EVENT_FILTER_EVENT_NAME structure (evntprov.h)

The EVENT_FILTER_EVENT_NAME structure defines event IDs used in an EVENT_FILTER_DESCRIPTOR structure for an event name or stalk walk name filter.

This filter will only be applied to events that are otherwise enabled on the logging session, via level/keyword in the enable call.

Syntax

typedef struct _EVENT_FILTER_EVENT_NAME {
  ULONGLONG MatchAnyKeyword;
  ULONGLONG MatchAllKeyword;
  UCHAR     Level;
  BOOLEAN   FilterIn;
  USHORT    NameCount;
  UCHAR     Names[ANYSIZE_ARRAY];
} EVENT_FILTER_EVENT_NAME, *PEVENT_FILTER_EVENT_NAME;

Members

MatchAnyKeyword

Bitmask of keywords that determine the category of events to filter on.

MatchAllKeyword

This bitmask is optional. This mask further restricts the category of events that you want to filter on. If the event's keyword meets the MatchAnyKeyword condition, the provider will filter the event only if all of the bits in this mask exist in the event's keyword. This mask is not used if MatchAnyKeyword is zero.

Level

Defines the severity level of the event to filter on.

FilterIn

True to filter the events matching the provided names in; false to filter them out.

When used for the EVENT_FILTER_TYPE_STACKWALK_NAMEfilter type, the filtered in events will have stacks collected for them.

NameCount

The number of names in the Names member.

Names[ANYSIZE_ARRAY]

An NameCount long array of null-terminated, UTF-8 event names.

Requirements

Requirement	Value
Minimum supported client	Windows 10, version 1709 [desktop apps only]
Minimum supported server	Windows Server 2016 [desktop apps only]
Header	evntprov.h