Image class

This class is the parent class for image events.

The following syntax is simplified from MOF code.

Syntax

[Guid("{2cb15d1d-5fc1-11d2-abe1-00a0c911f518}"), EventVersion(2)]
class Image : MSNT_SystemTrace
{
};

Members

The Image class does not define any members.

Remarks

To enable image events in an NT Kernel logging session, specify the EVENT_TRACE_FLAG_IMAGE_LOAD flag in the EnableFlags member of the EVENT_TRACE_PROPERTIES structure when calling the StartTrace function.

Event trace consumers can implement special processing for image load events by calling the SetTraceCallback function and specifying ImageLoadGuid as the pGuid parameter. Use the following event types to identify image load events when consuming events.

Event type Description
EVENT_TRACE_TYPE_LOAD(Event type value is 10)
Image load event. Generated when a DLL or executable file is loaded. The provider generates only one event for the first time a given DLL is loaded. The Image_Load MOF class defines the event data for this event.
EVENT_TRACE_TYPE_END(Event type value is 2)
Image unload event. Generated when a DLL or executable file is unloaded. The provider generates only one event for the last time a given DLL is unloaded. The Image_Load MOF class defines the event data for this event.
EVENT_TRACE_TYPE_DC_START(Event type value is 3)
Data collection start event. Enumerates all loaded images at the beginning of the trace. The Image_Load MOF class defines the event data for this event.
EVENT_TRACE_TYPE_DC_END(Event type value is 4)
Data collection end event. Enumerates all loaded images at the end of the trace. The Image_Load MOF class defines the event data for this event.

 

Requirements

Requirement Value
Minimum supported client
Windows Vista [desktop apps only]
Minimum supported server
Windows Server 2008 [desktop apps only]

See also

MSNT_SystemTrace

Image_Load

Image_V0

Image_V1