Subclass of BaseRecord.
The ETW trace sessions that Windows saved as it wrote a minidump
(tagged data nt!EtwSecondaryDumpDataGuid): the sessions started with
EVENT_TRACE_ADDTO_TRIAGE_DUMP, such as EventLog-System, and the system
fields that the logfile header of an .etl records.
-
property boot_time: int
EtwpBootTime, a FILETIME.
-
property boot_time_utc: str | None
boot_time as UTC. None if it is out of range.
-
property build_number: int
NtBuildNumber, its top nibble the free or checked build.
-
property cpu_mhz: int
EtwCPUSpeedInMHz.
-
property loggers: list[EtwDumpLogger]
-
property perf_frequency: int
EtwPerfFreq, the QPC frequency of PerfCounter timestamps.
-
property size: int
Bytes of the ETW data.
-
property stop: str | None
Why the walk of the data stopped before its end. None if it read
all of it.
-
property timer_resolution: int
KeMaximumIncrement, the clock interrupt interval in 100 ns.