Edit

OutputType Complex Type

  • Article

Defines an output data type that determines how the data is rendered.

<xs:complexType name="OutputType">
    <xs:simpleContent>
        <xs:extension
            base="string"
        >
            <xs:attribute name="default"
                type="boolean"
                use="optional"
             />
            <xs:attribute name="xmlType"
                type="QName"
                use="required"
             />
        </xs:extension>
    </xs:simpleContent>
</xs:complexType>

Attributes

Name Type Description
default boolean Determines if this output type should be used as the default output type for the parent input type. Set to true to use this output type as the default type; otherwise, false.
xmlType QName The name of the output type.

Remarks

The following lists the recognized output types that you can specify in your manifest. The output type determines how the service renders the data. The output types are defined in the \Include\Winmeta.xml file, which is included in the Windows SDK.

Windows Server 2008 and Windows Vista: The service does not use the output type to render the data; instead the service uses the input type to determine how to render the data.

Output type Description
xs:string Text data. This type is valid for the UnicodeString and AnsiString input types. Starting with the mc.exe shipped with the Windows Server 2016 SDK or later (mc.exe version 10.0.14251 or later), this type is also valid for the Int8, UInt8, and UInt16 input types, in which case it the data is interpreted as a single character.
xs:datetime An XML date/time. This is the default format for all dates. The date is formatted using the cultural markers embedded in the string (for example, Left-to-Right or Right-to-Left). For information on formatting dates and times, see Retrieving Time and Date Information on MSDN. This type is valid for the FILETIME and SYSTEMTIME input types. Prior to the version of the MC compiler that ships with the Windows 7 version of the Windows SDK: The date is not rendered using the cultural markers embedded in the string (for example, Left-to-Right or Right-to-Left).
xs:byte A signed 8-bit integer that is formatted as a decimal integer.
xs:unsignedByte An unsigned 8-bit integer that is formatted as a decimal integer.
xs:short A signed 16-bit integer that is formatted as a decimal integer.
xs:unsignedShort An unsigned 16-bit integer that is formatted as a decimal integer.
xs:int A signed 32-bit integer that is formatted as a decimal integer.
xs:unsignedInt An unsigned 32-bit integer that is formatted as a decimal integer.
xs:long A signed 64-bit integer that is formatted as a decimal integer.
xs:unsignedLong An unsigned 64-bit integer that is formatted as a decimal integer
xs:float A 4-byte floating-point number.
xs:double An 8-byte floating-point number.
xs:boolean A Boolean value. This type is valid for the Boolean input type, indicating a 32-bit Boolean value corresponding to the Win32 BOOL type. Starting with the mc.exe shipped with the Windows Server 2016 SDK or later (mc.exe version 10.0.14251 or later), this type is also valid for the UInt8 input type, indicating an 8-bit Boolean value corresponding to the C++ bool and Win32 BOOLEAN types.
xs:GUID A GUID value that is formatted in the registry string form, {xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx}.
xs:hexBinary A sequence of hexadecimal digits. Each byte of the formatted data is padded with leading zeros.
win:HexInt8 A hexadecimal number that is preceded by "0x". The formatted value is not padded with leading zeros.
win:HexInt16 A hexadecimal number that is preceded by "0x". The formatted value is not padded with leading zeros.
win:HexInt32 A hexadecimal number that is preceded by "0x". The formatted value is not padded with leading zeros.
win:HexInt64 A hexadecimal number that is preceded by "0x". The formatted value is not padded with leading zeros.
win:PID A signed 32-bit integer that represents a process ID. The value is formatted as a decimal integer.
win:TID A signed 32-bit integer that represents a thread ID. The value is formatted as a decimal integer.
win:Port A signed 16-bit integer that represents an IP address port. Pass the value to the ntohs function and format the result as a decimal integer.
win:IPv4 An IPv4 IP address. This type is valid for the UInt32 input type. The value must be in network byte order; each byte of the UInt32 represents one of the four parts of the IP address (p1.p2.p3.p4). The low-order byte contains the value for p1, the next byte contains the value for p2, and so on. The address is formatted in dot notation.
To convert an unsigned integer that contains an IPv4 address to a string, call the RtlIpv4AddressToString or inet_ntoa function.
win:IPv6 An IPv6 IP address. This type is valid for the win:Binary input type. The address is formatted as a string. To format the address, call the RtlIpv6AddressToString function.
win:SocketAddress A socket address that is interpreted as a SOCKADDR_STORAGE structure. The address family determines how the address is formatted. For the AF_INET and AF_INET6 families, the address is formatted as <IP_Address>:<Port>; for all other families the address is formatted as a hex dump.
For AF_INET and AF_INET6, the event data is a 128-bit binary value. For AF_LINK, the event data is a 112-bit binary value.
Windows Server 2008 and Windows Vista: The AF_LINK address family is not supported.
win:CIMDateTime Represents the CIM date/time. For specifying a time stamp or an interval. If it specifies a time stamp, it preserves the time zone offset. Not supported.
win:DateTimeCultureInsensitive An XML date/time. This type is valid for the FILETIME and SYSTEMTIME input types. The date is not rendered using the cultural markers embedded in the string (for example, Left-to-Right or Right-to-Left). For information on formatting dates and times, see Retrieving Time and Date Information on MSDN.Prior to MC version 1.12.7051 and Windows 7: Not available
win:Xml An XML document or document fragment. This type is valid for the UnicodeString and AnsiString input types. When decoded on a system running Windows Server 2016 or later, when used with the AnsiString input type, the string will be treated as UTF-8 unless the XML document starts with a processing instruction specifying an alternate encoding.
win:ETWTIME A time stamp in 100 nanosecond units that is the relative time from the beginning of the trace to when the event is written. The time stamp is rendered as a decimal integer. This type is valid for the UInt32 or UInt64 input type.
win:ErrorCode An error code. This type is valid for the UInt32 input type. The code is rendered as a hexadecimal number that is preceded by "0x". Do not use, instead use the more specific error code types, such as Win32Error or HResult.
win:Win32Error A Win32 error code. This type is valid for the UInt32 input type. The service retrieves and renders the message string associated with the Win32 error code if it exists; otherwise, the service renders a string in the form, "Unknown Win32 Error code: 0x" with the Win32 error code appended as hexadecimal number.
win:NTSTATUS An NTSTATUS error code. This type is valid for the UInt32 input type. The service retrieves and renders the message string associated with the NT status code if it exists; otherwise, the service renders a string in the form, "Unknown NTSTATUS Error code: 0x" with the NT status code appended as hexadecimal number.Prior to MC version 1.12.7051 and Windows 7: Not available
win:HResult An HRESULT error code. This type is valid for the Int32 input type. The service retrieves and renders the message string associated with the HRESULT error code if it exists; otherwise, the service renders a string in the form, "Unknown HResult Error code: 0x" with the HRESULT error code appended as hexadecimal number.Prior to MC version 1.12.7051 and Windows 7: Not available
win:Json A JSON string. This type is valid for the UnicodeString and AnsiString input types. When used with the AnsiString input type, the string will be treated as UTF-8.
win:Utf8 A UTF-8 string. This type is valid for the AnsiString input type. When this output type is used, the string will be treated as UTF-8.
win:Pkcs7WithTypeInfo A PKCS#7 message with optional type information. This type is valid for the Binary input type. The data consists of a PKCS#7 message (e.g. encrypted and/or signed data), optionally followed by TraceLogging type information that describes the type of the inner content. For example, the byte 0x01 (TlgInUNICODESTRING = 0x01) might be appended to indicate that the inner content is to be interpreted as input type UnicodeString; the bytes 0x82 0x22 (TlgInANSISTRING + TlgInChain = 0x82, TlgOutJSON = 0x22) might be appended to indicate that the inner content is to be interpreted as input type AnsiString, output type Json.

Requirements

Requirement Value
Minimum supported client
 Windows Vista [desktop apps only]
Minimum supported server
 Windows Server 2008 [desktop apps only]