Image class
This class is the parent class for image events.
The following syntax is simplified from MOF code.
Syntax
[Guid("{2cb15d1d-5fc1-11d2-abe1-00a0c911f518}"), EventVersion(2)]
class Image : MSNT_SystemTrace
{
};
Members
The Image class does not define any members.
Remarks
To enable image events in an NT Kernel logging session, specify the EVENT_TRACE_FLAG_IMAGE_LOAD flag in the EnableFlags member of the EVENT_TRACE_PROPERTIES structure when calling the StartTrace function.
Event trace consumers can implement special processing for image load events by calling the SetTraceCallback function and specifying ImageLoadGuid as the pGuid parameter. Use the following event types to identify image load events when consuming events.
| Event type | Description |
|---|---|
| EVENT_TRACE_TYPE_LOAD(Event type value is 10) |
Image load event. Generated when a DLL or executable file is loaded. The provider generates only one event for the first time a given DLL is loaded. The Image_Load MOF class defines the event data for this event. |
| EVENT_TRACE_TYPE_END(Event type value is 2) |
Image unload event. Generated when a DLL or executable file is unloaded. The provider generates only one event for the last time a given DLL is unloaded. The Image_Load MOF class defines the event data for this event. |
| EVENT_TRACE_TYPE_DC_START(Event type value is 3) |
Data collection start event. Enumerates all loaded images at the beginning of the trace. The Image_Load MOF class defines the event data for this event. |
| EVENT_TRACE_TYPE_DC_END(Event type value is 4) |
Data collection end event. Enumerates all loaded images at the end of the trace. The Image_Load MOF class defines the event data for this event. |
Requirements
| Requirement | Value |
|---|---|
| Minimum supported client |
Windows Vista [desktop apps only] |
| Minimum supported server |
Windows Server 2008 [desktop apps only] |
See also