EVENT_FILTER_HEADER structure (evntprov.h)

Defines the header data that must precede the filter data that is defined in the instrumentation manifest.

Syntax

typedef struct _EVENT_FILTER_HEADER {
  USHORT    Id;
  UCHAR     Version;
  UCHAR     Reserved[5];
  ULONGLONG InstanceId;
  ULONG     Size;
  ULONG     NextOffset;
} EVENT_FILTER_HEADER, *PEVENT_FILTER_HEADER;

Members

Id

The identifier that identifies the filter in the manifest for a schematized filter. The value attribute of the filter element contains the identifier.

Version

The version number of the filter for a schematized filter. The version attribute of the filter element contains the version number.

Reserved[5]

Reserved

InstanceId

An identifier that identifies the session that passed the filter. ETW sets this value; the session must set this member to zero.

Providers use this value to set the Filter parameter of EventWriteEx to prevent the event from being written to the session if the event data does not match the filter criteria (the provider determines the semantics of how the filter data is used in determining whether the event is written to the session).

Size

The size, in bytes, of this header and the filter data that is appended to the end of this header.

NextOffset

The offset from the beginning of this filter object to the next filter object. The value is zero if there are no more filter blocks. ETW sets this value; the session must set this member to zero.

Remarks

The filter data that you pass to the provider also includes a header. The following shows an example of how you would define a filter that contained three integers:

struct _MY_FILTER {
    EVENT_FILTER_HEADER FilterHeader;
    ULONG Int1;
    ULONG Int2;
    ULONG Int3;
} MY_FILTER, *MY_FILTER;

MY_FILTER FilterData;

Requirements

See also

ENABLE_TRACE_PARAMETERS

EVENT_FILTER_DESCRIPTOR

EnableTrace

EnableTraceEx

EnableTraceEx2