Struct ferrisetw::provider::ProviderBuilder

pub struct ProviderBuilder { /* private fields */ }

A Builder for a Provider

See Provider for various functions that create ProviderBuilders.

Implementations

impl ProviderBuilder

pub fn any(self, any: u64) -> Self

Set the any flag in the Provider instance More info

Example

let my_provider = Provider::by_guid("1EDEEE53-0AFE-4609-B846-D8C0B2075B1F").any(0xf0010000000003ff).build();

pub fn all(self, all: u64) -> Self

Set the all flag in the Provider instance More info

Example

let my_provider = Provider::by_guid("1EDEEE53-0AFE-4609-B846-D8C0B2075B1F").all(0x4000000000000000).build();

pub fn level(self, level: u8) -> Self

Set the level flag in the Provider instance

Example

// LogAlways (0x0)
// Critical (0x1)
// Error (0x2)
// Warning (0x3)
// Information (0x4)
// Verbose (0x5)
let my_provider = Provider::by_guid("1EDEEE53-0AFE-4609-B846-D8C0B2075B1F").level(0x5).build();

pub fn trace_flags(self, trace_flags: TraceFlags) -> Self

Set the trace_flags flag in the Provider instance More info

Example

let my_provider = Provider::by_guid("1EDEEE53-0AFE-4609-B846-D8C0B2075B1F").trace_flags(TraceFlags::EVENT_ENABLE_PROPERTY_SID).build();

pub fn add_callback<T>(self, callback: T) -> Selfwhere T: FnMut(&EventRecord, &SchemaLocator) + Send + Sync + 'static,

Add a callback function that will be called when the Provider generates an Event

Notes

The callback will be run on a background thread (the one that is blocked on the process function).

Example

let provider = Provider::by_guid("1EDEEE53-0AFE-4609-B846-D8C0B2075B1F").add_callback(|record: &EventRecord, schema_locator: &SchemaLocator| {
    // Handle Event
}).build();
UserTrace::new().enable(provider).start().unwrap();

pub fn add_filter(self, filter: EventFilter) -> Self

Add a filter to this Provider.

Adding multiple filters will bind them with an AND relationship.
If you want an OR relationship, include them in the same EventFilter.

Example

let only_events_18_or_42 = EventFilter::ByEventIds(vec![18, 42]);
let only_pid_1234 = EventFilter::ByPids(vec![1234]);

Provider::by_guid("22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716")
    .add_filter(only_events_18_or_42)
    .add_filter(only_pid_1234)
    .build();

pub fn build(self) -> Provider

Build the provider

Example

Provider::by_guid("22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716") // Microsoft-Windows-Kernel-Process
  .add_callback(process_callback)
  .build();

Trait Implementations

impl Debug for ProviderBuilder

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.