TdhGetEventMapInformation function

Retrieves information about the event map contained in the event.


ULONG __stdcall TdhGetEventMapInformation(
  _In_    PEVENT_RECORD   pEvent,
  _In_    LPWSTR          pMapName,
  _Out_   PEVENT_MAP_INFO pBuffer,
  _Inout_ ULONG           *pBufferSize


pEvent [in]

The event record passed to your EventRecordCallback callback. For details, see the EVENT_RECORD structure.

pMapName [in]

Null-terminated Unicode string that contains the name of the map attribute value. The name comes from the MapNameOffset member of the EVENT_PROPERTY_INFO structure.

pBuffer [out]

User-allocated buffer to receive the event map. The map could be a value map, bitmap, or pattern map. For details, see the EVENT_MAP_INFO structure.

pBufferSize [in, out]

Size, in bytes, of the pBuffer buffer. If the function succeeds, this parameter receives the size of the buffer used. If the buffer is too small, the function returns ERROR_INSUFFICIENT_BUFFER and sets this parameter to the required buffer size. If the buffer size is zero on input, no data is returned in the buffer and this parameter receives the required buffer size.

Return value

Returns ERROR_SUCCESS if successful. Otherwise, this function returns one of the following return codes in addition to others.

Return codeDescription

The size of the pBuffer buffer is too small. Use the required buffer size set in pBufferSize to allocate a new buffer.


The schema for the event was not found or the specified map was not found.


The resourceFileName attribute in the manifest contains the location of the provider binary. When you register the manifest, the location is written to the registry. TDH was unable to find the binary based on the registered location.


One or more of the parameters is not valid.


The WMI service is not available.



You cannot use this function to retrieve event map information for WPP events.

For maps defined in a manifest, the string will contain a space at the end of the string. For example, if the value is mapped to "Monday" in the manifest, the string is returned as "Monday ".


For an example that shows how to call this function, see Using TdhGetProperty to Consume Event Data.


Minimum supported client

Windows Vista [desktop apps only]

Minimum supported server

Windows Server 2008 [desktop apps only]