Skip to content

Instantly share code, notes, and snippets.

@aetos382
Last active August 29, 2015 14:08
Show Gist options
  • Save aetos382/9c4d5903e19756c0cd0e to your computer and use it in GitHub Desktop.
Save aetos382/9c4d5903e19756c0cd0e to your computer and use it in GitHub Desktop.
int _tmain(int argc, _TCHAR* argv[])
{
EVENT_TRACE_LOGFILE logFile = {};
logFile.LogFileName = L"Controller1.etl";
logFile.LoggerName = L"EtwSamples.Controller1";
logFile.ProcessTraceMode =
PROCESS_TRACE_MODE_EVENT_RECORD;
logFile.EventRecordCallback = &EventRecordCallback;
logFile.Context = &logFile;
TRACEHANDLE hTrace = OpenTrace(&logFile);
if (hTrace == INVALID_PROCESSTRACE_HANDLE)
{
return 1;
}
ULONG result = ProcessTrace(&hTrace, 1, NULL, NULL);
CloseTrace(hTrace);
return 0;
}
VOID WINAPI EventRecordCallback(_In_ PEVENT_RECORD eventRecord)
{
EVENT_HEADER & header = eventRecord->EventHeader;
if (!IsEqualGUID(header.ProviderId, PROVIDERID_SampleProvider0))
{
return;
}
WCHAR providerId[80] = {};
StringFromGUID2(header.ProviderId, providerId, _countof(providerId));
wprintf_s(L"Provider : %s\n", providerId);
wprintf_s(L"Channel : %u\n", header.EventDescriptor.Channel);
wprintf_s(L"Event : %u (Version: %u)\n", header.EventDescriptor.Id, header.EventDescriptor.Version);
wprintf_s(L"Level : %u\n", header.EventDescriptor.Level);
wprintf_s(L"Task : %u\n", header.EventDescriptor.Task);
wprintf_s(L"Opcode : %u\n", header.EventDescriptor.Opcode);
wprintf_s(L"Keywords : %#0I64x\n", header.EventDescriptor.Keyword);
FILETIME time = { header.TimeStamp.LowPart, header.TimeStamp.HighPart };
FILETIME localTime = {};
SYSTEMTIME st = {};
FileTimeToLocalFileTime(&time, &localTime);
FileTimeToSystemTime(&localTime, &st);
wprintf_s(L"Time : %04u-%02u-%02u %02u:%02u:%02u.%07u\n",
st.wYear, st.wMonth, st.wDay, st.wHour, st.wMinute, st.wSecond,
header.TimeStamp.QuadPart % 10000000);
wprintf_s(L"Process : %u\n", header.ProcessId);
wprintf_s(L"Thread : %u\n", header.ThreadId);
wprintf_s(L"Flags : %#0hx\n", header.Flags);
// ...
wprintf_s(L"Property : %#0hx\n", header.EventProperty);
// ...
_putws(L"");
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment