EVENT_HEADER_EXTENDED_DATA_ITEM structure

The EVENT_HEADER_EXTENDED_DATA_ITEM structure defines the extended data that ETW collects as part of the event data.

Syntax

typedef struct _EVENT_HEADER_EXTENDED_DATA_ITEM {
  USHORT    Reserved1;
  USHORT    ExtType;
  struct {
    USHORT Linkage  :1;
    USHORT Reserved2  :15;
  };
  USHORT    DataSize;
  ULONGLONG DataPtr;
} EVENT_HEADER_EXTENDED_DATA_ITEM, *PEVENT_HEADER_EXTENDED_DATA_ITEM;

Members

Reserved1

Reserved.

ExtType

Type of extended data. The following are possible values.

Value	Meaning
EVENT_HEADER_EXT_TYPE_RELATED_ACTIVITYID	The DataPtr member points to an EVENT_EXTENDED_ITEM_RELATED_ACTIVITYID structure that contains the related activity identifier if you called EventWriteTransfer to write the event.
EVENT_HEADER_EXT_TYPE_SID	The DataPtr member points to a SID structure that contains the security identifier (SID) of the user that logged the event. ETW includes the SID if you set the EnableProperty parameter of EnableTraceEx to EVENT_ENABLE_PROPERTY_SID.
EVENT_HEADER_EXT_TYPE_TS_ID	The DataPtr member points to an EVENT_EXTENDED_ITEM_TS_ID structure that contains the terminal session identifier. ETW includes the terminal session identifier if you set the EnableProperty parameter of EnableTraceEx to EVENT_ENABLE_PROPERTY_TS_ID.
EVENT_HEADER_EXT_TYPE_INSTANCE_INFO	The DataPtr member points to an EVENT_EXTENDED_ITEM_INSTANCE structure that contains the activity identifier if you called TraceEventInstance to write the event.
EVENT_HEADER_EXT_TYPE_STACK_TRACE32	The DataPtr member points to an EVENT_EXTENDED_ITEM_STACK_TRACE32 structure that contains the call stack if the event is captured on a 32-bit computer.
EVENT_HEADER_EXT_TYPE_STACK_TRACE64	The DataPtr member points to an EVENT_EXTENDED_ITEM_STACK_TRACE64 structure that contains the call stack if the event is captured on a 64-bit computer.
EVENT_HEADER_EXT_TYPE_EVENT_SCHEMA_TL	The DataPtr member points to an extended header item that contains TraceLogging event metadata information.
EVENT_HEADER_EXT_TYPE_PROV_TRAITS	The DataPtr member points to an extended header item that contains provider traits data, for example traits set through EventSetInformation(EventProviderSetTraits) or specified through EVENT_DATA_DESCRIPTOR_TYPE_PROVIDER_METADATA.
EVENT_HEADER_EXT_TYPE_EVENT_KEY	The DataPtr member points to an EVENT_EXTENDED_ITEM_EVENT_KEY structure that contains a unique event identifier which is a 64-bit scalar. The EnablePropertyEVENT_ENABLE_PROPERTY_EVENT_KEY needs to be passed in for the EnableTrace call for a given provider to enable this feature.
EVENT_HEADER_EXT_TYPE_PROCESS_START_KEY	The DataPtr member points to an EVENT_EXTENDED_ITEM_PROCESS_START_KEY structure that contains a unique process identifier (unique across the boot session). This identifier is a 64-bit scalar. The EnablePropertyEVENT_ENABLE_PROPERTY_PROCESS_START_KEY needs to be passed in for the EnableTrace call for a given provider to enable this feature.

 

Linkage

Reserved.

Reserved2

Reserved.

DataSize

Size, in bytes, of the extended data that DataPtr points to.

DataPtr

Pointer to the extended data. The ExtType member determines the type of extended data to which this member points.

Requirements

See also

EVENT_RECORD