//---------------------------------------------------------------------------------------------------------------------- /// \file /// Controller class for event trace sessions // Copyright (c) Microsoft Corporation. All Rights Reserved. //---------------------------------------------------------------------------------------------------------------------- #pragma once #include "EtwProcessor.h" #include namespace Etw { namespace Processor { /// /// Struct to encapsulate options for customizing how to set up an EtwController /// struct EtwControllerOptions { static const unsigned long c_defaultMaxFileSize = 200; static const unsigned long c_currentVersion = 2; /// Version number of the struct unsigned long Version = c_currentVersion; /// How long to wait before flushing ETW events unsigned long FlushTimerInMs = 500; /// Maximum file size in megabytes unsigned long MaximumFileSize = c_defaultMaxFileSize; /// Append existing etl file or write new one bool AppendEtlFile = false; /// Clock Resolution to use. Note that EVENT_TRACE_CLOCK_SYSTEMTIME (0x00000002) is recommended when AppendEtlFile is set to true unsigned long ClockResolution = 0x00000001; // EVENT_TRACE_CLOCK_PERFCOUNTER -- we don't define to prevent redefine collisions /// Default constructor - will use the default value for all options explicit EtwControllerOptions(unsigned long flushTimerInMs = 500, unsigned long maximumFileSize = c_defaultMaxFileSize, bool appendEtlFile = false, unsigned long clockResolution = 0x00000001 /*EVENT_TRACE_CLOCK_PERFCOUNTER*/) : FlushTimerInMs(flushTimerInMs) , MaximumFileSize(maximumFileSize) , AppendEtlFile(appendEtlFile) , ClockResolution(clockResolution) { } }; /// /// Controller class to start and stop trace sessions /// class EtwController { public: /// Method to start an event trace session /// Name of the trace session /// Maximum file size in megabytes /// S_OK if successfully started the trace ETWPROCESSOR_API static HRESULT __stdcall StartEtwTrace(const wchar_t* pszTraceName, unsigned long maximumFileSize = EtwControllerOptions::c_defaultMaxFileSize); /// Method to start an event trace session /// Name of the trace session /// Options to configure the ETW trace session /// S_OK if successfully started the trace ETWPROCESSOR_API static HRESULT __stdcall StartEtwTrace(const wchar_t* pszTraceName, const EtwControllerOptions& options); /// Method to start an event trace session /// Name of the trace session /// Name of the etl file /// Maximum file size in megabytes /// S_OK if successfully started the trace ETWPROCESSOR_API static HRESULT __stdcall StartEtwTrace(const wchar_t* pszTraceName, const wchar_t* pszFileName, unsigned long maximumFileSize = EtwControllerOptions::c_defaultMaxFileSize); /// Method to start an event trace session /// Name of the trace session /// Name of the etl file /// Options to configure the ETW trace session /// S_OK if successfully started the trace ETWPROCESSOR_API static HRESULT __stdcall StartEtwTrace(const wchar_t* pszTraceName, const wchar_t* pszFileName, const EtwControllerOptions& options); /// Method to stop an event trace session /// Name of the trace session /// S_OK if successfully stopped the trace ETWPROCESSOR_API static HRESULT __stdcall StopEtwTrace(const wchar_t* pszTraceName); /// Method to add/register an event provider in a trace session /// Name of the trace session /// Guid of the event provider /// Provider-defined value that specifies level of detail included in the event. /// This is used for the Level parameter of EnableTraceEx2. /// Bit mask of keywords that determine the category of events. /// This is used for the MatchAnyKeyword parameter of EnableTraceEx2. /// Bit mask of keywords that determine the category of events. /// This is used for the MatchAllKeyword parameter of EnableTraceEx2. /// Optional information that Etw can include when writing the events. /// This is used in ENABLE_TRACE_PARAMETERS::EnableProperty. /// S_OK if successfully enabled the provider ETWPROCESSOR_API static HRESULT __stdcall EnableProvider(const wchar_t* pszTraceName, const GUID& providerGuid, unsigned char level, unsigned __int64 matchAnyKeyword, unsigned __int64 matchAllKeyword, unsigned long enableProperty); /// Method to add/register an event provider in a trace session /// Name of the trace session /// Guid of the event provider /// S_OK if successfully enabled the provider ETWPROCESSOR_API static HRESULT __stdcall EnableProvider(const wchar_t* pszTraceName, const GUID& providerGuid); /// Method to un-register/remove an event provider in a trace session /// Name of the trace session /// Guid of the event provider /// S_OK if successfully disabled the provider ETWPROCESSOR_API static HRESULT __stdcall DisableProvider(const wchar_t* pszTraceName, const GUID& providerGuid); /// Method to flush events of a trace session /// Name of the trace session /// S_OK if successfully flushed the events ETWPROCESSOR_API static HRESULT __stdcall Flush(const wchar_t* pszTraceName); #if defined(ETWPROCESSOR_FULL_BUILD) ETWPROCESSOR_API static HRESULT __stdcall StartEtwTrace(const unsigned short* pszTraceName, unsigned long maximumFileSize = EtwControllerOptions::c_defaultMaxFileSize) { return EtwController::StartEtwTrace(reinterpret_cast(pszTraceName), maximumFileSize); } ETWPROCESSOR_API static HRESULT __stdcall StartEtwTrace(const unsigned short* pszTraceName, const EtwControllerOptions&) { return EtwController::StartEtwTrace(reinterpret_cast(pszTraceName)); } ETWPROCESSOR_API static HRESULT __stdcall StartEtwTrace(const unsigned short* pszTraceName, const unsigned short* pszFileName, unsigned long maximumFileSize = EtwControllerOptions::c_defaultMaxFileSize) { return EtwController::StartEtwTrace(reinterpret_cast(pszTraceName), reinterpret_cast(pszFileName), maximumFileSize); } ETWPROCESSOR_API static HRESULT __stdcall StartEtwTrace(const unsigned short* pszTraceName, const unsigned short* pszFileName, const EtwControllerOptions&) { return EtwController::StartEtwTrace(reinterpret_cast(pszTraceName), reinterpret_cast(pszFileName)); } ETWPROCESSOR_API static HRESULT __stdcall StopEtwTrace(const unsigned short* pszTraceName) { return EtwController::StopEtwTrace(reinterpret_cast(pszTraceName)); } ETWPROCESSOR_API static HRESULT __stdcall EnableProvider(const unsigned short* pszTraceName, const GUID& providerGuid, unsigned char level, unsigned __int64 matchAnyKeyword, unsigned __int64 matchAllKeyword, unsigned long enableProperty) { return EtwController::EnableProvider(reinterpret_cast(pszTraceName), providerGuid, level, matchAnyKeyword, matchAllKeyword, enableProperty); } ETWPROCESSOR_API static HRESULT __stdcall EnableProvider(const unsigned short* pszTraceName, const GUID& providerGuid) { return EtwController::EnableProvider(reinterpret_cast(pszTraceName), providerGuid); } ETWPROCESSOR_API static HRESULT __stdcall DisableProvider(const unsigned short* pszTraceName, const GUID& providerGuid) { return EtwController::DisableProvider(reinterpret_cast(pszTraceName), providerGuid); } ETWPROCESSOR_API static HRESULT __stdcall Flush(const unsigned short* pszTraceName) { return EtwController::Flush(reinterpret_cast(pszTraceName)); } #endif private: EtwController();//not implemented ~EtwController();//not implemented EtwController(const EtwController&);//not implemented EtwController& operator=(const EtwController&);//not implemented }; }/* namespace Processor */}/* namespace Etw */