EtwDumpLogger

final class ntoseye.EtwDumpLogger

Subclass of BaseRecord.

An ETW trace session that Windows saved in a minidump: what the session’s header in the dump records of its _WMI_LOGGER_CONTEXT, and its buffers.

property buffer_size: int

Bytes per buffer.

property buffers: list[EtwBuffer]

The buffers saved of the session, which are all the buffers on its GlobalList. A buffer’s address is the offset of its header in the dump’s ETW data, and its data_end its bytes there.

property clock: str

The name of what the event timestamps count.

property clock_type: int

ClockType (EVENT_TRACE_CLOCK_*).

property logger_id: int

property logger_mode: int

property logger_mode_names: list[str]

The EVENT_TRACE_*_MODE bits that are set in logger_mode.

property name: str

property start_time: int

StartTime, a FILETIME.

property start_time_utc: str | None

start_time as UTC (YYYY-MM-DD HH:MM:SS.fffffff). None if it is out of range.