Struct ferrisetw::trace::KernelTrace

[+] Show declaration

pub struct KernelTrace { /* fields omitted */ }

[−] Expand description

Kernel Trace struct

Implementations

impl KernelTrace[−]

pub fn new() -> Self[−]

Use the new function to create a KernelTrace builder

Example

let user_trace = KernelTrace::new();

Trait Implementations

impl Drop for KernelTrace[+]

On drop the ETW session will be stopped if not stopped before

[+] Show hidden undocumented items

fn drop(&mut self)[−]

Executes the destructor for this type.

impl TraceBaseTrait for KernelTrace[+]

[+] Show hidden undocumented items

fn set_trace_name(&mut self, name: &str)[−]

Internal function to set TraceName. See TraceTrait::named

fn set_trace_properties(self, props: TraceProperties) -> Self[−]

The set_trace_properties function sets the ETW session configuration properties

fn enable(self, provider: Provider) -> Self[−]

The enable function enables a Provider for the Trace

fn open(self) -> Result<Self, TraceError>[−]

The open function opens a Trace session

fn start(self) -> Result<Self, TraceError>[−]

The start function starts a Trace session, this includes open and process the trace

fn stop(&mut self)[−]

The stop function stops a Trace session

fn process(self) -> Result<Self, TraceError>[−]

The process function will start processing a Trace session

impl TraceTrait for KernelTrace[+]

[+] Show hidden undocumented items

fn named(self, name: String) -> Self[−]

See TraceTrait::named

Remarks

On Windows Versions older than Win8 this method won't change the trace name. In those versions the trace name need to be set to "NT Kernel Logger", that's handled by the module

fn augmented_file_mode() -> u32

fn enable_flags(providers: &RwLock<Vec<Provider>>) -> u32

fn trace_guid() -> Guid

fn enable_provider(&self)