Struct ferrisetw::trace::KernelTrace

pub struct KernelTrace { /* fields omitted */ }

Kernel Trace struct

Implementations

impl KernelTrace

pub fn new() -> Self

Use the new function to create a KernelTrace builder

Example

let user_trace = KernelTrace::new();

Trait Implementations

impl Drop for KernelTrace

On drop the ETW session will be stopped if not stopped before

fn drop(&mut self)

Executes the destructor for this type.

impl TraceBaseTrait for KernelTrace

fn set_trace_name(&mut self, name: &str)

Internal function to set TraceName. See TraceTrait::named

fn set_trace_properties(self, props: TraceProperties) -> Self

The set_trace_properties function sets the ETW session configuration properties

fn enable(self, provider: Provider) -> Self

The enable function enables a Provider for the Trace

fn open(self) -> Result<Self, TraceError>

The open function opens a Trace session

fn start(self) -> Result<Self, TraceError>

The start function starts a Trace session, this includes open and process the trace

fn stop(&mut self)

The stop function stops a Trace session

fn process(self) -> Result<Self, TraceError>

The process function will start processing a Trace session

impl TraceTrait for KernelTrace

fn named(self, name: String) -> Self

See TraceTrait::named

Remarks

On Windows Versions older than Win8 this method won't change the trace name. In those versions the trace name need to be set to "NT Kernel Logger", that's handled by the module

fn augmented_file_mode() -> u32

fn enable_flags(providers: &RwLock<Vec<Provider>>) -> u32

fn trace_guid() -> Guid

fn enable_provider(&self)