This class is the parent class for image events.
The following syntax is simplified from MOF code.
Syntax
[Guid("{2cb15d1d-5fc1-11d2-abe1-00a0c911f518}"), EventVersion(2)]class Image : MSNT_SystemTrace
{
};
Methods
The Image class inherits from MSNT_SystemTrace but does not define additional methods or properties.
Remarks
To enable image events in an NT Kernel logging session, specify the EVENT_TRACE_FLAG_IMAGE_LOAD flag in the EnableFlags member of the
EVENT_TRACE_PROPERTIES structure when calling the
StartTrace function.
Event trace consumers can implement special processing for image load events by calling the
SetTraceCallback function and specifying ImageLoadGuid as the pGuid parameter. Use the following event types to identify image load events when consuming events.
| Event type | Description |
|---|
| EVENT_TRACE_TYPE_LOAD( Event type value is 10)
| Image load event. Generated when a DLL or executable file is loaded. The provider generates only one event for the first time a given DLL is loaded. The Image_Load MOF class defines the event data for this event. |
| EVENT_TRACE_TYPE_END( Event type value is 2)
| Image unload event. Generated when a DLL or executable file is unloaded. The provider generates only one event for the last time a given DLL is unloaded. The Image_Load MOF class defines the event data for this event. |
| EVENT_TRACE_TYPE_DC_START( Event type value is 3)
| Data collection start event. Enumerates all loaded images at the beginning of the trace. The Image_Load MOF class defines the event data for this event. |
| EVENT_TRACE_TYPE_DC_END( Event type value is 4)
| Data collection end event. Enumerates all loaded images at the end of the trace. The Image_Load MOF class defines the event data for this event. |
Requirements
| Minimum supported client | Windows Vista |
|---|
| Minimum supported server | Windows Server 2008 |
|---|
See Also
- Image_Load
- Image_V0
- Image_V1
Send comments about this topic to Microsoft
Build date: 7/2/2009