EVT_PUBLISHER_METADATA_PROPERTY_ID enumeration (winevt.h)

2022-01-31

Defines the identifiers that identify the metadata properties of a provider.

Syntax

typedef enum _EVT_PUBLISHER_METADATA_PROPERTY_ID {
  EvtPublisherMetadataPublisherGuid = 0,
  EvtPublisherMetadataResourceFilePath,
  EvtPublisherMetadataParameterFilePath,
  EvtPublisherMetadataMessageFilePath,
  EvtPublisherMetadataHelpLink,
  EvtPublisherMetadataPublisherMessageID,
  EvtPublisherMetadataChannelReferences,
  EvtPublisherMetadataChannelReferencePath,
  EvtPublisherMetadataChannelReferenceIndex,
  EvtPublisherMetadataChannelReferenceID,
  EvtPublisherMetadataChannelReferenceFlags,
  EvtPublisherMetadataChannelReferenceMessageID,
  EvtPublisherMetadataLevels,
  EvtPublisherMetadataLevelName,
  EvtPublisherMetadataLevelValue,
  EvtPublisherMetadataLevelMessageID,
  EvtPublisherMetadataTasks,
  EvtPublisherMetadataTaskName,
  EvtPublisherMetadataTaskEventGuid,
  EvtPublisherMetadataTaskValue,
  EvtPublisherMetadataTaskMessageID,
  EvtPublisherMetadataOpcodes,
  EvtPublisherMetadataOpcodeName,
  EvtPublisherMetadataOpcodeValue,
  EvtPublisherMetadataOpcodeMessageID,
  EvtPublisherMetadataKeywords,
  EvtPublisherMetadataKeywordName,
  EvtPublisherMetadataKeywordValue,
  EvtPublisherMetadataKeywordMessageID,
  EvtPublisherMetadataPropertyIdEND
} EVT_PUBLISHER_METADATA_PROPERTY_ID;

Constants


`EvtPublisherMetadataPublisherGuid` Value: 0 Identifies the guid attribute of the provider. The variant type for this property is EvtVarTypeGuid.
`EvtPublisherMetadataResourceFilePath` Identifies the resourceFilePath attribute of the provider. The variant type for this property is EvtVarTypeString.
`EvtPublisherMetadataParameterFilePath` Identifies the parameterFilePath attribute of the provider. The variant type for this property is EvtVarTypeString.
`EvtPublisherMetadataMessageFilePath` Identifies the messageFilePath attribute of the provider. The variant type for this property is EvtVarTypeString.
`EvtPublisherMetadataHelpLink` Identifies the helpLink attribute of the provider. The variant type for this property is EvtVarTypeString.
`EvtPublisherMetadataPublisherMessageID` Identifies the message attribute of the provider. The metadata is the resource identifier assigned to the message string. To get the message string, call the EvtFormatMessage function. The variant type for this property is EvtVarTypeUInt32. If the provider does not specify a message, the value is –1.
`EvtPublisherMetadataChannelReferences` Identifies the channels child element of the provider. The variant type for this property is EvtVarTypeEvtHandle. To access the metadata of the channels that the provider defines or imports, use this handle when calling the EvtGetObjectArrayProperty function. For details, see Remarks. When you are done with the handle, call the EvtClose function.
`EvtPublisherMetadataChannelReferencePath` Identifies the name attribute of the channel. Use this identifier when calling the EvtGetObjectArrayProperty function. For details, see Remarks. The variant type for this property is EvtVarTypeString.
`EvtPublisherMetadataChannelReferenceIndex` Identifies the zero-based index value of the channel in the list of channels. Use this identifier when calling the EvtGetObjectArrayProperty function. For details, see Remarks. The variant type for this property is EvtVarTypeUInt32.
`EvtPublisherMetadataChannelReferenceID` Identifies the value attribute of the channel. Use this identifier when calling the EvtGetObjectArrayProperty function. For details, see Remarks. The variant type for this property is EvtVarTypeUInt32.
`EvtPublisherMetadataChannelReferenceFlags` Identifies the flags value that indicates whether this channel is imported from another provider. The channel is imported if the EvtChannelReferenceImported flag value is set. Use this identifier when calling the EvtGetObjectArrayProperty function. For details, see Remarks. The variant type for this property is EvtVarTypeUInt32.
`EvtPublisherMetadataChannelReferenceMessageID` Identifies the message attribute of the channel. Use this identifier when calling the EvtGetObjectArrayProperty function. For details, see Remarks. The variant type for this property is EvtVarTypeUInt32. The property contains the resource identifier that is assigned to the message string. To get the message string, call the EvtFormatMessage function. If the channel does not specify a message, the value is –1.
`EvtPublisherMetadataLevels` Identifies the levels child element of the provider. The variant type for this property is EvtVarTypeEvtHandle. To access the metadata of the levels that the provider defines or references, use this handle when calling the EvtGetObjectArrayProperty function. For details, see Remarks. When you are done with the handle, call the EvtClose function.
`EvtPublisherMetadataLevelName` Identifies the name attribute of the level. Use this identifier when calling the EvtGetObjectArrayProperty function. For details, see Remarks. The variant type for this property is EvtVarTypeString.
`EvtPublisherMetadataLevelValue` Identifies the value attribute of the level. Use this identifier when calling the EvtGetObjectArrayProperty function. For details, see Remarks. The variant type for this property is EvtVarTypeUInt32.
`EvtPublisherMetadataLevelMessageID` Identifies the message attribute of the level. Use this identifier when calling the EvtGetObjectArrayProperty function. For details, see Remarks. The variant type for this property is EvtVarTypeUInt32. The property contains the resource identifier that is assigned to the message string. To get the message string, call the EvtFormatMessage function. If the level does not specify a message, the value is –1.
`EvtPublisherMetadataTasks` Identifies the tasks child element of the provider. The variant type for this property is EvtVarTypeEvtHandle. To access the metadata of the tasks that the provider defines, use this handle when calling the EvtGetObjectArrayProperty function. For details, see Remarks. When you are done with the handle, call the EvtClose function.
`EvtPublisherMetadataTaskName` Identifies the name attribute of the task. Use this identifier when calling the EvtGetObjectArrayProperty function. For details, see Remarks. The variant type for this property is EvtVarTypeString.
`EvtPublisherMetadataTaskEventGuid` Identifies the eventGuid attribute of the task. Use this identifier when calling the EvtGetObjectArrayProperty function. For details, see Remarks. The variant type for this property is EvtVarTypeString.
`EvtPublisherMetadataTaskValue` Identifies the value attribute of the task. Use this identifier when calling the EvtGetObjectArrayProperty function. For details, see Remarks. The variant type for this property is EvtVarTypeUInt32.
`EvtPublisherMetadataTaskMessageID` Identifies the message attribute of the task. Use this identifier when calling the EvtGetObjectArrayProperty function. For details, see Remarks. The variant type for this property is EvtVarTypeUInt32. The property contains the resource identifier that is assigned to the message string. To get the message string, call the EvtFormatMessage function. If the task does not specify a message, the value is –1.
`EvtPublisherMetadataOpcodes` Identifies the opcodes child element of the provider. The variant type for this property is EvtVarTypeEvtHandle. To access the metadata of the opcodes that the provider defines or references, use this handle when calling the EvtGetObjectArrayProperty function. For details, see Remarks. When you are done with the handle, call the EvtClose function.
`EvtPublisherMetadataOpcodeName` Identifies the name attribute of the opcode. Use this identifier when calling the EvtGetObjectArrayProperty function. For details, see Remarks. The variant type for this property is EvtVarTypeString.
`EvtPublisherMetadataOpcodeValue` Identifies the value attribute of the opcode. Use this identifier when calling the EvtGetObjectArrayProperty function. For details, see Remarks. The variant type for this property is EvtVarTypeUInt32. The high word contains the opcode value and the low word contains the task to which it belongs. If the low word is zero, the opcode is defined globally; otherwise, the opcode is task specific. Use the low word value to determine the task that defines the opcode.
`EvtPublisherMetadataOpcodeMessageID` Identifies the message attribute of the opcode. Use this identifier when calling the EvtGetObjectArrayProperty function. For details, see Remarks. The variant type for this property is EvtVarTypeUInt32. The property contains the resource identifier that is assigned to the message string. To get the message string, call the EvtFormatMessage function. If the opcode does not specify a message, the value is –1.
`EvtPublisherMetadataKeywords` Identifies the keywords child element of the provider. The variant type for this property is EvtVarTypeEvtHandle. To access the metadata of the keywords that the provider defines, use this handle when calling the EvtGetObjectArrayProperty function. For details, see Remarks. When you are done with the handle, call the EvtClose function.
`EvtPublisherMetadataKeywordName` Identifies the name attribute of the keyword. Use this identifier when calling the EvtGetObjectArrayProperty function. For details, see Remarks. The variant type for this property is EvtVarTypeString.
`EvtPublisherMetadataKeywordValue` Identifies the mask attribute of the keyword. Use this identifier when calling the EvtGetObjectArrayProperty function. For details, see Remarks. The variant type for this property is EvtVarTypeUInt64.
`EvtPublisherMetadataKeywordMessageID` Identifies the message attribute of the keyword. Use this identifier when calling the EvtGetObjectArrayProperty function. For details, see Remarks. The variant type for this property is EvtVarTypeUInt32. The property contains the resource identifier that is assigned to the message string. To get the message string, call the EvtFormatMessage function. If the keyword does not specify a message, the value is –1.
`EvtPublisherMetadataPropertyIdEND` This enumeration value marks the end of the enumeration values.

Remarks

This list of identifiers in this enumeration are for those properties that cannot change. To get the configuration for a channel, call the EvtGetChannelConfigProperty function.

You cannot use the following property identifiers when calling the EvtGetPublisherMetadataProperty function:

EvtPublisherMetadataChannelReferencePath
EvtPublisherMetadataChannelReferenceIndex
EvtPublisherMetadataChannelReferenceID
EvtPublisherMetadataChannelReferenceFlags
EvtPublisherMetadataChannelReferenceMessageID
EvtPublisherMetadataLevelName
EvtPublisherMetadataLevelValue
EvtPublisherMetadataLevelMessageID
EvtPublisherMetadataTaskName
EvtPublisherMetadataTaskEventGuid
EvtPublisherMetadataTaskValue
EvtPublisherMetadataTaskMessageID
EvtPublisherMetadataOpcodeName
EvtPublisherMetadataOpcodeValue
EvtPublisherMetadataOpcodeMessageID
EvtPublisherMetadataKeywordName
EvtPublisherMetadataKeywordValue
EvtPublisherMetadataKeywordMessageID

To use these identifiers, you must first retrieve the handle to the property's parent object. To retrieve the channel properties, you must first retrieve the handle to the parent object using the EvtPublisherMetadataChannelReferences identifier; to retrieve the level properties, you must first retrieve the handle to the parent object using the EvtPublisherMetadataLevels identifier; to retrieve the task properties, you must first retrieve the handle to the parent object using the EvtPublisherMetadataTasks identifier; to retrieve the opcode properties, you must first retrieve the handle to the parent object using the EvtPublisherMetadataOpcodes identifier; and to retrieve the keyword properties, you must first retrieve the handle to the parent object using the EvtPublisherMetadataKeywords identifier.

The handle points to an array of objects that contain the metadata for child type that the provider defines. To determine how many objects are in the array, call the EvtGetObjectArraySize function. To access a property of one of the objects, call the EvtGetObjectArrayProperty function and specify the identifier of the property that you want to retrieve.

Requirements

Requirement	Value
Minimum supported client	Windows Vista [desktop apps only]
Minimum supported server	Windows Server 2008 [desktop apps only]
Header	winevt.h

Feedback

Was this page helpful?