TdhGetWppMessage function (tdh.h)

Article
10/13/2021

Retrieves the formatted WPP message embedded into an EVENT_RECORD structure.

Syntax

TDHSTATUS TdhGetWppMessage(
  [in]      TDH_HANDLE    Handle,
  [in]      PEVENT_RECORD EventRecord,
  [in, out] PULONG        BufferSize,
  [out]     PBYTE         Buffer
);

Parameters

[in] Handle

Type: TDH_HANDLE

A valid decoding handle.

[in] EventRecord

Type: PEVENT_RECORD

The event record passed to your EventRecordCallback callback.

[in, out] BufferSize

Type: PULONG

Size of the Buffer parameter, in bytes.

[out] Buffer

Type: PBYTE

User-allocated buffer that receives the property data.

Return value

Type: ULONG

Returns ERROR_SUCCESS if successful. Otherwise, this function returns one of the following return codes in addition to others.

Return code	Description
ERROR_NOT_FOUND	The specified property was not found.
ERROR_INSUFFICIENT_BUFFER	BufferSize is too small. To get the required buffer size, call TdhGetPropertySize.
ERROR_INVALID_PARAMETER	One or more of the parameters is not valid.

Remarks

To retrieve a specific property instead of the decoded event message without specifying a property name, call TdhGetWppProperty.

Requirements

Requirement	Value
Minimum supported client	Windows 8 [desktop apps only]
Minimum supported server	Windows Server 2012 [desktop apps only]
Target Platform	Windows
Header	tdh.h
Library	Tdh.lib
DLL	Tdh.dll