Edit

EtwSetInformation function (wdm.h)

  • Article

The EtwSetInformation provides special-purpose information to modify a kernel-mode ETW provider registration. The EtwSetInformation function is the kernel-mode equivalent of the EventSetInformation function.

Syntax

NTSTATUS EtwSetInformation(
  [in]           REGHANDLE        RegHandle,
  [in]           EVENT_INFO_CLASS InformationClass,
  [in, optional] PVOID            EventInformation,
  [in]           ULONG            InformationLength
);

Parameters

[in] RegHandle

The registration handle of the ETW provider to modify. The registration handle is returned by EtwRegister.

[in] InformationClass

The type (EVENT_INFO_CLASS) of operation to perform on the registration object.

[in, optional] EventInformation

The input buffer.

[in] InformationLength

Size of the input buffer.

Return value

If the function succeeds, the return value is STATUS_SUCCESS.

Return code Description
STATUS_INVALID_HANDLE This error is returned if the RegHandle parameter is not a valid registration handle.
STATUS_INVALID_PARAMETER One or more of the parameters is not valid.
STATUS_INVALID_DEVICE_REQUEST The request is not supported.

Requirements

Requirement Value
Minimum supported client Available in Windows 10 and later versions of Windows.
Target Platform Universal
Header wdm.h (include Wdm.h)
Library NtosKrnl.lib
IRQL PASSIVE_LEVEL

See also

EventSetInformation

EVENT_INFO_CLASS