Export (0) Print
Expand All

Image class

This class is the parent class for image events.

The following syntax is simplified from MOF code.

Syntax

[Guid("{2cb15d1d-5fc1-11d2-abe1-00a0c911f518}"), EventVersion(2)]class Image : MSNT_SystemTrace
{
};

Members

The Image class does not define any members.

Remarks

To enable image events in an NT Kernel logging session, specify the EVENT_TRACE_FLAG_IMAGE_LOAD flag in the EnableFlags member of the EVENT_TRACE_PROPERTIES structure when calling the StartTrace function.

Event trace consumers can implement special processing for image load events by calling the SetTraceCallback function and specifying ImageLoadGuid as the pGuid parameter. Use the following event types to identify image load events when consuming events.

Event typeDescription
EVENT_TRACE_TYPE_LOAD(

Event type value is 10)

Image load event. Generated when a DLL or executable file is loaded. The provider generates only one event for the first time a given DLL is loaded. The Image_Load MOF class defines the event data for this event.
EVENT_TRACE_TYPE_END(

Event type value is 2)

Image unload event. Generated when a DLL or executable file is unloaded. The provider generates only one event for the last time a given DLL is unloaded. The Image_Load MOF class defines the event data for this event.
EVENT_TRACE_TYPE_DC_START(

Event type value is 3)

Data collection start event. Enumerates all loaded images at the beginning of the trace. The Image_Load MOF class defines the event data for this event.
EVENT_TRACE_TYPE_DC_END(

Event type value is 4)

Data collection end event. Enumerates all loaded images at the end of the trace. The Image_Load MOF class defines the event data for this event.

 

Requirements

Minimum supported client

Windows Vista [desktop apps only]

Minimum supported server

Windows Server 2008 [desktop apps only]

See also

Image_Load
Image_V0
Image_V1

 

 

Community Additions

ADD
Show:
© 2014 Microsoft