from this stream.
TRACE_LOGFILE_HEADER LogfileHeader; // logfile header structure
PEVENT_TRACE_BUFFER_CALLBACKW // callback before each buffer
BufferCallback; // is read
//
// following variables are filled for BufferCallback.
//
ULONG BufferSize;
ULONG Filled;
ULONG EventsLost;
//
// following needs to be propaged to each buffer
//
PEVENT_CALLBACK EventCallback; // callback for every event
ULONG IsKernelTrace; // TRUE for kernel logfile
PVOID Context; // reserved for internal use
};
struct _EVENT_TRACE_LOGFILEA {
LPSTR LogFileName; // Logfile Name
LPSTR LoggerName; // LoggerName
LONGLONG CurrentTime; // timestamp of last event
ULONG BuffersRead; // buffers read to date
ULONG LogFileMode; // LogFile Mode.
EVENT_TRACE CurrentEvent; // Current Event from this stream
TRACE_LOGFILE_HEADER LogfileHeader; // logfile header structure
PEVENT_TRACE_BUFFER_CALLBACKA // callback before each buffer
BufferCallback; // is read
//
// following variables are filled for BufferCallback.
//
ULONG BufferSize;
ULONG Filled;
ULONG EventsLost;
//
// following needs to be propaged to each buffer
//
PEVENT_CALLBACK EventCallback; // callback for every event
ULONG IsKernelTrace; // TRUE for kernel logfile
PVOID Context; // reserved for internal use
};
//
// Define generic structures
//
#if defined(_UNICODE) || defined(UNICODE)
#define PEVENT_TRACE_BUFFER_CALLBACK PEVENT_TRACE_BUFFER_CALLBACKW
#define EVENT_TRACE_LOGFILE EVENT_TRACE_LOGFILEW
#define PEVENT_TRACE_LOGFILE PEVENT_TRACE_LOGFILEW
#define KERNEL_LOGGER_NAME KERNEL_LOGGER_NAMEW
#define GLOBAL_LOGGER_NAME GLOBAL_LOGGER_NAMEW
#define EVENT_LOGGER_NAME EVENT_LOGGER_NAMEW
#else
#define PEVENT_TRACE_BUFFER_CALLBACK PEVENT_TRACE_BUFFER_CALLBACKA
#define EVENT_TRACE_LOGFILE EVENT_TRACE_LOGFILEA
#define PEVENT_TRACE_LOGFILE PEVENT_TRACE_LOGFILEA
#define KERNEL_LOGGER_NAME KERNEL_LOGGER_NAMEA
#define GLOBAL_LOGGER_NAME GLOBAL_LOGGER_NAMEA
#define EVENT_LOGGER_NAME EVENT_LOGGER_NAMEA
#endif
#if _MSC_VER >= 1200
#pragma warning(pop)
#endif
#ifdef __cplusplus
extern "C" {
#endif
//
// Logger control APIs
//
//
// Use the routine below to start an event trace session
//
// ULONG
// StartTrace(
// OUT PTRACEHANDLE TraceHandle,
// IN LPTSTR InstanceName,
// IN OUT PEVENT_TRACE_PROPERTIES Properties
// );
EXTERN_C
ULONG
WMIAPI
StartTraceW(
OUT PTRACEHANDLE TraceHandle,
IN LPCWSTR InstanceName,
IN OUT PEVENT_TRACE_PROPERTIES Properties
);
EXTERN_C
ULONG
WMIAPI
StartTraceA(
OUT PTRACEHANDLE TraceHandle,
IN LPCSTR InstanceName,
IN OUT PEVENT_TRACE_PROPERTIES Properties
);
//
// Use the routine below to stop an event trace session
//
//
// ULONG
// StopTrace(
// IN TRACEHANDLE TraceHandle,
// IN LPTSTR InstanceName,
// IN OUT PEVENT_TRACE_PROPERTIES Properties
// );
EXTERN_C
ULONG
WMIAPI
StopTraceW(
IN TRACEHANDLE TraceHandle,
IN LPCWSTR InstanceName,
IN OUT PEVENT_TRACE_PROPERTIES Properties
);
EXTERN_C
ULONG
WMIAPI
StopTraceA(
IN TRACEHANDLE TraceHandle,
IN LPCSTR InstanceName,
IN OUT PEVENT_TRACE_PROPERTIES Properties
);
//
// Use the routine below to query the properties of an event trace session
//
// ULONG
// QueryTrace(
// IN TRACEHANDLE TraceHandle,
// IN LPTSTR InstanceName,
// IN OUT PEVENT_TRACE_PROPERTIES Properties
// );
EXTERN_C
ULONG
WMIAPI
QueryTraceW(
IN TRACEHANDLE TraceHandle,
IN LPCWSTR InstanceName,
IN OUT PEVENT_TRACE_PROPERTIES Properties
);
EXTERN_C
ULONG
WMIAPI
QueryTraceA(
IN TRACEHANDLE TraceHandle,
IN LPCSTR InstanceName,
IN OUT PEVENT_TRACE_PROPERTIES Properties
);
//
// Use the routine below to update certain properties of an event trace session
//
// ULONG
// UpdateTrace(
// IN (PTRACEHANDLE TraceHandle,
// IN LPTSTR InstanceName,
// IN OUT PEVENT_TRACE_PROPERTIES Properties
// );
EXTERN_C
ULONG
WMIAPI
UpdateTraceW(
IN TRACEHANDLE TraceHandle,
IN LPCWSTR InstanceName,
IN OUT PEVENT_TRACE_PROPERTIES Properties
);
EXTERN_C
ULONG
WMIAPI
UpdateTraceA(
IN TRACEHANDLE TraceHandle,
IN LPCSTR InstanceName,
IN OUT PEVENT_TRACE_PROPERTIES Properties
);
//
// Use the routine below to request that all active buffers an event trace
// session be "flushed", or written out.
//
#if (WINVER >= 0x0501)
// ULONG
// FlushTrace(
// IN TRACEHANDLE TraceHandle,
// IN LPTSTR InstanceName,
// IN OUT PEVENT_TRACE_PROPERTIES Properties
// );
EXTERN_C
ULONG
WMIAPI
FlushTraceW(
IN TRACEHANDLE TraceHandle,
IN LPCWSTR InstanceName,
IN OUT PEVENT_TRACE_PROPERTIES Properties
);
EXTERN_C
ULONG
WMIAPI
FlushTraceA(
IN TRACEHANDLE TraceHandle,
IN LPCSTR InstanceName,
IN OUT PEVENT_TRACE_PROPERTIES Properties
);
#endif
//
// Generic trace control routine
//
EXTERN_C
ULONG
WMIAPI
ControlTraceW(
IN TRACEHANDLE TraceHandle,
IN LPCWSTR InstanceName,
IN OUT PEVENT_TRACE_PROPERTIES Properties,
IN ULONG ControlCode
);
EXTERN_C
ULONG
WMIAPI
ControlTraceA(
IN TRACEHANDLE TraceHandle,
IN LPCSTR InstanceName,
IN OUT PEVENT_TRACE_PROPERTIES Properties,
IN ULONG ControlCode
);
//
// ULONG
// QueryAllTraces(
// OUT PEVENT_TRACE_PROPERTIES *PropertyArray,
// IN ULONG PropertyArrayCount,
// OUT PULONG LoggerCount
// );
//
EXTERN_C
ULONG
WMIAPI
QueryAllTracesW(
OUT PEVENT_TRACE_PROPERTIES *PropertyArray,
IN ULONG PropertyArrayCount,
OUT PULONG LoggerCount
);
EXTERN_C
ULONG
WMIAPI
QueryAllTracesA(
OUT PEVENT_TRACE_PROPERTIES *PropertyArray,
IN ULONG PropertyArrayCount,
OUT PULONG LoggerCount
);
//
// Data Provider APIs
//
EXTERN_C
ULONG
WMIAPI
CreateTraceInstanceId(
IN HANDLE RegHandle,
IN OUT PEVENT_INSTANCE_INFO pInstInfo
);
EXTERN_C
ULONG
WMIAPI
EnableTrace(
IN ULONG Enable,
IN ULONG EnableFlag,
IN ULONG EnableLevel,
IN LPCGUID ControlGuid,
IN TRACEHANDLE TraceHandle
);
//
// Use the routine below to generate and record an event trace
//
EXTERN_C
ULONG
WMIAPI
TraceEvent(
IN TRACEHANDLE TraceHandle,
IN PEVENT_TRACE_HEADER EventTrace
);
EXTERN_C
ULONG
WMIAPI
TraceEventInstance(
IN TRACEHANDLE TraceHandle,
IN PEVENT_INSTANCE_HEADER EventTrace,
IN PEVENT_INSTANCE_INFO pInstInfo,
IN PEVENT_INSTANCE_INFO pParentInstInfo
);
//
// Use the routine below to register a guid for tracing
//
//
// ULONG
// RegisterTraceGuids(
// IN WMIDPREQUEST RequestAddress,
// IN PVOID RequestContext,
// IN LPCGUID ControlGuid,
// IN ULONG GuidCount,
// IN PTRACE_GUID_REGISTRATION TraceGuidReg,
// IN LPCTSTR MofImagePath,
// IN LPCTSTR MofResourceName,
// OUT PTRACEHANDLE RegistrationHandle
// );
//
EXTERN_C
ULONG
WMIAPI
RegisterTraceGuidsW(
IN WMIDPREQUEST RequestAddress,
IN PVOID RequestContext,
IN LPCGUID ControlGuid,
IN ULONG GuidCount,
IN PTRACE_GUID_REGISTRATION TraceGuidReg,
IN LPCWSTR MofImagePath,
IN LPCWSTR MofResourceName,
OUT PTRACEHANDLE RegistrationHandle
);
EXTERN_C
ULONG
WMIAPI
RegisterTraceGuidsA(
IN WMIDPREQUEST RequestAddress,
IN PVOID RequestContext,
IN LPCGUID ControlGuid,
IN ULONG GuidCount,
IN PTRACE_GUID_REGISTRATION TraceGuidReg,
IN LPCSTR MofImagePath,
IN LPCSTR MofResourceName,
OUT PTRACEHANDLE RegistrationHandle
);
#if (WINVER >= 0x0501)
EXTERN_C
ULONG
WMIAPI
EnumerateTraceGuids(
IN OUT PTRACE_GUID_PROPERTIES *GuidPropertiesArray,
IN ULONG PropertyArrayCount,
OUT PULONG GuidCount
);
#endif
EXTERN_C
ULONG
WMIAPI
UnregisterTraceGuids(
IN TRACEHANDLE RegistrationHandle
);
EXTERN_C
TRACEHANDLE
WMIAPI
GetTraceLoggerHandle(
IN PVOID Buffer
);
EXTERN_C
UCHAR
WMIAPI
GetTraceEnableLevel(
IN TRACEHANDLE TraceHandle
);
EXTERN_C
ULONG
WMIAPI
GetTraceEnableFlags(
IN TRACEHANDLE TraceHandle
);
//
// Data Consumer APIs and structures start here
//
//
// TRACEHANDLE
// OpenTrace(
// IN OUT PEVENT_TRACE_LOGFILE Logfile
// );
//
EXTERN_C
TRACEHANDLE
WMIAPI
OpenTraceA(
IN OUT PEVENT_TRACE_LOGFILEA Logfile
);
EXTERN_C
TRACEHANDLE
WMIAPI
OpenTraceW(
IN OUT PEVENT_TRACE_LOGFILEW Logfile
);
EXTERN_C
ULONG
WMIAPI
ProcessTrace(
IN PTRACEHANDLE HandleArray,
IN ULONG HandleCount,
IN LPFILETIME StartTime,
IN LPFILETIME EndTime
);
EXTERN_C
ULONG
WMIAPI
CloseTrace(
IN TRACEHANDLE TraceHandle
);
EXTERN_C
ULONG
WMIAPI
SetTraceCallback(
IN LPCGUID pGuid,
IN PEVENT_CALLBACK EventCallback
);
EXTERN_C
ULONG
WMIAPI
RemoveTraceCallback (
IN LPCGUID pGuid
);
//
// The routines for tracing Messages follow
//
EXTERN_C
ULONG
__cdecl
TraceMessage(
IN TRACEHANDLE LoggerHandle,
IN ULONG MessageFlags,
IN LPGUID MessageGuid,
IN USHORT MessageNumber,
...
);
EXTERN_C
ULONG
TraceMessageVa(
IN TRACEHANDLE LoggerHandle,
IN ULONG MessageFlags,
IN LPGUID MessageGuid,
IN USHORT MessageNumber,
IN va_list MessageArgList
);
#ifdef __cplusplus
} // extern "C"
#endif
//
//
// Define the encoding independent routines
//
#if defined(UNICODE) || defined(_UNICODE)
#define RegisterTraceGuids RegisterTraceGuidsW
#define StartTrace StartTraceW
#define ControlTrace ControlTraceW
#if defined(__TRACE_W2K_COMPATIBLE)
#define StopTrace(a,b,c) ControlTraceW((a),(b),(c), \
EVENT_TRACE_CONTROL_STOP)
#define QueryTrace(a,b,c) ControlTraceW((a),(b),(c), \
EVENT_TRACE_CONTROL_QUERY)
#define UpdateTrace(a,b,c) ControlTraceW((a),(b),(c), \
EVENT_TRACE_CONTROL_UPDATE)
#else
#define StopTrace StopTraceW
#define QueryTrace QueryTraceW
#define UpdateTrace UpdateTraceW
#endif
#if (WINVER >= 0x0501)
#define FlushTrace FlushTraceW
#endif
#define QueryAllTraces QueryAllTracesW
#define OpenTrace OpenTraceW
#else
#define RegisterTraceGuids RegisterTraceGuidsA
#define StartTrace StartTraceA
#define ControlTrace ControlTraceA
#if defined(__TRACE_W2K_COMPATIBLE)
#define StopTrace(a,b,c) ControlTraceA((a),(b),(c), \
EVENT_TRACE_CONTROL_STOP)
#define QueryTrace(a,b,c) ControlTraceA((a),(b),(c), \
EVENT_TRACE_CONTROL_QUERY)
#define UpdateTrace(a,b,c) ControlTraceA((a),(b),(c), \
EVENT_TRACE_CONTROL_UPDATE)
#else
#define StopTrace StopTraceA
#define QueryTrace QueryTraceA
#define UpdateTrace UpdateTraceA
#endif
#if (WINVER >= 0x0501)
#define FlushTrace FlushTraceA
#endif
#define QueryAllTraces QueryAllTracesA
#define OpenTrace OpenTraceA
#endif // UNICODE
#endif /* _WMIKM_ && _NTDDK_ */
#endif // WINNT
#endif /* _EVNTRACE_ */
Reference in a new issue View git blame Copy permalink