Export (0) Print
Expand All

TRACE_LOGFILE_HEADER structure

The TRACE_LOGFILE_HEADER structure contains information about an event tracing session and its events.

Syntax


typedef struct _TRACE_LOGFILE_HEADER {
  ULONG                 BufferSize;
  union {
    ULONG  Version;
    struct {
      UCHAR MajorVersion;
      UCHAR MinorVersion;
      UCHAR SubVersion;
      UCHAR SubMinorVersion;
    } VersionDetail;
  };
  ULONG                 ProviderVersion;
  ULONG                 NumberOfProcessors;
  LARGE_INTEGER         EndTime;
  ULONG                 TimerResolution;
  ULONG                 MaximumFileSize;
  ULONG                 LogFileMode;
  ULONG                 BuffersWritten;
  union {
    GUID   LogInstanceGuid;
    struct {
      ULONG StartBuffers;
      ULONG PointerSize;
      ULONG EventsLost;
      ULONG CpuSpeedInMHz;
    };
  };
  LPWSTR                LoggerName;
  LPWSTR                LogFileName;
  TIME_ZONE_INFORMATION TimeZone;
  LARGE_INTEGER         BootTime;
  LARGE_INTEGER         PerfFreq;
  LARGE_INTEGER         StartTime;
  ULONG                 ReservedFlags;
  ULONG                 BuffersLost;
} TRACE_LOGFILE_HEADER, *PTRACE_LOGFILE_HEADER;

Members

BufferSize

Size of the event tracing session's buffers, in bytes.

Version

Version number of the operating system. This is a roll-up of the members of VersionDetail. Starting with the low-order bytes, the first two bytes contain MajorVersion, the next two bytes contain MinorVersion, the next two bytes contain SubVersion, and the last two bytes contain SubMinorVersion.

VersionDetail
MajorVersion

Major version number of the operating system.

MinorVersion

Minor version number of the operating system.

SubVersion

Reserved.

SubMinorVersion

Reserved.

ProviderVersion

Build number of the operating system.

NumberOfProcessors

Number of processors on the system.

EndTime

Time at which the event tracing session stopped, in 100-nanosecond intervals since midnight, January 1, 1601. This value may be 0 if you are consuming events in real time or from a log file to which the provide is still logging events.

TimerResolution

Resolution of the hardware timer, in units of 100 nanoseconds. For usage, see the Remarks for EVENT_TRACE_HEADER.

MaximumFileSize

Maximum size of the log file, in megabytes.

LogFileMode

Current logging mode for the event tracing session. For a list of values, see Logging Mode Constants.

BuffersWritten

Total number of buffers written by the event tracing session.

LogInstanceGuid

Reserved.

StartBuffers

Reserved.

PointerSize

Size of a pointer data type, in bytes.

EventsLost

Number of events lost during the event tracing session. Events may be lost due to insufficient memory or a very high rate of incoming events.

CpuSpeedInMHz

CPU speed, in megahertz.

Windows 2000:  This member is not supported.

LoggerName

Do not use.

The name of the event tracing session is the first null-terminated string following this structure in memory.

LogFileName

Do Not use.

The name of the event tracing log file is the second null-terminated string following this structure in memory. The first string is the name of the session.

TimeZone

A TIME_ZONE_INFORMATION structure that contains the time zone for the BootTime, EndTime and StartTime members.

BootTime

Time at which the system was started, in 100-nanosecond intervals since midnight, January 1, 1601. BootTime is supported only for traces written to the Global Logger session.

PerfFreq

Frequency of the high-resolution performance counter, if one exists.

StartTime

Time at which the event tracing session started, in 100-nanosecond intervals since midnight, January 1, 1601.

ReservedFlags

Specifies the clock type. For details, see the ClientContext member of WNODE_HEADER.

BuffersLost

Total number of buffers lost during the event tracing session.

Remarks

Be sure to initialize the memory for this structure to zero before setting any members.

The first event from any log file contains the data defined in this structure. You can use this structure to access the event data or you can use the EventTrace_Header MOF class to decode the event data. Using this structure to read the event data may return unexpected results if the consumer is on a different computer from the one that generated the log file or the log file was written in a WOW (32-bit) session on a 64-bit computer. This is because the LoggerName and LogFileName members are pointers and can vary in size depending on the PointerSize member.

Requirements

Minimum supported client

Windows 2000 Professional [desktop apps only]

Minimum supported server

Windows 2000 Server [desktop apps only]

Header

Evntrace.h

See also

EVENT_TRACE_LOGFILE
LARGE_INTEGER
TIME_ZONE_INFORMATION

 

 

Community Additions

ADD
Show:
© 2014 Microsoft