Export (0) Print
Expand All
Expand Minimize

EventWriteString function

Writes an event that contains a string as its data.

Syntax


ULONG EventWriteString(
  _In_  REGHANDLE RegHandle,
  _In_  UCHAR Level,
  _In_  ULONGLONG Keyword,
  _In_  PCWSTR String
);

Parameters

RegHandle [in]

Registration handle of the provider. The handle comes from EventRegister.

Level [in]

Level of detail included in the event. If the provider uses a manifest to define the event, set this value to the same level defined in the manifest. If the event is not defined in a manifest, set this value to 0 to ensure the event is written, otherwise, the event is written based on the level rule defined in EnableTraceEx.

Keyword [in]

Bitmask that specifies the event category. If the provider uses a manifest to define the event, set this value to the same keyword mask defined in the manifest. If the event is not defined in a manifest, set this value to 0 to ensure the event is written, otherwise, the event is written based on the keyword rules defined in EnableTraceEx.

String [in]

Null-terminated string to write as the event data.

Return value

Returns ERROR_SUCCESS if successful or one of the following values on error.

Return codeDescription
ERROR_INVALID_PARAMETER

One or more of the parameters is not valid.

ERROR_INVALID_HANDLE

The registration handle of the provider is not valid.

ERROR_ARITHMETIC_OVERFLOW

The event size is larger than the allowed maximum (64k - header).

ERROR_MORE_DATA

The session buffer size is too small for the event.

ERROR_NOT_ENOUGH_MEMORY

Occurs when filled buffers are trying to flush to disk, but disk IOs are not happening fast enough. This happens when the disk is slow and event traffic is heavy. Eventually, there are no more free (empty) buffers and the event is dropped.

STATUS_LOG_FILE_FULL

The real-time playback file is full. Events are not logged to the session until a real-time consumer consumes the events from the playback file. Do not stop logging events based on this error code.

 

Remarks

The provider does not need a manifest to use this function to write the event, unlike the EventWrite function which does require a manifest. Consumers also do not need a manifest to consume events written with this function.

This function gets the acitivity identifier from the thread local storage, if set.

ETW decides based on the level and keyword mask whether the event is written to a session (for details, see EnableTraceEx).

This function cannot be used to write events to the Admin or Operational channels.

Requirements

Minimum supported client

Windows Vista [desktop apps only]

Minimum supported server

Windows Server 2008 [desktop apps only]

Header

Evntprov.h

Library

Advapi32.lib

DLL

Advapi32.dll

See also

EventWrite
EventWriteTransfer
EnableTraceEx

 

 

Community Additions

ADD
Show:
© 2014 Microsoft