Using Flags with Your Events
Other versions of this page are also available for the following:
.gif "A hyphen indicates that the information in this topic is not relevant for this platform, or that the platform does not support the API that is listed.")
.gif "A checkmark indicates that the information in this topic is relevant for this platform, and that any API listed is also supported on this platform.")
8/27/2008
The CeLogData function allows you to specify two values, fFlagged and wFlag, that you can use to attach a small amount of additional information to your events. The fFlagged value indicates whether to attach a flag to the event, and the wFlag parameter contains the flag when fFlagged is TRUE.
The flags are not used by the system; you can set an event flag to any value you like. For example, you can use flags to attach an additional 16-bit value to your data, or use flags to identify the source of a logging call. For example, if you log identical data from two different places in your code, consider using flags to indicate which CeLogData call logged the data.
The following code shows an example of flag usage with CeLogData. The example logs a DWORD value in a CELID_RAW_ULONG event several times, and uses flag values to separate the calls. In this example, there are two CeLogData calls that would be identical if not for the flag.
DWORD dwIndex;
DWORD dwValue = 47;
for (dwIndex = 0; dwIndex < 3; dwIndex++) {
// The first call sets the fFlagged parameter to TRUE, and sets wFlag to 1
CeLogData(TRUE, CELID_RAW_ULONG, &dwValue, sizeof(DWORD),
0, CELZONE_ALWAYSON, 1, TRUE);
dwValue += 7;
// The second call sets the next fFlagged parameter to TRUE, and sets wFlag to 2
CeLogData(TRUE, CELID_RAW_ULONG, &dwValue, sizeof(DWORD),
0, CELZONE_ALWAYSON, 2, TRUE);
}
The Readlog output of this code example shows the flag value in each event header.
0:00:22.404.387 : (Flag 1) Raw data 1 (ulong)
47 = 0x0000002F
0:00:22.404.400 : (Flag 2) Raw data 1 (ulong)
54 = 0x00000036
0:00:22.404.410 : (Flag 1) Raw data 1 (ulong)
54 = 0x00000036
0:00:22.404.422 : (Flag 2) Raw data 1 (ulong)
61 = 0x0000003D
0:00:22.404.435 : (Flag 1) Raw data 1 (ulong)
61 = 0x0000003D
0:00:22.404.446 : (Flag 2) Raw data 1 (ulong)
68 = 0x00000044
Remote Kernel Tracker does not display flag values. To view the flags on your events, you must use the Readlog viewing tool.
See Also
Tasks
Capturing Events With Custom Data Structures
Concepts
Logging Events Using Pre-Defined Data Types