Enum ferrisetw::provider::EventFilter

pub enum EventFilter {
    ByPids(Vec<u16>),
    ByEventIds(Vec<u16>),
}

Specifies how this provider will filter its events

Some filters are not effective prior to Windows 8.1 (source)

Variants

ByPids(Vec<u16>)

Filter by PID. This is only effective on kernel mode logger session. TODO: even for KernelTrace, this does not seem to work. Maybe there’s a distinction between “a trace run in kernel-mode” and a “System trace”? See https://github.com/n4r1b/ferrisetw/issues/51

ByEventIds(Vec<u16>)

Filter by ETW Event ID.

Implementations

impl EventFilter

pub fn to_event_filter_descriptor( &self ) -> Result<EventFilterDescriptor, Box<dyn Error>>

Builds an EventFilterDescriptor (which can in turn generate an EVENT_FILTER_DESCRIPTOR)

Trait Implementations

impl Debug for EventFilter

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.