diff --git a/pkg/etw/eventdescriptor.go b/pkg/etw/eventdescriptor.go index b16ad57..cc41f15 100644 --- a/pkg/etw/eventdescriptor.go +++ b/pkg/etw/eventdescriptor.go @@ -17,7 +17,7 @@ const ( // will always be collected. type Level uint8 -// Predefined ETW log levels. +// Predefined ETW log levels from winmeta.xml in the Windows SDK. const ( LevelAlways Level = iota LevelCritical @@ -27,13 +27,30 @@ const ( LevelVerbose ) +// Opcode represents the operation that the event indicates is being performed. +type Opcode uint8 + +// Predefined ETW opcodes from winmeta.xml in the Windows SDK. +const ( + // OpcodeInfo indicates an informational event. + OpcodeInfo Opcode = iota + // OpcodeStart indicates the start of an operation. + OpcodeStart + // OpcodeStop indicates the end of an operation. + OpcodeStop + // OpcodeDCStart indicates the start of a provider capture state operation. + OpcodeDCStart + // OpcodeDCStop indicates the end of a provider capture state operation. + OpcodeDCStop +) + // EventDescriptor represents various metadata for an ETW event. type eventDescriptor struct { id uint16 version uint8 channel Channel level Level - opcode uint8 + opcode Opcode task uint16 keyword uint64 } diff --git a/pkg/etw/eventopt.go b/pkg/etw/eventopt.go index 33ad6a4..0a8386d 100644 --- a/pkg/etw/eventopt.go +++ b/pkg/etw/eventopt.go @@ -36,12 +36,20 @@ func WithKeyword(keyword uint64) EventOpt { } } +// WithChannel specifies the channel of the event to be written. func WithChannel(channel Channel) EventOpt { return func(options *eventOptions) { options.descriptor.channel = channel } } +// WithOpcode specifies the opcode of the event to be written. +func WithOpcode(opcode Opcode) EventOpt { + return func(options *eventOptions) { + options.descriptor.opcode = opcode + } +} + // WithTags specifies the tags of the event to be written. Tags is a 28-bit // value (top 4 bits are ignored) which are interpreted by the event consumer. func WithTags(newTags uint32) EventOpt { @@ -50,12 +58,14 @@ func WithTags(newTags uint32) EventOpt { } } +// WithActivityID specifies the activity ID of the event to be written. func WithActivityID(activityID *windows.GUID) EventOpt { return func(options *eventOptions) { options.activityID = activityID } } +// WithRelatedActivityID specifies the parent activity ID of the event to be written. func WithRelatedActivityID(activityID *windows.GUID) EventOpt { return func(options *eventOptions) { options.relatedActivityID = activityID