EtwRecord

final class ntoseye.EtwRecord

Subclass of BaseRecord.

An event record decoded from a trace buffer. A field is None if the header kind of the event does not have it.

property activity_id: str | None

EVENT_HEADER.ActivityId, braced.

property descriptor: EtwEventDescriptor | None

property event_class: EtwEventClass | None

The class of a classic event.

property event_flags: int | None

EVENT_HEADER.Flags.

property extended: list[EtwExtendedItem]

property group: str | None

The EVENT_TRACE_GROUP_* name of the hook id, if it is known.

property guid: str | None

The provider GUID (EVENT_HEADER), event class GUID (EVENT_TRACE_HEADER), or message GUID (MESSAGE_TRACE_HEADER), braced.

property header: Literal['system', 'compact', 'perfinfo', 'classic', 'instance', 'event', 'message']

The trace header at the start of the record (event for EVENT_HEADER, …).

property header_type: int

property hook_id: int | None

The kernel hook id (group << 8 | type) of system and perfinfo events.

property message: EtwMessage | None

property offset: int

The offset of the record in its buffer.

property payload: bytes

The user data of the event.

property process_id: int | None

property size: int

The record size, with the header included (unaligned).

property thread_id: int | None

property timestamp: int | None

The raw timestamp in the clock of the logger. A WPP message without TRACE_MESSAGE_TIMESTAMP has no timestamp.