Edit

Share via

EVENT_HEADER_EXTENDED_DATA_ITEM structure (relogger.h)

  • Article

The EVENT_HEADER_EXTENDED_DATA_ITEM structure defines the extended data that ETW collects as part of the event data.

Syntax

typedef struct _EVENT_HEADER_EXTENDED_DATA_ITEM {
  USHORT    Reserved1;
  USHORT    ExtType;
  USHORT    Linkage;
  USHORT    DataSize;
  ULONGLONG DataPtr;
} EVENT_HEADER_EXTENDED_DATA_ITEM, *PEVENT_HEADER_EXTENDED_DATA_ITEM;

Members

Reserved1

Reserved.

ExtType

Type of extended data. The following are possible values.

Value Meaning
EVENT_HEADER_EXT_TYPE_RELATED_ACTIVITYID
 The DataPtr member points to an EVENT_EXTENDED_ITEM_RELATED_ACTIVITYID structure that contains the related activity identifier if you called EventWriteTransfer to write the event.
EVENT_HEADER_EXT_TYPE_SID
 The DataPtr member points to a SID structure that contains the security identifier (SID) of the user that logged the event. ETW includes the SID if you set the EnableProperty parameter of EnableTraceEx to EVENT_ENABLE_PROPERTY_SID.
EVENT_HEADER_EXT_TYPE_TS_ID
 The DataPtr member points to an EVENT_EXTENDED_ITEM_TS_ID structure that contains the terminal session identifier. ETW includes the terminal session identifier if you set the EnableProperty parameter of EnableTraceEx to EVENT_ENABLE_PROPERTY_TS_ID.
EVENT_HEADER_EXT_TYPE_INSTANCE_INFO
 The DataPtr member points to an EVENT_EXTENDED_ITEM_INSTANCE structure that contains the activity identifier if you called TraceEventInstance to write the event.
EVENT_HEADER_EXT_TYPE_STACK_TRACE32
 The DataPtr member points to an EVENT_EXTENDED_ITEM_STACK_TRACE32 structure that contains the call stack if the event is captured on a 32-bit computer.
EVENT_HEADER_EXT_TYPE_STACK_TRACE64
 The DataPtr member points to an EVENT_EXTENDED_ITEM_STACK_TRACE64 structure that contains the call stack if the event is captured on a 64-bit computer.
EVENT_HEADER_EXT_TYPE_EVENT_SCHEMA_TL
 The DataPtr member points to an extended header item that contains TraceLogging event metadata information.
EVENT_HEADER_EXT_TYPE_PROV_TRAITS
 The DataPtr member points to an extended header item that contains provider traits data, for example traits set through EventSetInformation(EventProviderSetTraits) or specified through EVENT_DATA_DESCRIPTOR_TYPE_PROVIDER_METADATA.
EVENT_HEADER_EXT_TYPE_EVENT_KEY
 The DataPtr member points to an EVENT_EXTENDED_ITEM_EVENT_KEY structure that contains a unique event identifier which is a 64-bit scalar.

The EnableProperty EVENT_ENABLE_PROPERTY_EVENT_KEY needs to be passed in for the EnableTrace call for a given provider to enable this feature.
EVENT_HEADER_EXT_TYPE_PROCESS_START_KEY
 The DataPtr member points to an EVENT_EXTENDED_ITEM_PROCESS_START_KEY structure that contains a unique process identifier (unique across the boot session). This identifier is a 64-bit scalar.

The EnableProperty EVENT_ENABLE_PROPERTY_PROCESS_START_KEY needs to be passed in for the EnableTrace call for a given provider to enable this feature.

Linkage

Reserved.

DataSize

Size, in bytes, of the extended data that DataPtr points to.

DataPtr

Pointer to the extended data. The ExtType member determines the type of extended data to which this member points.

Requirements

Requirement Value
Minimum supported client Windows Vista [desktop apps only]
Minimum supported server Windows Server 2008 [desktop apps only]
Header relogger.h (include Evntcons.h)

See also

EVENT_RECORD