The topic you requested is included in another documentation set. For convenience, it's displayed below. Choose Switch to see the topic in its original location.

EventWriteString function

Writes an event that contains a string as its data.

Syntax

C++


ULONG EventWriteString(
  _In_ REGHANDLE RegHandle,
  _In_ UCHAR     Level,
  _In_ ULONGLONG Keyword,
  _In_ PCWSTR    String
);

Parameters

RegHandle [in]: Registration handle of the provider. The handle comes from EventRegister.
Level [in]: Level of detail included in the event. If the provider uses a manifest to define the event, set this value to the same level defined in the manifest. If the event is not defined in a manifest, set this value to 0 to ensure the event is written, otherwise, the event is written based on the level rule defined in EnableTraceEx.
Keyword [in]: Bitmask that specifies the event category. If the provider uses a manifest to define the event, set this value to the same keyword mask defined in the manifest. If the event is not defined in a manifest, set this value to 0 to ensure the event is written, otherwise, the event is written based on the keyword rules defined in EnableTraceEx.
String [in]: Null-terminated string to write as the event data.

Return value

Returns ERROR_SUCCESS if successful or one of the following values on error.

Return code	Description
ERROR_INVALID_PARAMETER	One or more of the parameters is not valid.
ERROR_INVALID_HANDLE	The registration handle of the provider is not valid.
ERROR_ARITHMETIC_OVERFLOW	The event size is larger than the allowed maximum (64k - header).
ERROR_MORE_DATA	The session buffer size is too small for the event.
ERROR_NOT_ENOUGH_MEMORY	Occurs when filled buffers are trying to flush to disk, but disk IOs are not happening fast enough. This happens when the disk is slow and event traffic is heavy. Eventually, there are no more free (empty) buffers and the event is dropped.
STATUS_LOG_FILE_FULL	The real-time playback file is full. Events are not logged to the session until a real-time consumer consumes the events from the playback file. Do not stop logging events based on this error code.

Remarks

The provider does not need a manifest to use this function to write the event, unlike the EventWrite function which does require a manifest. Consumers also do not need a manifest to consume events written with this function.

This function gets the acitivity identifier from the thread local storage, if set.

ETW decides based on the level and keyword mask whether the event is written to a session (for details, see EnableTraceEx).

This function cannot be used to write events to the Admin or Operational channels.

Requirements

Minimum supported client	Windows Vista [desktop apps \| Windows Store apps]
Minimum supported server	Windows Server 2008 [desktop apps \| Windows Store apps]
Header	Evntprov.h
Library	Advapi32.lib
DLL	Advapi32.dll