Enum SystemProvider 

pub enum SystemProvider {
    Process,
    Registry,
    Network,
    FileIo,
    ImageLoad,
}

System-level event sources for kernel tracing.

Each variant represents a category of events emitted by the Windows kernel. Because these providers operate inside the kernel, they capture activity from all processes on the machine without any instrumentation in the target application.

Privileges

Enabling any SystemProvider requires Administrator privileges. The underlying trace session uses the NT Kernel Logger — a Windows-reserved name for kernel providers — so only one kernel session can be active at a time.

Variants

Process

Process and thread creation/termination events.

Emits an event whenever any process or thread starts or stops system-wide.

Registry

Registry key and value operations.

Emits an event for every registry read, write, create, and delete across all processes. Can be high-volume on busy systems.

Network

TCP/IP network connections and data transfer.

Emits events for TCP connections, UDP sends/receives, and connection failures. Covers both IPv4 and IPv6.

FileIo

File I/O operations (create, read, write, delete).

Emits an event for every file system operation. Very high volume — consider using next_batch_with_filter to focus on relevant paths.

ImageLoad

DLL and EXE image load/unload events.

Emits an event whenever any executable or library is mapped into or unmapped from a process. Useful for detecting code injection.

Trait Implementations

impl Clone for SystemProvider

fn clone(&self) -> SystemProvider

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SystemProvider

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl PartialEq for SystemProvider

fn eq(&self, other: &SystemProvider) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Copy for SystemProvider

impl Eq for SystemProvider

impl StructuralPartialEq for SystemProvider