CLASSIC_EVENT_ID structure (evntrace.h)

Identifies the kernel event for which you want to enable call stack tracing. Used with the TraceStackTracingInfo class of TraceSetInformation.

Syntax

typedef struct _CLASSIC_EVENT_ID {
  GUID  EventGuid;
  UCHAR Type;
  UCHAR Reserved[7];
} CLASSIC_EVENT_ID, *PCLASSIC_EVENT_ID;

Members

EventGuid

The GUID that identifies the kernel event class.

Type

The event type that identifies the event within the kernel event class to enable.

Reserved[7]

Reserved.

Remarks

Useful values for the EventGuid and Type fields can be determined from consulting the WMI classes in the root\wmi namespace. You can also find these values in wmicore.mof (where they are originally defined), or see NT Kernel Logger Constants.

Examples

To enable the read event type for disk IO events, set GUID to 3d6fa8d4-fe05-11d0-9dda-00c04fd7ba7c and Type to 10.

To enable the context switch event type for thread events, set GUID to 3d6fa8d1-fe05-11d0-9dda-00c04fd7ba7c and Type to 36.

Requirements

See also

TraceSetInformation

TRACE_QUERY_INFO_CLASS

NT Kernel Logger Constants