TdhGetWppProperty function
Retrieves a specific property associated with a WPP message.
Syntax
ULONG TdhGetWppProperty( _In_ TDH_HANDLE Handle, _In_ PEVENT_RECORD EventRecord, _In_ PWSTR PropertyName, _Inout_ PULONG BufferSize, _Out_ PBYTE Buffer );
Parameters
- Handle [in]
-
Type: TDH_HANDLE
A valid decoding handle.
- EventRecord [in]
-
Type: PEVENT_RECORD
The event record passed to your EventRecordCallback callback.
- PropertyName [in]
-
Type: PWSTR
The name of the property to retrieve.
For a list of possible values, see PROPERTY_DATA_DESCRIPTOR.
- BufferSize [in, out]
-
Type: PULONG
Size of the Buffer parameter, in bytes.
- Buffer [out]
-
Type: PBYTE
User-allocated buffer that receives the property data.
Return value
Type: ULONG
Returns ERROR_SUCCESS if successful. Otherwise, this function returns one of the following return codes in addition to others.
| Return code | Description |
|---|---|
|
The specified property was not found. |
|
BufferSize is too small. To get the required buffer size, call TdhGetWppProperty twice, once with a null buffer and a pointer to retrieve the buffer size and then again with the correctly sized buffer. |
|
One or more of the parameters is incorrect. This error is returned if the Handle, EventRecord, PropertyName, or Buffer parameter is NULL. |
Remarks
To retrieve only the decoded event message without specifying a property name, call TdhGetWppMessage.
Requirements
|
Minimum supported client |
Windows 8 [desktop apps only] |
|---|---|
|
Minimum supported server |
Windows Server 2012 [desktop apps only] |
|
Header |
|
|
Library |
|
|
DLL |
|
See also