EVENT_HEADER_EXTENDED_DATA_ITEM structure

The EVENT_HEADER_EXTENDED_DATA_ITEM structure defines the extended data that ETW collects as part of the event data.

Syntax


typedef struct _EVENT_HEADER_EXTENDED_DATA_ITEM {
  USHORT    Reserved1;
  USHORT    ExtType;
  struct {
    USHORT Linkage  :1;
    USHORT Reserved2  :15;
  };
  USHORT    DataSize;
  ULONGLONG DataPtr;
} EVENT_HEADER_EXTENDED_DATA_ITEM, *PEVENT_HEADER_EXTENDED_DATA_ITEM;

Members

Reserved1

Reserved.

ExtType

Type of extended data. The following are possible values.

ValueMeaning
EVENT_HEADER_EXT_TYPE_RELATED_ACTIVITYID

The DataPtr member points to an EVENT_EXTENDED_ITEM_RELATED_ACTIVITYID structure that contains the related activity identifier if you called EventWriteTransfer to write the event.

EVENT_HEADER_EXT_TYPE_SID

The DataPtr member points to a SID structure that contains the security identifier (SID) of the user that logged the event. ETW includes the SID if you set the EnableProperty parameter of EnableTraceEx to EVENT_ENABLE_PROPERTY_SID.

EVENT_HEADER_EXT_TYPE_TS_ID

The DataPtr member points to an EVENT_EXTENDED_ITEM_TS_ID structure that contains the terminal session identifier. ETW includes the terminal session identifier if you set the EnableProperty parameter of EnableTraceEx to EVENT_ENABLE_PROPERTY_TS_ID.

EVENT_HEADER_EXT_TYPE_INSTANCE_INFO

The DataPtr member points to an EVENT_EXTENDED_ITEM_INSTANCE structure that contains the activity identifier if you called TraceEventInstance to write the event.

EVENT_HEADER_EXT_TYPE_STACK_TRACE32

The DataPtr member points to an EVENT_EXTENDED_ITEM_STACK_TRACE32 structure that contains the call stack if the event is captured on a 32-bit computer.

EVENT_HEADER_EXT_TYPE_STACK_TRACE64

The DataPtr member points to an EVENT_EXTENDED_ITEM_STACK_TRACE64 structure that contains the call stack if the event is captured on a 64-bit computer.

EVENT_HEADER_EXT_TYPE_EVENT_SCHEMA_TL

The DataPtr member points to an extended header item that contains TraceLogging event metadata information.

EVENT_HEADER_EXT_TYPE_PROV_TRAITS

The DataPtr member points to an extended header item that contains provider traits data, for example traits set through EventSetInformation(EventProviderSetTraits) or specified through EVENT_DATA_DESCRIPTOR_TYPE_PROVIDER_METADATA.

EVENT_HEADER_EXT_TYPE_EVENT_KEY

The DataPtr member points to an EVENT_EXTENDED_ITEM_EVENT_KEY structure that contains a unique event identifier which is a 64-bit scalar.

The EnablePropertyEVENT_ENABLE_PROPERTY_EVENT_KEY needs to be passed in for the EnableTrace call for a given provider to enable this feature.

EVENT_HEADER_EXT_TYPE_PROCESS_START_KEY

The DataPtr member points to an EVENT_EXTENDED_ITEM_PROCESS_START_KEY structure that contains a unique process identifier (unique across the boot session). This identifier is a 64-bit scalar.

The EnablePropertyEVENT_ENABLE_PROPERTY_PROCESS_START_KEY needs to be passed in for the EnableTrace call for a given provider to enable this feature.

 

Linkage

Reserved.

Reserved2

Reserved.

DataSize

Size, in bytes, of the extended data that DataPtr points to.

DataPtr

Pointer to the extended data. The ExtType member determines the type of extended data to which this member points.

Requirements

Minimum supported client

Windows Vista [desktop apps only]

Minimum supported server

Windows Server 2008 [desktop apps only]

Header

Evntcons.h

See also

EVENT_RECORD

 

 

Show: