Skip to main content
TdhGetWppMessage function

Retrieves the formatted WPP message embedded into an EVENT_RECORD structure.

Syntax


ULONG TdhGetWppMessage(
  _In_     TDH_HANDLE Handle,
  _In_     PEVENT_RECORD EventRecord,
  _Inout_  PULONG BufferSize,
  _Out_    PBYTE Buffer
);

Parameters

Handle [in]

Type: TDH_HANDLE

A valid decoding handle.

EventRecord [in]

Type: PEVENT_RECORD

The event record passed to your EventRecordCallback callback.

BufferSize [in, out]

Type: PULONG

Size of the Buffer parameter, in bytes.

Buffer [out]

Type: PBYTE

User-allocated buffer that receives the property data.

Return value

Type: ULONG

Returns ERROR_SUCCESS if successful. Otherwise, this function returns one of the following return codes in addition to others.

Return codeDescription
ERROR_NOT_FOUND

The specified property was not found.

ERROR_INSUFFICIENT_BUFFER

BufferSize is too small. To get the required buffer size, call TdhGetPropertySize.

ERROR_INVALID_PARAMETER

One or more of the parameters is not valid.

 

Remarks

To retrieve a specific property instead of the decoded event message without specifying a property name, call TdhGetWppProperty.

Requirements

Minimum supported client

Windows 8 [desktop apps only]

Minimum supported server

Windows Server 2012 [desktop apps only]

Header

Tdh.h

Library

Tdh.lib

DLL

Tdh.dll

See also

EVENT_RECORD
EventRecordCallback
TdhGetWppProperty
TdhGetPropertySize