//---------------------------------------------------------------------------------------------------------------------- /// \file /// Consumer class for Real time Etw events // Copyright (c) Microsoft Corporation. All Rights Reserved. //---------------------------------------------------------------------------------------------------------------------- #pragma once #include "EtwProcessor.h" #include "EtwConsumer.h" // Suppress warning 4481: nonstandard extension used: override specifier 'override' #pragma warning(push) #pragma warning(disable: 4481) namespace Etw { namespace Processor { /// /// Struct to encapsulate options for customizing how to set up an EtwRealtimeConsumer /// struct EtwRealtimeConsumerOptions { static const unsigned long c_currentVersion = 1; /// Version number of the struct unsigned long Version = c_currentVersion; /// How long to wait before flushing ETW events unsigned long FlushTimerInMs = 500; explicit EtwRealtimeConsumerOptions(unsigned long flushTimerInMs = 500) : FlushTimerInMs(flushTimerInMs) { } }; /// /// Consumer class for Real time Etw events /// class EtwRealtimeConsumer : public EtwConsumer { public: /// Construct a real time etw consumer /// Name of the trace session to consume the events from EtwRealtimeConsumer(const wchar_t* pszTraceName) { Initialize(pszTraceName, EtwRealtimeConsumerOptions()); } /// Construct a real time etw consumer /// Name of the trace session to consume the events from /// Options to configure the consumer EtwRealtimeConsumer(const wchar_t* pszTraceName, const EtwRealtimeConsumerOptions& options) { Initialize(pszTraceName, options); } ETWPROCESSOR_API ~EtwRealtimeConsumer(); /// Method to add/register an event provider in this trace session /// Guid of the event provider /// S_OK if successfully enabled the provider ETWPROCESSOR_API HRESULT EnableProvider(const GUID& providerGuid); /// Method to add/register an event provider in this trace session /// Guid of the event provider /// Provider-defined value that specifies level of detail included in the event. /// This is used for the Level parameter of EnableTraceEx2. /// Bit mask of keywords that determine the category of events. /// This is used for the MatchAnyKeyword parameter of EnableTraceEx2. /// Bit mask of keywords that determine the category of events. /// This is used for the MatchAllKeyword parameter of EnableTraceEx2. /// Optional information that Etw can include when writing the events. /// This is used in ENABLE_TRACE_PARAMETERS::EnableProperty. /// S_OK if successfully enabled the provider ETWPROCESSOR_API HRESULT EnableProvider(const GUID& providerGuid, unsigned char level, unsigned __int64 matchAnyKeyword, unsigned __int64 matchAllKeyword, unsigned long enableProperty); /// Method to remove/un-register an event provider in this trace session /// Guid of the event provider /// S_OK if successfully disabled the provider ETWPROCESSOR_API HRESULT DisableProvider(const GUID& provierGuid); // Open a trace for the registered providers. ETWPROCESSOR_API virtual HRESULT OpenTraceW() override; // Flush the underlying ETW trace session. ETWPROCESSOR_API HRESULT Flush(); private: EtwRealtimeConsumer(const EtwRealtimeConsumer&) = delete; EtwRealtimeConsumer& operator=(const EtwRealtimeConsumer&) = delete; // We export Initialize methods instead of exporting the constructor to force the calling DLL to use its // own virtual function table. That way the new and delete happen from the same DLL. ETWPROCESSOR_API void Initialize(const wchar_t* pszTraceName, const EtwRealtimeConsumerOptions& options); #if defined(ETWPROCESSOR_FULL_BUILD) ETWPROCESSOR_API void Initialize(const unsigned short* pszTraceName, const EtwRealtimeConsumerOptions& options); #endif // EventProvider is an internal class used within ETW Processor as part of the EtwWaiter implementation. // It is a friend to provide access to FlushImpl and m_status. We don't currently expose those publicly. friend class EventProvider; void FlushImpl() const; // This stores the result of construction. The constructor itself does not throw on failure. // Any method call on an instance which failed construction will return this error code. HRESULT m_status = S_OK; struct EtwRealImpl; EtwRealImpl* m_pImpl = nullptr; }; }/* namespace Processor */}/* namespace Etw */ #pragma warning(pop)