1 // Licensed to the .NET Foundation under one or more agreements. 2 // The .NET Foundation licenses this file to you under the MIT license. 3 // See the LICENSE file in the project root for more information. 4 5 using System; 6 using System.Runtime.InteropServices; 7 8 internal static partial class Interop 9 { 10 internal static partial class Advapi32 11 { 12 [DllImport(Interop.Libraries.Advapi32)] EventRegister(ref Guid ProviderId, EtwEnableCallback EnableCallback, IntPtr CallbackContext, out ulong RegHandle)13 internal extern static uint EventRegister(ref Guid ProviderId, EtwEnableCallback EnableCallback, IntPtr CallbackContext, out ulong RegHandle); 14 EtwEnableCallback( ref Guid sourceId, int isEnabled, byte level, ulong matchAnyKeywords, ulong matchAllKeywords, Interop.Kernel32.EVENT_FILTER_DESCRIPTOR* filterData, IntPtr callbackContext )15 internal unsafe delegate void EtwEnableCallback( 16 ref Guid sourceId, 17 int isEnabled, 18 byte level, 19 ulong matchAnyKeywords, 20 ulong matchAllKeywords, 21 Interop.Kernel32.EVENT_FILTER_DESCRIPTOR* filterData, 22 IntPtr callbackContext 23 ); 24 25 [StructLayout(LayoutKind.Sequential)] 26 internal struct EVENT_FILTER_DESCRIPTOR 27 { 28 internal ulong Ptr; 29 internal uint Size; 30 internal uint Type; 31 } 32 33 // 34 // Constants error coded returned by ETW APIs 35 // 36 37 // The event size is larger than the allowed maximum (64k - header). 38 internal const int ERROR_ARITHMETIC_OVERFLOW = 534; 39 40 // Occurs when filled buffers are trying to flush to disk, 41 // but disk IOs are not happening fast enough. 42 // This happens when the disk is slow and event traffic is heavy. 43 // Eventually, there are no more free (empty) buffers and the event is dropped. 44 internal const int ERROR_NOT_ENOUGH_MEMORY = 8; 45 46 internal const int ERROR_MORE_DATA = 0xEA; 47 internal const int ERROR_NOT_SUPPORTED = 50; 48 internal const int ERROR_INVALID_PARAMETER = 0x57; 49 50 // 51 // ETW Methods 52 // 53 54 internal const int EVENT_CONTROL_CODE_DISABLE_PROVIDER = 0; 55 internal const int EVENT_CONTROL_CODE_ENABLE_PROVIDER = 1; 56 internal const int EVENT_CONTROL_CODE_CAPTURE_STATE = 2; 57 } 58 } 59