Struct TraceEvent 

pub struct TraceEvent {
    pub id: u16,
    pub version: u8,
    pub opcode: u8,
    pub level: u8,
    pub provider_guid: GUID,
    pub process_id: ProcessId,
    pub thread_id: ThreadId,
    pub timestamp: SystemTime,
    pub data: Vec<u8>,
    pub thread_context: Option<ThreadContext>,
    pub stack_trace: Option<StackTrace>,
    pub cpu_sample: Option<CpuSample>,
    /* private fields */
}

A single event captured from a kernel trace session.

Each TraceEvent is emitted by one of the active SystemProviders. The id and opcode fields identify the specific operation; the data field contains the raw binary payload whose layout depends on the provider and event ID.

Fields

id: u16

Event ID — identifies the event type within the provider.

version: u8

Event version.

opcode: u8

Opcode — identifies the operation phase (start, stop, info, etc.).

level: u8

Severity level of this event.

provider_guid: GUID

GUID of the provider that emitted this event.

process_id: ProcessId

ID of the process that triggered the event.

thread_id: ThreadId

ID of the thread that triggered the event.

timestamp: SystemTime

When the event was recorded.

data: Vec<u8>

Raw binary payload. Layout depends on the provider and event ID.

thread_context: Option<ThreadContext>

Optional thread context enrichment (enabled by with_thread_context).

stack_trace: Option<StackTrace>

Optional stack trace enrichment (enabled by with_stack_traces).

cpu_sample: Option<CpuSample>

Optional CPU sampling enrichment (enabled by with_cpu_samples).

Implementations

impl TraceEvent

pub fn from_event_record(record: &EVENT_RECORD) -> Self

Build a TraceEvent from a raw EVENT_RECORD.

Used by the ProcessTrace callback pipeline in session.rs.

pub fn decode(&self) -> DecodedEvent

Decode this event into a typed representation when a known kernel layout is available.

Returns DecodedEvent::Unknown when no direct decoder matches the provider, version, and opcode combination.

pub fn fields(&self) -> Option<&[EventField]>

Returns schema-parsed fields when detailed event parsing is enabled.

Trait Implementations

impl Clone for TraceEvent

fn clone(&self) -> TraceEvent

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for TraceEvent

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.