etw

package module

Go to main page

Versions in this module

v1

v1.1.3

Feb 23, 2023

v1.1.2

Feb 23, 2023

v1.1.1

Jan 6, 2023

v1.1.0

Oct 26, 2022

Changes in this version

+ const EVENT_ENABLE_PROPERTY_EXCLUDE_INPRIVATE — windows/amd64

+ const EVENT_ENABLE_PROPERTY_IGNORE_KEYWORD_0 — windows/amd64

+ const EVENT_ENABLE_PROPERTY_SID — windows/amd64

+ const EVENT_ENABLE_PROPERTY_STACK_TRACE — windows/amd64

+ const EVENT_ENABLE_PROPERTY_TS_ID — windows/amd64

+ const EVENT_TRACE_INDEPENDENT_SESSION_MODE — windows/amd64

+ const EVENT_TRACE_SECURE_MODE — windows/amd64

+ const EVENT_TRACE_SYSTEM_LOGGER_MODE — windows/amd64

+ const TRACE_LEVEL_CRITICAL — windows/amd64

+ const TRACE_LEVEL_ERROR — windows/amd64

+ const TRACE_LEVEL_INFORMATION — windows/amd64

+ const TRACE_LEVEL_VERBOSE — windows/amd64

+ const TRACE_LEVEL_WARNING — windows/amd64

+ const TdhIntypeBinary — windows/amd64

+ const TdhOuttypeIpv6 — windows/amd64

+ func KillSession(name string) error — windows/amd64

+ type CompareOperation uint16

+ const CompareIntegerBetween

+ const CompareIntegerEqual

+ const CompareIntegerGreater

+ const CompareIntegerGreatorOrEqual

+ const CompareIntegerLess

+ const CompareIntegerLessOrEqual

+ const CompareIntegerModulo

+ const CompareIntegerNotBetween

+ const CompareIntegerNotEqual

+ const CompareStringContains

+ const CompareStringEquals

+ const CompareStringNotContains

+ const CompareStringNotEquals

+ type EnableFlag uint32 — windows/amd64

+ const EVENT_TRACE_FLAG_ALPC

+ const EVENT_TRACE_FLAG_CSWITCH

+ const EVENT_TRACE_FLAG_DBGPRINT

+ const EVENT_TRACE_FLAG_DEBUG_EVENTS

+ const EVENT_TRACE_FLAG_DISK_FILE_IO

+ const EVENT_TRACE_FLAG_DISK_IO

+ const EVENT_TRACE_FLAG_DISK_IO_INIT

+ const EVENT_TRACE_FLAG_DISPATCHER

+ const EVENT_TRACE_FLAG_DPC

+ const EVENT_TRACE_FLAG_DRIVER

+ const EVENT_TRACE_FLAG_ENABLE_RESERVE

+ const EVENT_TRACE_FLAG_EXTENSION

+ const EVENT_TRACE_FLAG_FILE_IO

+ const EVENT_TRACE_FLAG_FILE_IO_INIT

+ const EVENT_TRACE_FLAG_FORWARD_WMI

+ const EVENT_TRACE_FLAG_IMAGE_LOAD

+ const EVENT_TRACE_FLAG_INTERRUPT

+ const EVENT_TRACE_FLAG_JOB

+ const EVENT_TRACE_FLAG_MEMORY_HARD_FAULTS

+ const EVENT_TRACE_FLAG_MEMORY_PAGE_FAULTS

+ const EVENT_TRACE_FLAG_NETWORK_TCPIP

+ const EVENT_TRACE_FLAG_NO_SYSCONFIG

+ const EVENT_TRACE_FLAG_OBTRACE

+ const EVENT_TRACE_FLAG_PROCESS

+ const EVENT_TRACE_FLAG_PROCESS_COUNTERS

+ const EVENT_TRACE_FLAG_PROFILE

+ const EVENT_TRACE_FLAG_REGISTRY

+ const EVENT_TRACE_FLAG_RUNDOWN

+ const EVENT_TRACE_FLAG_SPLIT_IO

+ const EVENT_TRACE_FLAG_SYSTEMCALL

+ const EVENT_TRACE_FLAG_THREAD

+ const EVENT_TRACE_FLAG_VAMAP

+ const EVENT_TRACE_FLAG_VIRTUAL_ALLOC

+ type EnableProperty uint32 — windows/amd64

+ type Event struct — windows/amd64

+ Header EventHeader

+ func (e *Event) EventProperties() (map[string]interface{}, error)

+ func (e *Event) ExtendedInfo() ExtendedEventInfo

+ func (e *Event) UserData() []byte

+ type EventCallback func(e *Event) — windows/amd64

+ type EventDescriptor struct

+ Channel uint8

+ ID uint16

+ Keyword uint64

+ Level uint8

+ OpCode uint8

+ Task uint16

+ Version uint8

+ type EventFieldType uint32

+ const EventChannelInformation

+ const EventKeywordInformation

+ const EventLevelInformation

+ const EventOpcodeInformation

+ const EventTaskInformation

+ type EventFilter interface

+ EventFilterDescriptor func() (EventFilterDescriptor, error)

+ Merge func(filter EventFilter) (EventFilter, error)

+ Type func() EventFilterType

+ type EventFilterDescriptor struct

+ Close func() error

+ Descriptor eventFilterDescriptorC

+ type EventFilterType uint32

+ type EventHeader struct — windows/amd64

+ ActivityID windows.GUID

+ Flags uint16

+ KernelTime uint32

+ ProcessID uint32

+ ProcessorTime uint64

+ ProviderID windows.GUID

+ ThreadID uint32

+ TimeStamp time.Time

+ UserTime uint32

+ func (h EventHeader) HasCPUTime() bool

+ type EventIdFilter struct

+ EventIds []uint16

+ PositiveFilter bool

+ func (e EventIdFilter) EventFilterDescriptor() (EventFilterDescriptor, error)

+ func (e EventIdFilter) Merge(other EventFilter) (EventFilter, error)

+ func (e EventIdFilter) Type() EventFilterType

+ type EventInstanceInfo struct — windows/amd64

+ InstanceID uint32

+ ParentGUID windows.GUID

+ ParentInstanceID uint32

+ type EventPayloadCompare struct

+ Field string

+ Operation CompareOperation

+ Value string

+ type EventPayloadFilter struct

+ AnyMatches bool

+ Comparisons []EventPayloadCompare

+ FilteredDescriptor EventDescriptor

+ FilteredProvider windows.GUID

+ func (EventPayloadFilter) Merge(filter EventFilter) (EventFilter, error)

+ func (EventPayloadFilter) Type() EventFilterType

+ func (e EventPayloadFilter) EventFilterDescriptor() (EventFilterDescriptor, error)

+ type EventStackTrace struct — windows/amd64

+ Addresses []uint64

+ MatchedID uint64

+ type ExistsError struct — windows/amd64

+ SessionName string

+ func (e ExistsError) Error() string

+ type ExtendedEventInfo struct — windows/amd64

+ ActivityID *windows.GUID

+ InstanceInfo *EventInstanceInfo

+ SessionID *uint32

+ StackTrace *EventStackTrace

+ UserSID *windows.SID

+ type LogFileMode uint32 — windows/amd64

+ type Provider struct

+ Guid windows.GUID

+ Name string

+ func ListProviders() ([]Provider, error)

+ func LookupProvider(name string) (Provider, error)

+ func (p Provider) ListChannels() ([]ProviderField, error)

+ func (p Provider) ListEvents() ([]EventDescriptor, error)

+ func (p Provider) ListKeywords() ([]ProviderField, error)

+ func (p Provider) ListLevels() ([]ProviderField, error)

+ func (p Provider) QueryField(fieldValue uint64, fieldType EventFieldType) ([]ProviderField, error)

+ func (p Provider) QueryOpcode(taskValue uint16, opcodeValue uint8) (ProviderField, error)

+ func (p Provider) QueryTask(taskValue uint16) (ProviderField, error)

+ type ProviderField struct

+ Description string

+ ID uint64

+ Name string

+ type ProviderOption func(cfg *ProviderOptions) — windows/amd64

+ func WithFilter(f EventFilter) ProviderOption

+ func WithLevel(lvl TraceLevel) ProviderOption

+ func WithMatchKeywords(anyKeyword, allKeyword uint64) ProviderOption

+ func WithProperty(p EnableProperty) ProviderOption

+ func WithRundown(withRundown bool) ProviderOption

+ type ProviderOptions struct — windows/amd64

+ EnableProperties []EnableProperty

+ Filters []EventFilter

+ IgnoreMapInfo bool

+ Level TraceLevel

+ MatchAllKeyword uint64

+ MatchAnyKeyword uint64

+ TriggerRundown bool

+ type Session struct — windows/amd64

+ func NewSession(options ...SessionOption) (*Session, error)

+ func NewSessionNoCreate(options ...SessionOption) *Session

+ func (s *Session) AddProvider(providerGUID windows.GUID, options ...ProviderOption) error

+ func (s *Session) Close() error

+ func (s *Session) Process(cb EventCallback) error

+ func (s *Session) Stat() (SessionStatistics, error)

+ func (s *Session) Update(options ...SessionOption) error

+ type SessionOption func(cfg *SessionOptions) — windows/amd64

+ func EnableFlags(flags ...EnableFlag) SessionOption

+ func EnableLogModes(modes ...LogFileMode) SessionOption

+ func IgnoreMapInfo(ignoreMapInfo bool) SessionOption

+ func WithName(name string) SessionOption

+ type SessionOptions struct — windows/amd64

+ Flags []EnableFlag

+ IgnoreMapInfo bool

+ Kernel bool

+ LogFileModes []LogFileMode

+ Name string

+ type SessionStatistics struct — windows/amd64

+ LostEvents uint64

+ ProcessedEvents uint64

+ type TraceLevel uint8 — windows/amd64

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL