EventTrace_Header class

Article
01/07/2021

The event type class for the log file header event. This class contains information about the event tracing session.

The following syntax is simplified from MOF code.

Syntax

[EventType(0)]
class EventTrace_Header : EventTraceEvent
{
  uint32 BufferSize;
  uint32 Version;
  uint32 ProviderVersion;
  uint32 NumberOfProcessors;
  uint64 EndTime;
  uint32 TimerResolution;
  uint32 MaxFileSize;
  uint32 LogFileMode;
  uint32 BuffersWritten;
  uint32 StartBuffers;
  uint32 PointerSize;
  uint32 EventsLost;
  uint32 CPUSpeed;
  uint32 LoggerName;
  uint32 LogFileName;
  uint8  TimeZoneInformation[];
  uint64 BootTime;
  uint64 PerfFreq;
  uint64 StartTime;
  uint32 ReservedFlags;
  uint32 BuffersLost;
};

Members

The EventTrace_Header class has these types of members:

Properties

Properties

The EventTrace_Header class has these properties.

BootTime

Data type: uint64
Access type: Read-only
Qualifiers: WmiDataId (17)

Time at which the system was started, in 100-nanosecond intervals since midnight, January 1, 1601.

BufferSize

Data type: uint32
Access type: Read-only
Qualifiers: WmiDataId (1)

Size of the event tracing session's buffers, in kilobytes.

BuffersLost

Data type: uint32
Access type: Read-only
Qualifiers: WmiDataId (21)

Total number of buffers lost.

BuffersWritten

Data type: uint32
Access type: Read-only
Qualifiers: WmiDataId (9)

Total number of buffers written by the event tracing session.

CPUSpeed

Data type: uint32
Access type: Read-only
Qualifiers: WmiDataId (13)

CPU speed, in megahertz.

Windows 2000: Not supported.

EndTime

Data type: uint64
Access type: Read-only
Qualifiers: WmiDataId (5)

Time at which the event tracing session stopped, in 100-nanosecond intervals since midnight, January 1, 1601. This value may be 0 if you are consuming events in real time or from a log file to which the provide is still logging events.

EventsLost

Data type: uint32
Access type: Read-only
Qualifiers: WmiDataId (12)

Number of events lost during the event tracing session.

LogFileMode

Data type: uint32
Access type: Read-only
Qualifiers: WmiDataId (8), Format("x")

Current logging mode for the event tracing session. For a list of values, see Logging Mode Constants.

LogFileName

Data type: uint32
Access type: Read-only
Qualifiers: WmiDataId (15), Pointer

Name of the event tracing log file that contains the events.

LoggerName

Data type: uint32
Access type: Read-only
Qualifiers: WmiDataId (14), Pointer

Name of the event tracing session.

MaxFileSize

Data type: uint32
Access type: Read-only
Qualifiers: WmiDataId (7)

Maximum size of the log file, in megabytes.

NumberOfProcessors

Data type: uint32
Access type: Read-only
Qualifiers: WmiDataId (4)

Number of processors on the system.

PerfFreq

Data type: uint64
Access type: Read-only
Qualifiers: WmiDataId (18)

Frequency of the high-resolution performance counter, if one exists.

PointerSize

Data type: uint32
Access type: Read-only
Qualifiers: WmiDataId (11)

Size of a pointer data type, in bytes.

ProviderVersion

Data type: uint32
Access type: Read-only
Qualifiers: WmiDataId (3)

Build number of the operating system.

ReservedFlags

Data type: uint32
Access type: Read-only
Qualifiers: WmiDataId (20)

Reserved.

StartBuffers

Data type: uint32
Access type: Read-only
Qualifiers: WmiDataId (10)

Reserved.

StartTime

Data type: uint64
Access type: Read-only
Qualifiers: WmiDataId (19)

Time at which the event tracing session started, in 100-nanosecond intervals since midnight, January 1, 1601.

TimerResolution

Data type: uint32
Access type: Read-only
Qualifiers: WmiDataId (6)

Resolution of the hardware timer, in units of 100 nanoseconds.

TimeZoneInformation

Data type: uint8 array
Access type: Read-only
Qualifiers: WmiDataId (16), Extension("NoPrint"), Max (176)

A TIME_ZONE_INFORMATION structure that contains the time zone for the BootTime, EndTime and StartTime members.

Version

Data type: uint32
Access type: Read-only
Qualifiers: WmiDataId (2)

Version number of the operating system. Starting with the low-order bytes, the first two bytes contain major version, the next two bytes contain minor version, the next two bytes contain service pack major version, and the last two bytes contain service pack minor version.

Remarks

Typically, you want to save the values for the following properties for use later when processing events from the log file.

TimerResolution—use with the KernelTime and UserTime members of the EVENT_TRACE_HEADER structure to determine the CPU cost for a set of instructions. For details, see the Remarks section of EVENT_TRACE_HEADER.
PointerSize—for properties that contain the Pointer qualifier, use this value to determine the size of the pointer. Note that this value may not be accurate. For example, on a 64-bit computer, a 32-bit application will log 4-byte pointers; however, the session will set PointerSize to 8.
LogFileMode—use to determine if this session is a private logger session. There are some properties that do not contain data for private logger sessions. For example, the KernelTime and UserTime members of the EVENT_TRACE_HEADER structure.

Requirements

Requirement	Value
Minimum supported client	Windows 2000 Professional [desktop apps only]
Minimum supported server	Windows 2000 Server [desktop apps only]