Channel: Defines the audience for the event (for example, administrator or developer). Level: Specifies the severity or level of detail included in the event (for example, informational or fatal). Opcode: Identifies a step in a sequence of operations being performed within a Task. Task: Identifies a larger unit of work within an application or component (broader in scope than the Opcode). Keyword: A bitmask that specifies a logical group of related events. Each bit corresponds to one group. An event can belong to one or more groups. The keyword can contain one or more provider-defined keywords, standard keywords, or both. This structure represents an event defined in a manifest and is included in the structure. EVENT_HEADER The EVENT_HEADER structure defines the main parameters of an event. typedef struct _EVENT_HEADER { USHORT Size; USHORT HeaderType; USHORT Flags; USHORT EventProperty; ULONG ThreadId; ULONG ProcessId; LARGE_INTEGER TimeStamp; GUID ProviderId; EVENT_DESCRIPTOR EventDescriptor; union { struct { ULONG KernelTime; ULONG UserTime; }; ULONG64 ProcessorTime; }; GUID ActivityId; } EVENT_HEADER, *PEVENT_HEADER; Size: Size of the event record, in bytes. HeaderType: Reserved. Flags: Flags that provide information about the event such as the type of session it was logged to and whether the event contains extended data. This member can contain one or more of the following flags. Value Meaning EVENT_HEADER_FLAG_EXTENDED_INFO The ExtendedData member of the event record contains data. EVENT_HEADER_FLAG_PRIVATE_SESSION The event was logged to a private session. EVENT_HEADER_FLAG_STRING_ONLY The event data is a null-terminated Unicode string. EVENT_HEADER_FLAG_TRACE_MESSAGE The provider used an implementation-specific trace message function to log the event.Typically indicates that the event was written by the Windows software trace preprocessor. EVENT_HEADER_FLAG_NO_CPUTIME Indicates that elapsed execution time was not recorded; the
Channel: Defines the audience for the event (for example, administrator or developer). Level: Specifies the severity or level of detail included in the event (for example, informational or fatal). Opcode: Identifies a step in a sequence of operations being performed within a Task. Task: Identifies a larger unit of work within an application or component (broader in scope than the Opcode). Keyword: A bitmask that specifies a logical group of related events. Each bit corresponds to one group. An event can belong to one or more groups. The keyword can contain one or more provider-defined keywords, standard keywords, or both. This structure represents an event defined in a manifest and is included in the structure. EVENT_HEADER The EVENT_HEADER structure defines the main parameters of an event. typedef struct _EVENT_HEADER { USHORT Size; USHORT HeaderType; USHORT Flags; USHORT EventProperty; ULONG ThreadId; ULONG ProcessId; LARGE_INTEGER TimeStamp; GUID ProviderId; EVENT_DESCRIPTOR EventDescriptor; union { struct { ULONG KernelTime; ULONG UserTime; }; ULONG64 ProcessorTime; }; GUID ActivityId; } EVENT_HEADER, *PEVENT_HEADER; Size: Size of the event record, in bytes. HeaderType: Reserved. Flags: Flags that provide information about the event such as the type of session it was logged to and whether the event contains extended data. This member can contain one or more of the following flags. Value Meaning EVENT_HEADER_FLAG_EXTENDED_INFO The ExtendedData member of the event record contains data. EVENT_HEADER_FLAG_PRIVATE_SESSION The event was logged to a private session. EVENT_HEADER_FLAG_STRING_ONLY The event data is a null-terminated Unicode string. EVENT_HEADER_FLAG_TRACE_MESSAGE The provider used an implementation-specific trace message function to log the event.Typically indicates that the event was written by the Windows software trace preprocessor. EVENT_HEADER_FLAG_NO_CPUTIME Indicates that elapsed execution time was not recorded; the
%5BMS-DTYP%5D-171201.docx