TdhGetWppProperty function (tdh.h)

Retrieves a specific property associated with a WPP message.

Syntax

TDHSTATUS TdhGetWppProperty(
  [in]      TDH_HANDLE    Handle,
  [in]      PEVENT_RECORD EventRecord,
  [in]      PWSTR         PropertyName,
  [in, out] PULONG        BufferSize,
  [out]     PBYTE         Buffer
);

Parameters

[in] Handle

Type: TDH_HANDLE

A valid decoding handle.

[in] EventRecord

Type: PEVENT_RECORD

The event record passed to your EventRecordCallback callback.

[in] PropertyName

Type: PWSTR

The name of the property to retrieve.

For a list of possible values, see PROPERTY_DATA_DESCRIPTOR.

[in, out] BufferSize

Type: PULONG

Size of the Buffer parameter, in bytes.

[out] Buffer

Type: PBYTE

User-allocated buffer that receives the property data.

Return value

Type: ULONG

Returns ERROR_SUCCESS if successful. Otherwise, this function returns one of the following return codes in addition to others.

Return code Description
ERROR_NOT_FOUND
The specified property was not found.
ERROR_INSUFFICIENT_BUFFER
BufferSize is too small. To get the required buffer size, call TdhGetWppProperty twice, once with a null buffer and a pointer to retrieve the buffer size and then again with the correctly sized buffer.
ERROR_INVALID_PARAMETER
One or more of the parameters is incorrect. This error is returned if the Handle, EventRecord, PropertyName, or Buffer parameter is NULL.

Remarks

To retrieve only the decoded event message without specifying a property name, call TdhGetWppMessage.

Requirements

   
Minimum supported client Windows 8 [desktop apps only]
Minimum supported server Windows Server 2012 [desktop apps only]
Target Platform Windows
Header tdh.h
Library Tdh.lib
DLL Tdh.dll

See also

EVENT_RECORD

EventRecordCallback

TdhGetPropertySize

TdhGetWppMessage