EtwWriteTransfer function

The EtwWriteTransfer function marks an event that links two activities together; this type of event is referred to as a transfer event. A transfer event can contain the same user-defined data, the same fields, and is subject to the same rules as other events.

Syntax


NTSTATUS EtwWriteTransfer(
  _In_      REGHANDLE RegHandle,
  _In_      PCEVENT_DESCRIPTOR EventDescriptor,
  _In_opt_  LPCGUID ActivityId,
  _In_opt_  LPCGUID RelatedActivityId,
  _In_      ULONG UserDataCount,
  _In_opt_  PEVENT_DATA_DESCRIPTOR UserData
);

Parameters

RegHandle [in]

A pointer to the event provider registration handle, which is returned by the EtwRegister function if the event provider registration is successful.

EventDescriptor [in]

A pointer to the EVENT_DESCRIPTOR structure.

ActivityId [in, optional]

The identifier that indicates the activity associated with the event. The ActivityId provides a way to group related events and is used in end-to-end tracing. This identifier is optional and can be NULL.

RelatedActivityId [in, optional]

The identifier that indicates related activity associated with the event. The RelatedActivityID provides a way to group related events and is used in end-to-end tracing.

UserDataCount [in]

The number of elements in an array of EVENT_DATA_DESCRIPTOR structures.

UserData [in, optional]

The pointer to the first element in an array of EVENT_DATA_DESCRIPTOR structures.

Return value

EtwWriteTransfer returns STATUS_SUCCESS if the event was successfully published.

Remarks

You can call EtwWriteTransfer at any IRQL. However, when IRQL is greater than APC_LEVEL, any data passed to the EtwWrite, EtwWriteString, EtwWriteTransfer functions must not be pageable. That is, any kernel-mode routine that is running at IRQL greater than APC_LEVEL cannot access pageable memory. Data passed to the EtwWrite, EtwWriteString, EtwWriteTransfer functions must reside in system-space memory, regardless of what the IRQL is.

Requirements

Version

Available in Windows Vista and later versions of Windows.

Header

Wdm.h (include Wdm.h or Ntddk.h)

Library

Ntoskrnl.lib

IRQL

Any level (See Comments section.)

See also

EtwWrite
EtwWriteString

 

 

Send comments about this topic to Microsoft

Show:
© 2014 Microsoft