Struct EventTrace 

pub struct EventTrace { /* private fields */ }

A running ETW trace session.

Created by EventTraceBuilder::start. Automatically stops the trace when dropped (RAII).

Use EventTrace::builder to configure and start a session.

Implementations

impl EventTrace

pub fn builder(name: impl Into<String>) -> EventTraceBuilder

Create a builder to configure and start an ETW trace session.

No validation happens here — all checks run in EventTraceBuilder::start so the builder can always be constructed without a Result.

Example

use windows_erg::etw::{EventTrace, SystemProvider};

let mut trace = EventTrace::builder("ProcessMonitor")
    .system_provider(SystemProvider::Process)
    .start()?;

pub fn name(&self) -> &str

The active ETW session name.

Kernel sessions always use NT Kernel Logger; user-mode sessions use the builder name.

pub fn events_processed(&self) -> usize

Total events delivered so far across all next_batch calls.

pub fn stop_handle(&self) -> Wait

Get a clone of the stop signal for external cancellation coordination.

pub fn next_batch(&mut self, out_events: &mut Vec<TraceEvent>) -> Result<usize>

Fetch the next batch of events into the output buffer.

Clears out_events before filling it. Returns the number of events added.

pub fn next_batch_or_stopped( &mut self, out_events: &mut Vec<TraceEvent>, ) -> Result<usize>

Fetch the next batch unless the session stop signal has been set.

Returns 0 when stop was requested.

pub fn run_until_stopped( &mut self, out_events: &mut Vec<TraceEvent>, poll_interval: Duration, ) -> Result<()>

Continuously drain batches until the stop signal is set.

The output buffer is reused on each iteration.

pub fn next_batch_with_filter<F>( &mut self, out_events: &mut Vec<TraceEvent>, filter: F, ) -> Result<usize>

where F: Fn(&TraceEvent) -> bool,

Fetch the next batch of events, keeping only those that pass filter.

Clears out_events before filling it. Returns the number of events added.

Filtering happens during enumeration, so rejected events are never pushed to the buffer.

pub fn next_batch_decoded( &mut self, out_events: &mut Vec<DecodedEvent>, ) -> Result<usize>

Fetch the next batch of decoded events into the output buffer.

Clears out_events before filling it. Returns the number of events added.

pub fn next_batch_decoded_with_filter<F>( &mut self, out_events: &mut Vec<DecodedEvent>, filter: F, ) -> Result<usize>

where F: Fn(&DecodedEvent) -> bool,

Fetch the next batch of decoded events, keeping only those that pass filter.

Clears out_events before filling it. Returns the number of events added.

pub fn stop(&mut self) -> Result<()>

Stop the trace session explicitly.

Also called automatically when EventTrace is dropped.

Trait Implementations

impl Drop for EventTrace

fn drop(&mut self)

Executes the destructor for this type.

impl Send for EventTrace