Event Filter Descriptor structure

The EVENT_FILTER_DESCRIPTOR structure supplements the event provider, level, and keyword data that determines which events are reported and traced. The EVENT_FILTER_DESCRIPTOR structure gives the event provider greater control over the selection of events for reporting and tracing.

Syntax


typedef struct _EVENT_FILTER_DESCRIPTOR {
  ULONGLONG Ptr;
  ULONG     Size;
  ULONG     Type;
} EVENT_FILTER_DESCRIPTOR, *PEVENT_FILTER_DESCRIPTOR;

Members

Ptr

A pointer to the filter data.

Size

The size of the filter data, in bytes. The maximum size is 1024 bytes.

Type

The type of filter data. The type is application-defined. An event controller that knows about the provider and knows details about the provider's events can use the Type field to send the provider an arbitrary set of data for use as enhancements to the filtering of events.

Remarks

You pass a pointer to the EVENT_FILTER_DESCRIPTOR structure when you create the optional driver-supplied EtwEnableCallbackfunction. When you register the driver with ETW, the EtwRegister function takes a pointer to the EtwEnableCallback function as a parameter.

Requirements

Version

Available in Windows Vista and later versions of Windows.

Header

Evntprov.h (include Wdm.h or Ntddk.h)

See also

EtwEnableCallback
EtwRegister

 

 

Send comments about this topic to Microsoft

Show: