Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
The EtwWriteTransfer function marks an event that links two activities together; this type of event is referred to as a transfer event. A transfer event can contain the same user-defined data, the same fields, and is subject to the same rules as other events.
Syntax
NTSTATUS EtwWriteTransfer(
[in] REGHANDLE RegHandle,
[in] PCEVENT_DESCRIPTOR EventDescriptor,
[in, optional] LPCGUID ActivityId,
[in, optional] LPCGUID RelatedActivityId,
[in] ULONG UserDataCount,
[in, optional] PEVENT_DATA_DESCRIPTOR UserData
);
Parameters
[in] RegHandle
A pointer to the event provider registration handle, which is returned by the EtwRegister function if the event provider registration is successful.
[in] EventDescriptor
A pointer to the EVENT_DESCRIPTOR structure.
[in, optional] ActivityId
The identifier that indicates the activity associated with the event. The ActivityId provides a way to group related events and is used in end-to-end tracing. This identifier is optional and can be NULL.
[in, optional] RelatedActivityId
The identifier that indicates related activity associated with the event. The RelatedActivityID provides a way to group related events and is used in end-to-end tracing.
[in] UserDataCount
The number of elements in an array of EVENT_DATA_DESCRIPTOR structures.
[in, optional] UserData
The pointer to the first element in an array of EVENT_DATA_DESCRIPTOR structures.
Return value
EtwWriteTransfer returns STATUS_SUCCESS if the event was successfully published.
Remarks
You can call EtwWriteTransfer at any IRQL. However, when IRQL is greater than APC_LEVEL, any data passed to the EtwWrite, EtwWriteString, EtwWriteTransfer functions must not be pageable. That is, any kernel-mode routine that is running at IRQL greater than APC_LEVEL cannot access pageable memory. Data passed to the EtwWrite, EtwWriteString, EtwWriteTransfer functions must reside in system-space memory, regardless of what the IRQL is.
Requirements
Requirement | Value |
---|---|
Target Platform | Universal |
Header | wdm.h (include Wdm.h, Ntddk.h) |
Library | NtosKrnl.lib |
DLL | NtosKrnl.exe; Ntdll.dll |
IRQL | Any level (see Comments section) |