EtwWriteString function (wdm.h)

Article
02/25/2022

The EventWriteString function is a tracing function that you can use when no sophisticated data is required. This function is similar to a debug print statement.

Syntax

NTSTATUS EtwWriteString(
  [in]           REGHANDLE RegHandle,
  [in]           UCHAR     Level,
  [in]           ULONGLONG Keyword,
  [in, optional] LPCGUID   ActivityId,
  [in]           PCWSTR    String
);

Parameters

[in] RegHandle

A Pointer to the event provider registration handle, which is returned by the EtwRegister function if the event provider registration is successful.

[in] Level

The level at which the event is active.

[in] Keyword

The keyword for the event. A keyword is a bitmask that makes general statements about the category of the event or error. Because the keyword is a bitmask, you can apply more than one keyword to a single event. You can define the keywords and bit positions, or you can use Windows-standard keywords, or you can use combination of your own keywords and the Windows keywords.

[in, optional] ActivityId

The identifier that indicates the activity associated with the event. The ActivityId provides a way to group related events and is used in end-to-end tracing. This identifier is optional and can be NULL.

[in] String

A null-terminated string (WCHAR).

Return value

The function returns STATUS_SUCCESS if the event is published successfully.

Remarks

Because the string produced by EventWriteString function is not localizable, this function is not recommended for use in production code. This function should not be used to log highly visible events.

You can call EtwWriteString at any IRQL. However, when IRQL is greater than APC_LEVEL, any data passed to the EtwWrite, EtwWriteEx, EtwWriteString, and EtwWriteTransfer functions must not be pageable. That is, any kernel-mode routine that is running at IRQL greater than APC_LEVEL cannot access pageable memory. Data passed to the EtwWrite, EtwWriteEx, EtwWriteString, and EtwWriteTransfer functions must reside in system-space memory, regardless of what the IRQL is.

Requirements

Requirement	Value
Minimum supported client	Available in Windows Vista and later versions of Windows.
Target Platform	Universal
Header	wdm.h (include Wdm.h, Ntddk.h)
Library	NtosKrnl.lib
DLL	NtosKrnl.exe
IRQL	Any level (See Comments section.)