Windows Dev Center

Expand Minimize

TraceSetInformation function

The TraceSetInformation function enables or disables event tracing session settings for the specified information class.

Syntax


ULONG WINAPI TraceSetInformation(
  _In_ TRACEHANDLE      SessionHandle,
  _In_ TRACE_INFO_CLASS InformationClass,
  _In_ PVOID            TraceInformation,
  _In_ ULONG            InformationLength
);

Parameters

SessionHandle [in]

A handle of the event tracing session that wants to capture the specified information. The StartTrace function returns this handle.

InformationClass [in]

The information class to enable or disable. The information that the class captures is included in the extended data section of the event. For a list of information classes that you can enable, see the TRACE_INFO_CLASS enumeration.

TraceInformation [in]

A pointer to information class specific data; the information class determines the contents of this parameter. For example, for the TraceStackTracingInfo information class, this parameter is an array of CLASSIC_EVENT_ID structures. The structures specify the event GUIDs for which stack tracing is enabled. The array is limited to 256 elements.

InformationLength [in]

The size, in bytes, of the data in the TraceInformation buffer.

Return value

If the function succeeds, the return value is ERROR_SUCCESS.

If the function fails, the return value is one of the following error codes.

Return codeDescription
ERROR_BAD_LENGTH

The program issued a command but the command length is incorrect. This error is returned if the InformationLength parameter is less than a minimum size.

ERROR_INVALID_PARAMETER

The parameter is incorrect.

ERROR_NOT_SUPPORTED

The request is not supported.

Other

Use FormatMessage to obtain the message string for the returned error.

 

Remarks

Call this function after calling StartTrace.

If the InformationClass parameter is set to TraceStackTracingInfo, calling this function enables stack tracing of the specified kernel events. Subsequent calls to this function overwrites the previous list of kernel events for which stack tracing is enabled. To disable stack tracing, call this function with InformationClass set to TraceStackTracingInfo and InformationLength set to 0.

The extended data section of the event will include the call stack. The StackWalk_Event MOF class defines the layout of the extended data.

Typically, on 64-bit computers, you cannot capture the kernel stack in certain contexts when page faults are not allowed. To enable walking the kernel stack on x64, set the DisablePagingExecutive Memory Management registry value to 1. The DisablePagingExecutive registry value is located under the following registry key:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Memory Management

You should consider the cost of setting this registry value before doing so.

Requirements

Minimum supported client

Windows 7 [desktop apps only]

Minimum supported server

Windows Server 2008 R2 [desktop apps only]

Header

Evntrace.h

Library

Sechost.lib on Windows 8.1 and Windows Server 2012 R2;
Advapi32.lib on Windows 8, Windows Server 2012, Windows 7, and Windows Server 2008 R2

DLL

Sechost.dll on Windows 8.1 and Windows Server 2012 R2;
Advapi32.dll on Windows 8, Windows Server 2012, Windows 7, and Windows Server 2008 R2

See also

TRACE_INFO_CLASS
TraceQueryInformation

 

 

Community Additions

ADD
Show:
© 2015 Microsoft