Edit

EVENT_RECORD structure (relogger.h)

  • Article

The EVENT_RECORD structure defines the layout of an event that ETW delivers.

Syntax

typedef struct _EVENT_RECORD {
  EVENT_HEADER                     EventHeader;
  ETW_BUFFER_CONTEXT               BufferContext;
  USHORT                           ExtendedDataCount;
  USHORT                           UserDataLength;
  PEVENT_HEADER_EXTENDED_DATA_ITEM ExtendedData;
  PVOID                            UserData;
  PVOID                            UserContext;
} EVENT_RECORD, *PEVENT_RECORD;

Members

EventHeader

Information about the event such as the time stamp for when it was written. For details, see the EVENT_HEADER structure.

BufferContext

Defines information such as the session that logged the event. For details, see the ETW_BUFFER_CONTEXT structure.

ExtendedDataCount

The number of extended data structures in the ExtendedData member.

UserDataLength

The size, in bytes, of the data in the UserData member.

ExtendedData

One or more extended data items that ETW collects. The extended data includes some items, such as the security identifier (SID) of the user that logged the event, only if the controller sets the EnableProperty parameter passed to the EnableTraceEx or EnableTraceEx2 function. The extended data includes other items, such as the related activity identifier and decoding information for trace logging, regardless whether the controller sets the EnableProperty parameter passed to EnableTraceEx or EnableTraceEx2. For details, see the EVENT_HEADER_EXTENDED_DATA_ITEM structure .

UserData

Event specific data. To parse this data, see Retrieving Event Data Using TDH. If the Flags member of EVENT_HEADER contains EVENT_HEADER_FLAG_STRING_ONLY, the data is a null-terminated Unicode string that you do not need TDH to parse.

UserContext

Th context specified in the Context member of the EVENT_TRACE_LOGFILE structure that is passed to the OpenTrace function.

Remarks

The EVENT_RECORD structure is passed to the consumer's implementation of the EventRecordCallback callback .

Requirements

Requirement Value
Minimum supported client Windows Vista [desktop apps only]
Minimum supported server Windows Server 2008 [desktop apps only]
Header relogger.h (include Evntcons.h)

See also

ETW_BUFFER_CONTEXT

EVENT_HEADER

EVENT_HEADER_EXTENDED_DATA_ITEM

EVENT_TRACE_LOGFILE

EnableTraceEx

EnableTraceEx2

EventRecordCallback

OpenTrace