//----------------------------------------------------------------------------------------------------------------------
/// \file
/// Consumer class for Real time Etw events
// Copyright (c) Microsoft Corporation. All Rights Reserved.
//----------------------------------------------------------------------------------------------------------------------
#pragma once
#include "EtwProcessor.h"
#include "EtwConsumer.h"
// Suppress warning 4481: nonstandard extension used: override specifier 'override'
#pragma warning(push)
#pragma warning(disable: 4481)
namespace Etw { namespace Processor
{
///
/// Struct to encapsulate options for customizing how to set up an EtwRealtimeConsumer
///
struct EtwRealtimeConsumerOptions
{
static const unsigned long c_currentVersion = 1;
/// Version number of the struct
unsigned long Version = c_currentVersion;
/// How long to wait before flushing ETW events
unsigned long FlushTimerInMs = 500;
explicit EtwRealtimeConsumerOptions(unsigned long flushTimerInMs = 500)
: FlushTimerInMs(flushTimerInMs)
{
}
};
///
/// Consumer class for Real time Etw events
///
class EtwRealtimeConsumer : public EtwConsumer
{
public:
/// Construct a real time etw consumer
/// Name of the trace session to consume the events from
EtwRealtimeConsumer(const wchar_t* pszTraceName)
{
Initialize(pszTraceName, EtwRealtimeConsumerOptions());
}
/// Construct a real time etw consumer
/// Name of the trace session to consume the events from
/// Options to configure the consumer
EtwRealtimeConsumer(const wchar_t* pszTraceName, const EtwRealtimeConsumerOptions& options)
{
Initialize(pszTraceName, options);
}
ETWPROCESSOR_API ~EtwRealtimeConsumer();
/// Method to add/register an event provider in this trace session
/// Guid of the event provider
/// S_OK if successfully enabled the provider
ETWPROCESSOR_API HRESULT EnableProvider(const GUID& providerGuid);
/// Method to add/register an event provider in this trace session
/// Guid of the event provider
/// Provider-defined value that specifies level of detail included in the event.
/// This is used for the Level parameter of EnableTraceEx2.
/// Bit mask of keywords that determine the category of events.
/// This is used for the MatchAnyKeyword parameter of EnableTraceEx2.
/// Bit mask of keywords that determine the category of events.
/// This is used for the MatchAllKeyword parameter of EnableTraceEx2.
/// Optional information that Etw can include when writing the events.
/// This is used in ENABLE_TRACE_PARAMETERS::EnableProperty.
/// S_OK if successfully enabled the provider
ETWPROCESSOR_API HRESULT EnableProvider(const GUID& providerGuid, unsigned char level,
unsigned __int64 matchAnyKeyword, unsigned __int64 matchAllKeyword, unsigned long enableProperty);
/// Method to remove/un-register an event provider in this trace session
/// Guid of the event provider
/// S_OK if successfully disabled the provider
ETWPROCESSOR_API HRESULT DisableProvider(const GUID& provierGuid);
// Open a trace for the registered providers.
ETWPROCESSOR_API virtual HRESULT OpenTraceW() override;
// Flush the underlying ETW trace session.
ETWPROCESSOR_API HRESULT Flush();
private:
EtwRealtimeConsumer(const EtwRealtimeConsumer&) = delete;
EtwRealtimeConsumer& operator=(const EtwRealtimeConsumer&) = delete;
// We export Initialize methods instead of exporting the constructor to force the calling DLL to use its
// own virtual function table. That way the new and delete happen from the same DLL.
ETWPROCESSOR_API void Initialize(const wchar_t* pszTraceName, const EtwRealtimeConsumerOptions& options);
#if defined(ETWPROCESSOR_FULL_BUILD)
ETWPROCESSOR_API void Initialize(const unsigned short* pszTraceName, const EtwRealtimeConsumerOptions& options);
#endif
// EventProvider is an internal class used within ETW Processor as part of the EtwWaiter implementation.
// It is a friend to provide access to FlushImpl and m_status. We don't currently expose those publicly.
friend class EventProvider;
void FlushImpl() const;
// This stores the result of construction. The constructor itself does not throw on failure.
// Any method call on an instance which failed construction will return this error code.
HRESULT m_status = S_OK;
struct EtwRealImpl;
EtwRealImpl* m_pImpl = nullptr;
};
}/* namespace Processor */}/* namespace Etw */
#pragma warning(pop)