1724 lines
55 KiB
Groff
1724 lines
55 KiB
Groff
<?xml version='1.0' encoding='utf-8' standalone='yes'?>
|
|
<instrumentationManifest xmlns="http://schemas.microsoft.com/win/2004/08/events">
|
|
<instrumentation
|
|
xmlns:win="http://manifests.microsoft.com/win/2004/08/windows/events"
|
|
xmlns:xs="http://www.w3.org/2001/XMLSchema"
|
|
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
|
|
<events xmlns="http://schemas.microsoft.com/win/2004/08/events">
|
|
<provider
|
|
guid="{21a9201e-73b0-43fe-9821-7e159a59bc70}"
|
|
message="$(string.providermessage)"
|
|
messageFileName="%SystemDrive%\Eventing\Advanced\CPP\AdvancedProvider.exe"
|
|
name="Microsoft-Windows-SDKSample-AdvancedProvider"
|
|
resourceFileName="%SystemDrive%\Eventing\Advanced\CPP\AdvancedProvider.exe"
|
|
symbol="MICROSOFT_WINDOWS_SDKSAMPLE_ADVANCEDPROVIDER"
|
|
>
|
|
<channels>
|
|
<!--ImportChannels - System, Application or Setup-->
|
|
<importChannel
|
|
chid="C1"
|
|
name="System"
|
|
/>
|
|
<importChannel
|
|
chid="C2"
|
|
name="Application"
|
|
/>
|
|
<!--Direct channels - type Analytic or Debug-->
|
|
<channel name="Microsoft-Windows-SDKSample-AdvancedProvider/Analytic" chid="C4" type="Analytic" symbol="ANALYTIC_CHANNEL" isolation="System" enabled="true" message="$(string.AnalyticChannelMessage)">
|
|
<logging>
|
|
<retention>false</retention>
|
|
<maxSize>1000000</maxSize>
|
|
</logging>
|
|
<publishing>
|
|
<level>2</level>
|
|
<keywords>0x00</keywords>
|
|
</publishing>
|
|
</channel>
|
|
<!--Eventlog channels - type Admin or Operational-->
|
|
<channel name="Microsoft-Windows-SDKSample-AdvancedProvider/Operational" chid="C5" type="Admin" symbol="OPERATIONAL_CHANNEL" isolation="System" enabled="true" message="$(string.OperationalChannelMessage)">
|
|
<logging>
|
|
<autoBackup>false</autoBackup>
|
|
<retention>true</retention>
|
|
<maxSize>1000000</maxSize>
|
|
</logging>
|
|
</channel>
|
|
</channels>
|
|
<levels>
|
|
<level
|
|
message="$(string.Level.SampleLevel)"
|
|
name="SampleLevel"
|
|
symbol="SAMPLE_LEVEL"
|
|
value="16"/>
|
|
</levels>
|
|
<keywords>
|
|
<keyword name="ResourceLimit"
|
|
mask="0x20"
|
|
symbol="WINEVENT_KEYWORD_RESOURCELIMIT"
|
|
message="$(string.resourcelimitkeywordmsg)">
|
|
</keyword>
|
|
</keywords>
|
|
<tasks>
|
|
<task
|
|
message="$(string.Task.SampleTask1)"
|
|
name="SampleTask1"
|
|
symbol="SAMPLE_TASK_1"
|
|
value="100"
|
|
/>
|
|
<task
|
|
message="$(string.Task.SampleTask2)"
|
|
name="SampleTask2"
|
|
symbol="SAMPLE_TASK_2"
|
|
value="101"
|
|
/>
|
|
<task
|
|
message="$(string.Task.SampleTask3)"
|
|
name="SampleTask3"
|
|
symbol="SAMPLE_TASK_3"
|
|
value="102"
|
|
/>
|
|
<task
|
|
message="$(string.Task.SampleTask4)"
|
|
name="SampleTask4"
|
|
symbol="SAMPLE_TASK_4"
|
|
value="103"
|
|
/>
|
|
<task
|
|
message="$(string.Task.SampleTask5)"
|
|
name="SampleTask5"
|
|
symbol="SAMPLE_TASK_5"
|
|
value="104"
|
|
/>
|
|
</tasks>
|
|
<opcodes>
|
|
<opcode
|
|
message="$(string.Opcode.SampleOpcode1)"
|
|
name="SampleOpcode1"
|
|
symbol="SAMPLE_OPCODE_1"
|
|
value="10"
|
|
/>
|
|
<opcode
|
|
message="$(string.Opcode.SampleOpcode2)"
|
|
name="SampleOpcode2"
|
|
symbol="SAMPLE_OPCODE_2"
|
|
value="11"
|
|
/>
|
|
<opcode
|
|
message="$(string.Opcode.SampleOpcode3)"
|
|
name="SampleOpcode3"
|
|
symbol="SAMPLE_OPCODE_3"
|
|
value="12"
|
|
/>
|
|
<opcode
|
|
message="$(string.Opcode.SampleOpcode4)"
|
|
name="SampleOpcode4"
|
|
symbol="SAMPLE_OPCODE_4"
|
|
value="13"
|
|
/>
|
|
<opcode
|
|
message="$(string.Opcode.SampleOpcode5)"
|
|
name="SampleOpcode5"
|
|
symbol="SAMPLE_OPCODE_5"
|
|
value="14"
|
|
/>
|
|
</opcodes>
|
|
<maps>
|
|
<valueMap name="VMap" symbol="VMapSymbol" >
|
|
<map
|
|
message="$(string.VMap.ok)"
|
|
value="1"
|
|
symbol="VMapValue_1"
|
|
/>
|
|
<map
|
|
message="$(string.VMap.bad)"
|
|
value="2"
|
|
symbol="VMapValue_2"
|
|
/>
|
|
<map
|
|
message="$(string.VMap.good)"
|
|
value="3"
|
|
symbol="VMapValue_3"
|
|
/>
|
|
</valueMap>
|
|
<bitMap name="BMap" symbol="BMapSymbol">
|
|
<map
|
|
message="$(string.BMap.red)"
|
|
value="0x1"
|
|
symbol="BMapValue_1"
|
|
/>
|
|
<map
|
|
message="$(string.BMap.green)"
|
|
value="0x2"
|
|
symbol="BMapValue_2"
|
|
/>
|
|
<map
|
|
message="$(string.BMap.blue)"
|
|
value="0x4"
|
|
symbol="BMapValue_3"
|
|
/>
|
|
</bitMap>
|
|
</maps>
|
|
<!--Basic supported types. Contains inType X outType possible combinations.-->
|
|
<templates>
|
|
<!--1- Basic Types-->
|
|
<template tid="T_INT8">
|
|
<data
|
|
inType="win:Int8"
|
|
name="Prop_Int8"
|
|
/>
|
|
</template>
|
|
<template tid="T_UINT8">
|
|
<data
|
|
inType="win:UInt8"
|
|
name="Prop_UInt8"
|
|
/>
|
|
</template>
|
|
<template tid="T_UINT8_HEXINT8">
|
|
<data
|
|
inType="win:UInt8"
|
|
name="Prop_UInt8_HexInt8"
|
|
outType="win:HexInt8"
|
|
/>
|
|
</template>
|
|
<template tid="T_INT16">
|
|
<data
|
|
inType="win:Int16"
|
|
name="Prop_Int16"
|
|
/>
|
|
</template>
|
|
<template tid="T_UINT16">
|
|
<data
|
|
inType="win:UInt16"
|
|
name="Prop_UInt16"
|
|
/>
|
|
</template>
|
|
<template tid="T_UINT16_HexInt16">
|
|
<data
|
|
inType="win:UInt16"
|
|
name="Prop_UInt16_HexInt16"
|
|
outType="win:HexInt16"
|
|
/>
|
|
</template>
|
|
<template tid="T_INT32">
|
|
<data
|
|
inType="win:Int32"
|
|
name="Prop_Int32"
|
|
/>
|
|
</template>
|
|
<template tid="T_UINT32">
|
|
<data
|
|
inType="win:UInt32"
|
|
name="Prop_Uint32"
|
|
/>
|
|
</template>
|
|
<template tid="T_UINT32_PID">
|
|
<data
|
|
inType="win:UInt32"
|
|
name="Prop_UInt32_Pid"
|
|
outType="win:PID"
|
|
/>
|
|
</template>
|
|
<template tid="T_UINT32_TID">
|
|
<data
|
|
inType="win:UInt32"
|
|
name="Prop_Uint32_Tid"
|
|
outType="win:TID"
|
|
/>
|
|
</template>
|
|
<template tid="T_UINT32_IPV4">
|
|
<data
|
|
inType="win:UInt32"
|
|
name="Prop_Uint32_IPV4"
|
|
outType="win:IPv4"
|
|
/>
|
|
</template>
|
|
<template tid="T_UINT32_ERRORCODE">
|
|
<data
|
|
inType="win:UInt32"
|
|
name="Prop_Uint32_ERRORCODE"
|
|
outType="win:ErrorCode"
|
|
/>
|
|
</template>
|
|
<template tid="T_UINT32_HEXINT32">
|
|
<data
|
|
inType="win:UInt32"
|
|
name="Prop_Uint32_HEXINT32"
|
|
outType="win:HexInt32"
|
|
/>
|
|
</template>
|
|
<template tid="T_INT64">
|
|
<data
|
|
inType="win:Int64"
|
|
name="Prop_Int64"
|
|
/>
|
|
</template>
|
|
<template tid="T_UINT64">
|
|
<data
|
|
inType="win:UInt64"
|
|
name="Prop_UInt64"
|
|
/>
|
|
</template>
|
|
<template tid="T_UINT64_HEXInt64">
|
|
<data
|
|
inType="win:UInt64"
|
|
name="Prop_UInt64_HEXInt64"
|
|
outType="win:HexInt64"
|
|
/>
|
|
</template>
|
|
<template tid="T_FLOAT">
|
|
<data
|
|
inType="win:Float"
|
|
name="Prop_Float"
|
|
/>
|
|
</template>
|
|
<template tid="T_DOUBLE">
|
|
<data
|
|
inType="win:Double"
|
|
name="Prop_Double"
|
|
/>
|
|
</template>
|
|
<template tid="T_BOOL">
|
|
<data
|
|
inType="win:Boolean"
|
|
name="Prop_Bool"
|
|
/>
|
|
</template>
|
|
<template tid="T_GUID">
|
|
<data
|
|
inType="win:GUID"
|
|
name="Prop_Guid"
|
|
/>
|
|
</template>
|
|
<template tid="T_POINTER">
|
|
<data
|
|
inType="win:Pointer"
|
|
name="Prop_Pointer"
|
|
/>
|
|
</template>
|
|
<template tid="T_FILETIME">
|
|
<data
|
|
inType="win:FILETIME"
|
|
name="Prop_FileTime"
|
|
/>
|
|
</template>
|
|
<template tid="T_SYSTEMTIME">
|
|
<data
|
|
inType="win:SYSTEMTIME"
|
|
name="Prop_SystemTime"
|
|
/>
|
|
</template>
|
|
<template tid="T_SID">
|
|
<data
|
|
inType="win:SID"
|
|
name="Prop_SID"
|
|
/>
|
|
</template>
|
|
<!--End basic types-->
|
|
|
|
<!--2- Variable Length Types-->
|
|
<!--Default-->
|
|
<template tid="T_UnicodeString">
|
|
<data
|
|
inType="win:UnicodeString"
|
|
name="Prop_UnicodeString"
|
|
/>
|
|
</template>
|
|
<template tid="T_AnsiString">
|
|
<data
|
|
inType="win:AnsiString"
|
|
name="Prop_AnsiString"
|
|
/>
|
|
</template>
|
|
<!--End Default-->
|
|
<!--Fixed Length-->
|
|
<template tid="T_FixedLength_UnicodeString">
|
|
<data
|
|
inType="win:UnicodeString"
|
|
name="Prop_FixedLength_UnicodeString"
|
|
length="15"
|
|
/>
|
|
</template>
|
|
<template tid="T_FixedLength_AnsiString">
|
|
<data
|
|
inType="win:AnsiString"
|
|
name="Prop_FixedLength_AnsiString"
|
|
length="15"
|
|
/>
|
|
</template>
|
|
<template tid="T_FixedLength_Binary">
|
|
<data
|
|
inType="win:Binary"
|
|
length="15"
|
|
name="Prop_FixedLength_Binary"
|
|
/>
|
|
</template>
|
|
<!-- End Fixed length -->
|
|
<!--Parameterized Length-->
|
|
<template tid="T_ParamLength_UnicodeString">
|
|
<data
|
|
inType="win:UInt32"
|
|
name="Prop_ParamLength_UnicodString_Length"
|
|
/>
|
|
<data
|
|
inType="win:UnicodeString"
|
|
name="Prop_ParamLength_UnicodeString"
|
|
length="Prop_ParamLength_UnicodString_Length"
|
|
/>
|
|
</template>
|
|
<template tid="T_ParamLength_AnsiString">
|
|
<data
|
|
inType="win:UInt32"
|
|
name="Prop_ParamLength_AnsiString_Length"
|
|
/>
|
|
<data
|
|
inType="win:AnsiString"
|
|
name="Prop_ParamLength_AnsiString"
|
|
length="Prop_ParamLength_AnsiString_Length"
|
|
/>
|
|
</template>
|
|
<template tid="T_ParamLength_Binary">
|
|
<data
|
|
inType="win:UInt32"
|
|
name="Prop_ParamLength_Binary_Length"
|
|
/>
|
|
<data
|
|
inType="win:Binary"
|
|
name="Prop_ParamLength_Binary"
|
|
length="Prop_ParamLength_Binary_Length"
|
|
/>
|
|
</template>
|
|
<template tid="T_Binary_HexBinary">
|
|
<data
|
|
inType="win:UInt32"
|
|
name="Prop_Binary_HexBinary_Length"
|
|
/>
|
|
<data
|
|
inType="win:Binary"
|
|
length="Prop_Binary_HexBinary_Length"
|
|
name="Prop_Binary_HexBinary"
|
|
/>
|
|
</template>
|
|
<template tid="T_BINARY_IPv6">
|
|
<data
|
|
inType="win:UInt32"
|
|
name="Prop_Binary_IPv6_Length"
|
|
/>
|
|
<data
|
|
inType="win:Binary"
|
|
length="Prop_Binary_IPv6_Length"
|
|
name="Prop_Binary_IPv6"
|
|
outType="win:IPv6"
|
|
/>
|
|
</template>
|
|
<template tid="T_BINARY_SOCKETADDRRESS">
|
|
<data
|
|
inType="win:UInt32"
|
|
name="Prop_Binary_SocketAddress_Length"
|
|
/>
|
|
<data
|
|
inType="win:Binary"
|
|
length="Prop_Binary_SocketAddress_Length"
|
|
name="Prop_Binary_SocketAddress"
|
|
outType="win:SocketAddress"
|
|
/>
|
|
</template>
|
|
<!--3- Arrays-->
|
|
<!--Fixed count array-->
|
|
<template tid="T_FixedCount_Int8">
|
|
<data
|
|
inType="win:Int8"
|
|
name="Prop_FixedCount_Int8"
|
|
count="15"
|
|
/>
|
|
</template>
|
|
<!-- End Fixed Count array-->
|
|
<!--Fixed count variable length-->
|
|
<template tid="T_FixedCount_UnicodeString">
|
|
<data
|
|
inType="win:UnicodeString"
|
|
name="Prop_FixedCount_UnicodeString"
|
|
count="15"
|
|
/>
|
|
</template>
|
|
<template tid="T_FixedCount_AnsiString">
|
|
<data
|
|
inType="win:AnsiString"
|
|
name="Prop_FixedCount_AnsiString"
|
|
count="15"
|
|
/>
|
|
</template>
|
|
<!--End fixed count variable length array-->
|
|
<!--Fixed count Fixed length array-->
|
|
<template tid="T_FixedCount_FixedLength_UnicodeString">
|
|
<data
|
|
inType="win:UnicodeString"
|
|
name="Prop_FixedCount_FixedLength_UnicodeString"
|
|
length="15"
|
|
count="15"
|
|
/>
|
|
</template>
|
|
<template tid="T_FixedCount_FixedLength_AnsiString">
|
|
<data
|
|
inType="win:AnsiString"
|
|
name="Prop_FixedCount_FixedLength_AnsiString"
|
|
length="15"
|
|
count="15"
|
|
/>
|
|
</template>
|
|
<template tid="T_FixedCount_FixedLength_Binary">
|
|
<data
|
|
inType="win:Binary"
|
|
name="Prop_FixedCount_FixedLength_Binary"
|
|
length="15"
|
|
count="15"
|
|
/>
|
|
</template>
|
|
<!-- End Fixed count fixed length array-->
|
|
<!--Fixed count parameterized length-->
|
|
<template tid="T_FixedCount_ParamLength_UnicodeString">
|
|
<data
|
|
inType="win:UInt8"
|
|
name="Prop_FixedCount_ParamLength_UnicodeString_Length"
|
|
/>
|
|
<data
|
|
inType="win:UnicodeString"
|
|
name="Prop_FixedCount_ParamLength_UnicodeString"
|
|
length="Prop_FixedCount_ParamLength_UnicodeString_Length"
|
|
count="15"
|
|
/>
|
|
</template>
|
|
<template tid="T_FixedCount_ParamLength_AnsiString">
|
|
<data
|
|
inType="win:UInt8"
|
|
name="Prop_FixedCount_ParamLength_AnsiString_Length"
|
|
/>
|
|
<data
|
|
inType="win:AnsiString"
|
|
name="Prop_FixedCount_ParamLength_AnsiString"
|
|
length="Prop_FixedCount_ParamLength_AnsiString_Length"
|
|
count="15"
|
|
/>
|
|
</template>
|
|
<template tid="T_FixedCount_ParamLength_Binary">
|
|
<data
|
|
inType="win:UInt8"
|
|
name="Prop_FixedCount_ParamLength_Binary_Length"
|
|
/>
|
|
<data
|
|
inType="win:Binary"
|
|
name="Prop_FixedCount_ParamLength_Binary"
|
|
length="Prop_FixedCount_ParamLength_Binary_Length"
|
|
count="15"
|
|
/>
|
|
</template>
|
|
<!--Parameterized count array-->
|
|
<template tid="T_ParamCount_Int8">
|
|
<data
|
|
inType="win:UInt8"
|
|
name="Prop_ParamCount_Int8_Count"
|
|
/>
|
|
<data
|
|
count="Prop_ParamCount_Int8_Count"
|
|
inType="win:Int8"
|
|
name="Prop_ParamCount_Int8"
|
|
/>
|
|
</template>
|
|
<!--Parameterized count variable length-->
|
|
<template tid="T_ParamCount_UnicodeString">
|
|
<data
|
|
inType="win:UInt8"
|
|
name="Prop_ParamCount_UnicodeString_Count"
|
|
/>
|
|
<data
|
|
inType="win:UnicodeString"
|
|
name="Prop_ParamCount_UnicodeString"
|
|
count="Prop_ParamCount_UnicodeString_Count"
|
|
/>
|
|
</template>
|
|
<template tid="T_ParamCount_AnsiString">
|
|
<data
|
|
inType="win:UInt8"
|
|
name="Prop_ParamCount_AnsiString_Count"
|
|
/>
|
|
<data
|
|
inType="win:AnsiString"
|
|
name="Prop_ParamCount_AnsiString"
|
|
count="Prop_ParamCount_AnsiString_Count"
|
|
/>
|
|
</template>
|
|
<!--Parameterized count Fixed length-->
|
|
<template tid="T_ParamCount_FixedLength_UnicodeString">
|
|
<data
|
|
inType="win:UInt8"
|
|
name="Prop_ParamCount_FixedLength_UnicodeString_Count"
|
|
/>
|
|
<data
|
|
inType="win:UnicodeString"
|
|
name="Prop_ParamCount_FixedLength_UnicodeString"
|
|
count="Prop_ParamCount_FixedLength_UnicodeString_Count"
|
|
length="15"
|
|
/>
|
|
</template>
|
|
<template tid="T_ParamCount_FixedLength_AnsiString">
|
|
<data
|
|
inType="win:UInt8"
|
|
name="Prop_ParamCount_FixedLength_AnsiString_Count"
|
|
/>
|
|
<data
|
|
inType="win:AnsiString"
|
|
name="Prop_ParamCount_FixedLength_AnsiString"
|
|
count="Prop_ParamCount_FixedLength_AnsiString_Count"
|
|
length="15"
|
|
/>
|
|
</template>
|
|
<template tid="T_ParamCount_FixedLength_Binary">
|
|
<data
|
|
inType="win:UInt8"
|
|
name="Prop_ParamCount_FixedLength_Binary_Count"
|
|
/>
|
|
<data
|
|
inType="win:Binary"
|
|
name="Prop_ParamCount_FixedLength_Binary"
|
|
count="Prop_ParamCount_FixedLength_Binary_Count"
|
|
length="15"
|
|
/>
|
|
</template>
|
|
<!--End param count fixed length array-->
|
|
<!--Parameterized count parameterized length-->
|
|
<template tid="T_ParamCount_ParamLength_UnicodeString">
|
|
<data
|
|
inType="win:UInt8"
|
|
name="Prop_ParamCount_ParamLength_UnicodeString_Count"
|
|
/>
|
|
<data
|
|
inType="win:UInt8"
|
|
name="Prop_ParamCount_ParamLength_UnicodeString_Length"
|
|
/>
|
|
<data
|
|
inType="win:UnicodeString"
|
|
name="Prop_ParamCount_ParamLength_UnicodeString"
|
|
count="Prop_ParamCount_ParamLength_UnicodeString_Count"
|
|
length="Prop_ParamCount_ParamLength_UnicodeString_Length"
|
|
/>
|
|
</template>
|
|
<template tid="T_ParamCount_ParamLength_AnsiString">
|
|
<data
|
|
inType="win:UInt8"
|
|
name="Prop_ParamCount_ParamLength_AnsiString_Count"
|
|
/>
|
|
<data
|
|
inType="win:UInt8"
|
|
name="Prop_ParamCount_ParamLength_AnsiString_Length"
|
|
/>
|
|
<data
|
|
inType="win:AnsiString"
|
|
name="Prop_ParamCount_ParamLength_AnsiString"
|
|
count="Prop_ParamCount_ParamLength_AnsiString_Count"
|
|
length="Prop_ParamCount_ParamLength_AnsiString_Length"
|
|
/>
|
|
</template>
|
|
<template tid="T_ParamCount_ParamLength_Binary">
|
|
<data
|
|
inType="win:UInt8"
|
|
name="Prop_ParamCount_ParamLength_Binary_Count"
|
|
/>
|
|
<data
|
|
inType="win:UInt8"
|
|
name="Prop_ParamCount_ParamLength_Binary_Length"
|
|
/>
|
|
<data
|
|
inType="win:Binary"
|
|
name="Prop_ParamCount_ParamLength_Binary"
|
|
count="Prop_ParamCount_ParamLength_Binary_Count"
|
|
length="Prop_ParamCount_ParamLength_Binary_Length"
|
|
/>
|
|
</template>
|
|
<!--End Parameterized count parameterized length-->
|
|
<!--Struct of UINT8 and Unicode string (UnAligned data)-->
|
|
<template tid="T_Alignment_UInt8_UnicodeString">
|
|
<data
|
|
inType="win:UInt8"
|
|
name="Prop_Alignment_UInt8_UnicodeString_1"
|
|
/>
|
|
<data
|
|
inType="win:UnicodeString"
|
|
name="Prop_Alignment_UInt8_UnicodeString_2"
|
|
/>
|
|
</template>
|
|
<!--End Struct of UINT8 and Unicode string (UnAligned data)-->
|
|
<!-- UserData All Types-->
|
|
<template tid="T_UserData_All_Types">
|
|
<data
|
|
inType="win:Int8"
|
|
name="Prop_Int8_UserData"
|
|
/>
|
|
<data
|
|
inType="win:UInt8"
|
|
name="Prop_UInt8_UserData"
|
|
/>
|
|
<data
|
|
inType="win:Int16"
|
|
name="Prop_Int16_UserData"
|
|
/>
|
|
<data
|
|
inType="win:UInt16"
|
|
name="Prop_UInt16_UserData"
|
|
/>
|
|
<data
|
|
inType="win:Int32"
|
|
name="Prop_Int32_UserData"
|
|
/>
|
|
<data
|
|
inType="win:UInt32"
|
|
name="Prop_Uint32_UserData"
|
|
/>
|
|
<data
|
|
inType="win:Int64"
|
|
name="Prop_Int64_UserData"
|
|
/>
|
|
<data
|
|
inType="win:UInt64"
|
|
name="Prop_UInt64_UserData"
|
|
/>
|
|
<data
|
|
inType="win:Float"
|
|
name="Prop_Float_UserData"
|
|
/>
|
|
<data
|
|
inType="win:Double"
|
|
name="Prop_Double_UserData"
|
|
/>
|
|
<data
|
|
inType="win:Boolean"
|
|
name="Prop_Bool_UserData"
|
|
/>
|
|
<UserData>
|
|
<UserDataTest xmlns="http://manifests.microsoft.com/win/2005/08/windows/AllPurposeProvider/407FAE1C-6C21-48cf-AF26-3B15DCA05E34/Events">
|
|
<Prop_Int8_UserData>%1</Prop_Int8_UserData>
|
|
<Prop_UInt8_UserData>%2</Prop_UInt8_UserData>
|
|
<Prop_Int16_UserData>%3</Prop_Int16_UserData>
|
|
<Prop_UInt16_UserData>%4</Prop_UInt16_UserData>
|
|
<Prop_Int32_UserData>%5</Prop_Int32_UserData>
|
|
<Prop_Uint32_UserData>%6</Prop_Uint32_UserData>
|
|
<Prop_Int64_UserData>%7</Prop_Int64_UserData>
|
|
<Prop_UInt64_UserData>%8</Prop_UInt64_UserData>
|
|
<Prop_Float_UserData>%9</Prop_Float_UserData>
|
|
<Prop_Double_UserData>%10</Prop_Double_UserData>
|
|
<Prop_Bool_UserData>%11</Prop_Bool_UserData>
|
|
</UserDataTest>
|
|
</UserData>
|
|
</template>
|
|
<!-- End UserData All Types-->
|
|
<!--template with value map-->
|
|
<template tid="T_ValueMap_UInt8">
|
|
<data
|
|
inType="win:UInt8"
|
|
map="VMap"
|
|
name="Prop_ValueMap_Uint8"
|
|
/>
|
|
</template>
|
|
<!--Bit map-->
|
|
<template tid="T_BitMap_UInt8">
|
|
<data
|
|
inType="win:UInt8"
|
|
map="BMap"
|
|
name="Prop_BitMap_Uint8"
|
|
/>
|
|
</template>
|
|
<!--new ERROR outType support-->
|
|
<template tid="T_UInt32_Win32Error">
|
|
<data
|
|
inType="win:UInt32"
|
|
name="Prop_UInt32_Win32Error"
|
|
outType="win:Win32Error"
|
|
/>
|
|
</template>
|
|
<template tid="T_UInt32_NTSTATUS">
|
|
<data
|
|
inType="win:UInt32"
|
|
name="Prop_UInt32_NTSTATUS"
|
|
outType="win:NTSTATUS"
|
|
/>
|
|
</template>
|
|
<template tid="T_Int32_HResult">
|
|
<data
|
|
inType="win:Int32"
|
|
name="Prop_Int32_HResult"
|
|
outType="win:HResult"
|
|
/>
|
|
</template>
|
|
</templates>
|
|
<events>
|
|
<event
|
|
channel="C1"
|
|
level="win:Critical"
|
|
message="$(string.event.102)"
|
|
opcode="win:Start"
|
|
symbol="SampleEvt_INT8"
|
|
task="SampleTask1"
|
|
template="T_INT8"
|
|
value="102"
|
|
/>
|
|
<event
|
|
channel="C1"
|
|
keywords="win:CorrelationHint"
|
|
level="win:Critical"
|
|
message="$(string.event.103)"
|
|
opcode="win:Stop"
|
|
symbol="SampleEvt_UINT8"
|
|
task="SampleTask1"
|
|
template="T_UINT8"
|
|
value="103"
|
|
/>
|
|
<event
|
|
channel="C1"
|
|
level="win:Critical"
|
|
message="$(string.event.104)"
|
|
opcode="win:Info"
|
|
symbol="SampleEvt_UINT8_HEXINT8"
|
|
task="SampleTask1"
|
|
template="T_UINT8_HEXINT8"
|
|
value="104"
|
|
/>
|
|
<event
|
|
channel="C1"
|
|
level="win:Critical"
|
|
message="$(string.event.105)"
|
|
opcode="win:Resume"
|
|
symbol="SampleEvt_INT16"
|
|
task="SampleTask1"
|
|
template="T_INT16"
|
|
value="105"
|
|
/>
|
|
<event
|
|
channel="C1"
|
|
level="win:Critical"
|
|
message="$(string.event.106)"
|
|
opcode="win:Suspend"
|
|
symbol="SampleEvt_UINT16"
|
|
task="SampleTask1"
|
|
template="T_UINT16"
|
|
value="106"
|
|
/>
|
|
<event
|
|
channel="C1"
|
|
level="win:Critical"
|
|
message="$(string.event.107)"
|
|
opcode="win:Send"
|
|
symbol="SampleEvt_UINT16_HexInt16"
|
|
task="SampleTask1"
|
|
template="T_UINT16_HexInt16"
|
|
value="107"
|
|
/>
|
|
<event
|
|
channel="C1"
|
|
level="win:Critical"
|
|
message="$(string.event.108)"
|
|
opcode="win:Receive"
|
|
symbol="SampleEvt_INT32"
|
|
task="SampleTask1"
|
|
template="T_INT32"
|
|
value="108"
|
|
/>
|
|
<event
|
|
channel="C1"
|
|
level="win:Critical"
|
|
message="$(string.event.109)"
|
|
opcode="SampleOpcode1"
|
|
symbol="SampleEvt_UINT32"
|
|
task="SampleTask1"
|
|
template="T_UINT32"
|
|
value="109"
|
|
/>
|
|
<event
|
|
channel="C1"
|
|
level="win:Critical"
|
|
message="$(string.event.110)"
|
|
opcode="SampleOpcode2"
|
|
symbol="SampleEvt_UINT32_PID"
|
|
task="SampleTask1"
|
|
template="T_UINT32_PID"
|
|
value="110"
|
|
/>
|
|
<event
|
|
channel="C1"
|
|
level="win:Critical"
|
|
message="$(string.event.111)"
|
|
opcode="win:Start"
|
|
symbol="SampleEvt_UINT32_TID"
|
|
task="SampleTask2"
|
|
template="T_UINT32_TID"
|
|
value="111"
|
|
/>
|
|
<event
|
|
channel="C1"
|
|
level="win:Critical"
|
|
message="$(string.event.112)"
|
|
opcode="win:Stop"
|
|
symbol="SampleEvt_UINT32_IPV4"
|
|
task="SampleTask2"
|
|
template="T_UINT32_IPV4"
|
|
value="112"
|
|
/>
|
|
<event
|
|
channel="C1"
|
|
level="win:Critical"
|
|
message="$(string.event.114)"
|
|
opcode="win:Info"
|
|
symbol="SampleEvt_UINT32_ERRORCODE"
|
|
task="SampleTask2"
|
|
template="T_UINT32_ERRORCODE"
|
|
value="114"
|
|
/>
|
|
<event
|
|
channel="C1"
|
|
level="win:Critical"
|
|
message="$(string.event.115)"
|
|
opcode="win:Resume"
|
|
symbol="SampleEvt_UINT32_HEXINT32"
|
|
task="SampleTask2"
|
|
template="T_UINT32_HEXINT32"
|
|
value="115"
|
|
/>
|
|
<event
|
|
channel="C1"
|
|
level="win:Critical"
|
|
message="$(string.event.116)"
|
|
opcode="win:Suspend"
|
|
symbol="SampleEvt_INT64"
|
|
task="SampleTask2"
|
|
template="T_INT64"
|
|
value="116"
|
|
/>
|
|
<event
|
|
channel="C1"
|
|
level="win:Critical"
|
|
message="$(string.event.117)"
|
|
opcode="win:Send"
|
|
symbol="SampleEvt_UINT64"
|
|
task="SampleTask2"
|
|
template="T_UINT64"
|
|
value="117"
|
|
/>
|
|
<event
|
|
channel="C1"
|
|
level="win:Critical"
|
|
message="$(string.event.118)"
|
|
opcode="win:Receive"
|
|
symbol="SampleEvt_UINT64_HEXInt64"
|
|
task="SampleTask2"
|
|
template="T_UINT64_HEXInt64"
|
|
value="118"
|
|
/>
|
|
<event
|
|
channel="C1"
|
|
level="win:Critical"
|
|
message="$(string.event.119)"
|
|
opcode="SampleOpcode1"
|
|
symbol="SampleEvt_FLOAT"
|
|
task="SampleTask2"
|
|
template="T_FLOAT"
|
|
value="119"
|
|
/>
|
|
<event
|
|
channel="C1"
|
|
level="win:Critical"
|
|
message="$(string.event.120)"
|
|
opcode="SampleOpcode2"
|
|
symbol="SampleEvt_DOUBLE"
|
|
task="SampleTask2"
|
|
template="T_DOUBLE"
|
|
value="120"
|
|
/>
|
|
<event
|
|
channel="C1"
|
|
level="win:Critical"
|
|
message="$(string.event.121)"
|
|
opcode="win:Start"
|
|
symbol="SampleEvt_BOOL"
|
|
task="SampleTask3"
|
|
template="T_BOOL"
|
|
value="121"
|
|
/>
|
|
<event
|
|
channel="C1"
|
|
level="win:Critical"
|
|
message="$(string.event.125)"
|
|
opcode="win:Stop"
|
|
symbol="SampleEvt_GUID"
|
|
task="SampleTask3"
|
|
template="T_GUID"
|
|
value="125"
|
|
/>
|
|
<event
|
|
channel="C1"
|
|
level="win:Critical"
|
|
message="$(string.event.126)"
|
|
opcode="win:Info"
|
|
symbol="SampleEvt_POINTER"
|
|
task="SampleTask3"
|
|
template="T_POINTER"
|
|
value="126"
|
|
/>
|
|
<event
|
|
channel="C1"
|
|
level="win:Critical"
|
|
message="$(string.event.127)"
|
|
opcode="win:Resume"
|
|
symbol="SampleEvt_FILETIME"
|
|
task="SampleTask3"
|
|
template="T_FILETIME"
|
|
value="127"
|
|
/>
|
|
<event
|
|
channel="C1"
|
|
level="win:Critical"
|
|
message="$(string.event.128)"
|
|
opcode="win:Suspend"
|
|
symbol="SampleEvt_SYSTEMTIME"
|
|
task="SampleTask3"
|
|
template="T_SYSTEMTIME"
|
|
value="128"
|
|
/>
|
|
<event
|
|
channel="C1"
|
|
level="win:Critical"
|
|
message="$(string.event.129)"
|
|
opcode="win:Send"
|
|
symbol="SampleEvt_SID"
|
|
task="SampleTask3"
|
|
template="T_SID"
|
|
value="129"
|
|
/>
|
|
<event
|
|
channel="C2"
|
|
level="win:Informational"
|
|
message="$(string.event.200)"
|
|
opcode="win:Receive"
|
|
symbol="SampleEvt_UnicodeString"
|
|
task="SampleTask3"
|
|
template="T_UnicodeString"
|
|
value="200"
|
|
/>
|
|
<event
|
|
channel="C2"
|
|
level="win:Informational"
|
|
message="$(string.event.201)"
|
|
opcode="SampleOpcode1"
|
|
symbol="SampleEvt_AnsiString"
|
|
keywords="ResourceLimit"
|
|
task="SampleTask3"
|
|
template="T_AnsiString"
|
|
value="201"
|
|
/>
|
|
<event
|
|
channel="C2"
|
|
level="win:Informational"
|
|
message="$(string.event.202)"
|
|
opcode="SampleOpcode2"
|
|
symbol="SampleEvt_FixedLength_UnicodeString"
|
|
task="SampleTask3"
|
|
template="T_FixedLength_UnicodeString"
|
|
value="202"
|
|
/>
|
|
<event
|
|
channel="C2"
|
|
level="win:Informational"
|
|
message="$(string.event.203)"
|
|
opcode="win:Start"
|
|
symbol="SampleEvt_FixedLength_AnsiString"
|
|
task="SampleTask4"
|
|
template="T_FixedLength_AnsiString"
|
|
value="203"
|
|
/>
|
|
<event
|
|
channel="C2"
|
|
level="win:Informational"
|
|
message="$(string.event.204)"
|
|
opcode="win:Stop"
|
|
symbol="SampleEvt_FixedLength_Binary"
|
|
task="SampleTask4"
|
|
template="T_FixedLength_Binary"
|
|
value="204"
|
|
/>
|
|
<event
|
|
channel="C2"
|
|
level="win:Informational"
|
|
message="$(string.event.205)"
|
|
opcode="win:Info"
|
|
symbol="SampleEvt_ParamLength_UnicodeString"
|
|
task="SampleTask4"
|
|
template="T_ParamLength_UnicodeString"
|
|
value="205"
|
|
/>
|
|
<event
|
|
channel="C2"
|
|
level="win:Informational"
|
|
message="$(string.event.206)"
|
|
opcode="win:Resume"
|
|
symbol="SampleEvt_ParamLength_AniString"
|
|
task="SampleTask4"
|
|
template="T_ParamLength_AnsiString"
|
|
value="206"
|
|
/>
|
|
<event
|
|
channel="C2"
|
|
level="win:Informational"
|
|
message="$(string.event.207)"
|
|
opcode="win:Suspend"
|
|
symbol="SampleEvt_ParamLength_Binary"
|
|
task="SampleTask4"
|
|
template="T_ParamLength_Binary"
|
|
value="207"
|
|
/>
|
|
<event
|
|
channel="C2"
|
|
level="win:Informational"
|
|
message="$(string.event.208)"
|
|
opcode="win:Send"
|
|
symbol="SampleEvt_Binary_HexBinary"
|
|
task="SampleTask4"
|
|
template="T_Binary_HexBinary"
|
|
value="208"
|
|
/>
|
|
<event
|
|
channel="C2"
|
|
level="win:Informational"
|
|
message="$(string.event.209)"
|
|
opcode="win:Receive"
|
|
symbol="SampleEvt_BINARY_IPv6"
|
|
task="SampleTask4"
|
|
template="T_BINARY_IPv6"
|
|
value="209"
|
|
/>
|
|
<event
|
|
channel="C2"
|
|
level="win:Informational"
|
|
message="$(string.event.210)"
|
|
opcode="SampleOpcode1"
|
|
symbol="SampleEvt_BINARY_SOCKETADDRRESS"
|
|
task="SampleTask4"
|
|
template="T_BINARY_SOCKETADDRRESS"
|
|
value="210"
|
|
/>
|
|
<event
|
|
channel="C4"
|
|
level="win:Warning"
|
|
message="$(string.event.300)"
|
|
opcode="SampleOpcode2"
|
|
symbol="SampleEvt_FixedCount_Int8"
|
|
task="SampleTask4"
|
|
template="T_FixedCount_Int8"
|
|
value="300"
|
|
/>
|
|
<event
|
|
channel="C4"
|
|
level="win:Warning"
|
|
message="$(string.event.300)"
|
|
opcode="win:Start"
|
|
symbol="SampleEvt_FixedCount_UnicodeString"
|
|
task="SampleTask5"
|
|
template="T_FixedCount_UnicodeString"
|
|
value="301"
|
|
/>
|
|
<event
|
|
channel="C4"
|
|
level="win:Warning"
|
|
message="$(string.event.300)"
|
|
opcode="win:Stop"
|
|
symbol="SampleEvt_FixedCount_AnsiString"
|
|
task="SampleTask5"
|
|
template="T_FixedCount_AnsiString"
|
|
value="302"
|
|
/>
|
|
<event
|
|
channel="C4"
|
|
level="win:Warning"
|
|
message="$(string.event.300)"
|
|
opcode="win:Info"
|
|
symbol="SampleEvt_FixedCount_FixedLength_UnicodeString"
|
|
task="SampleTask5"
|
|
template="T_FixedCount_FixedLength_UnicodeString"
|
|
value="303"
|
|
/>
|
|
<event
|
|
channel="C4"
|
|
level="win:Warning"
|
|
message="$(string.event.300)"
|
|
opcode="win:Resume"
|
|
symbol="SampleEvt_FixedCount_FixedLength_AnsiString"
|
|
task="SampleTask5"
|
|
template="T_FixedCount_FixedLength_AnsiString"
|
|
value="304"
|
|
/>
|
|
<event
|
|
channel="C4"
|
|
level="win:Critical"
|
|
message="$(string.event.300)"
|
|
opcode="win:Suspend"
|
|
symbol="SampleEvt_FixedCount_FixedLength_Binary"
|
|
task="SampleTask5"
|
|
template="T_FixedCount_FixedLength_Binary"
|
|
value="305"
|
|
/>
|
|
<event
|
|
channel="C4"
|
|
level="win:Warning"
|
|
message="$(string.event.300)"
|
|
opcode="win:Send"
|
|
symbol="SampleEvt_FixedCount_ParamLength_UnicodeString"
|
|
task="SampleTask5"
|
|
template="T_FixedCount_ParamLength_UnicodeString"
|
|
value="306"
|
|
/>
|
|
<event
|
|
channel="C4"
|
|
level="win:Warning"
|
|
message="$(string.event.300)"
|
|
opcode="win:Receive"
|
|
symbol="SampleEvt_FixedCount_ParamLength_AnsiString"
|
|
task="SampleTask5"
|
|
template="T_FixedCount_ParamLength_AnsiString"
|
|
value="307"
|
|
/>
|
|
<event
|
|
channel="C4"
|
|
level="win:Warning"
|
|
message="$(string.event.300)"
|
|
opcode="SampleOpcode1"
|
|
symbol="SampleEvt_FixedCount_ParamLength_Binary"
|
|
task="SampleTask5"
|
|
template="T_FixedCount_ParamLength_Binary"
|
|
value="308"
|
|
/>
|
|
<event
|
|
channel="C4"
|
|
level="win:Warning"
|
|
message="$(string.event.300)"
|
|
opcode="SampleOpcode2"
|
|
symbol="SampleEvt_ParamCount_Int8"
|
|
task="SampleTask5"
|
|
template="T_ParamCount_Int8"
|
|
value="309"
|
|
/>
|
|
<event
|
|
channel="C4"
|
|
level="win:Warning"
|
|
message="$(string.event.300)"
|
|
opcode="win:Extension"
|
|
symbol="SampleEvt_ParamCount_UnicodeString"
|
|
task="SampleTask1"
|
|
template="T_ParamCount_UnicodeString"
|
|
value="310"
|
|
/>
|
|
<event
|
|
channel="C4"
|
|
level="win:Warning"
|
|
message="$(string.event.300)"
|
|
opcode="win:Reply"
|
|
symbol="SampleEvt_ParamCount_AnsiString"
|
|
task="SampleTask1"
|
|
template="T_ParamCount_AnsiString"
|
|
value="311"
|
|
/>
|
|
<event
|
|
channel="C4"
|
|
level="win:Warning"
|
|
message="$(string.event.300)"
|
|
opcode="SampleOpcode3"
|
|
symbol="SampleEvt_ParamCount_FixedLength_UnicodeString"
|
|
task="SampleTask1"
|
|
template="T_ParamCount_FixedLength_UnicodeString"
|
|
value="312"
|
|
/>
|
|
<event
|
|
channel="C4"
|
|
level="win:Warning"
|
|
message="$(string.event.300)"
|
|
opcode="SampleOpcode4"
|
|
symbol="SampleEvt_ParamCount_FixedLength_AnsiString"
|
|
task="SampleTask1"
|
|
template="T_ParamCount_FixedLength_AnsiString"
|
|
value="313"
|
|
/>
|
|
<event
|
|
channel="C4"
|
|
level="win:Warning"
|
|
message="$(string.event.300)"
|
|
opcode="SampleOpcode5"
|
|
symbol="SampleEvt_ParamCount_FixedLength_Binary"
|
|
task="SampleTask1"
|
|
template="T_ParamCount_FixedLength_Binary"
|
|
value="314"
|
|
/>
|
|
<event
|
|
channel="C4"
|
|
level="win:Warning"
|
|
message="$(string.event.300)"
|
|
opcode="win:Extension"
|
|
symbol="SampleEvt_ParamCount_ParamLength_UnicodeString"
|
|
task="SampleTask2"
|
|
template="T_ParamCount_ParamLength_UnicodeString"
|
|
value="315"
|
|
/>
|
|
<event
|
|
channel="C4"
|
|
level="win:Warning"
|
|
message="$(string.event.300)"
|
|
opcode="win:Reply"
|
|
symbol="SampleEvt_ParamCount_ParamLength_AnsiString"
|
|
task="SampleTask2"
|
|
template="T_ParamCount_ParamLength_AnsiString"
|
|
value="316"
|
|
/>
|
|
<event
|
|
channel="C4"
|
|
level="win:Warning"
|
|
message="$(string.event.300)"
|
|
opcode="SampleOpcode3"
|
|
symbol="SampleEvt_ParamCount_ParamLength_Binary"
|
|
task="SampleTask2"
|
|
template="T_ParamCount_ParamLength_Binary"
|
|
value="317"
|
|
/>
|
|
<event
|
|
channel="C5"
|
|
level="win:Critical"
|
|
message="$(string.event.400)"
|
|
opcode="SampleOpcode4"
|
|
symbol="SampleEvt_UserData_All_Types"
|
|
task="SampleTask2"
|
|
template="T_UserData_All_Types"
|
|
value="500"
|
|
/>
|
|
<event
|
|
channel="C5"
|
|
level="win:Error"
|
|
message="$(string.event.400)"
|
|
opcode="SampleOpcode5"
|
|
symbol="SampleEvt_UserChannel_UnicodeString"
|
|
task="SampleTask2"
|
|
template="T_UnicodeString"
|
|
value="600"
|
|
/>
|
|
<event
|
|
channel="C5"
|
|
level="win:Error"
|
|
message="$(string.event.400)"
|
|
opcode="win:Extension"
|
|
symbol="SampleEvt_UserChannel_UINT8"
|
|
task="SampleTask3"
|
|
template="T_UINT8"
|
|
value="601"
|
|
/>
|
|
<event
|
|
channel="C5"
|
|
level="win:Error"
|
|
message="$(string.event.400)"
|
|
opcode="win:Reply"
|
|
symbol="SampleEvt_UserKeyword_UINT8"
|
|
task="SampleTask3"
|
|
keywords="ResourceLimit"
|
|
template="T_UINT8"
|
|
value="602"
|
|
/>
|
|
<event
|
|
channel="C5"
|
|
level="win:Error"
|
|
message="$(string.event.400)"
|
|
opcode="SampleOpcode3"
|
|
symbol="SampleEvt_Alignment_UInt8_UnicodeString"
|
|
task="SampleTask3"
|
|
keywords="ResourceLimit"
|
|
template="T_Alignment_UInt8_UnicodeString"
|
|
value="603"
|
|
/>
|
|
<event
|
|
channel="C5"
|
|
level="win:Error"
|
|
message="$(string.event.400)"
|
|
opcode="SampleOpcode4"
|
|
symbol="SampleEvt_ValueMap_UInt8"
|
|
task="SampleTask3"
|
|
keywords="ResourceLimit"
|
|
template="T_ValueMap_UInt8"
|
|
value="605"
|
|
/>
|
|
<event
|
|
channel="C5"
|
|
level="win:Error"
|
|
message="$(string.event.400)"
|
|
opcode="SampleOpcode5"
|
|
symbol="SampleEvt_BitMap_UInt8"
|
|
task="SampleTask3"
|
|
keywords="ResourceLimit"
|
|
template="T_BitMap_UInt8"
|
|
value="606"
|
|
/>
|
|
<event
|
|
channel="C5"
|
|
level="win:Warning"
|
|
message="$(string.event.400)"
|
|
opcode="win:Extension"
|
|
symbol="SampleEvt_UInt32_Win32Error"
|
|
task="SampleTask4"
|
|
template="T_UInt32_Win32Error"
|
|
value="700"
|
|
/>
|
|
<event
|
|
channel="C5"
|
|
level="win:Warning"
|
|
message="$(string.event.400)"
|
|
opcode="win:Reply"
|
|
symbol="SampleEvt_UInt32_NTSTATUS"
|
|
task="SampleTask4"
|
|
template="T_UInt32_NTSTATUS"
|
|
value="701"
|
|
/>
|
|
<event
|
|
channel="C5"
|
|
level="win:Warning"
|
|
message="$(string.event.400)"
|
|
opcode="SampleOpcode3"
|
|
symbol="SampleEvt_Int32_HResult"
|
|
task="SampleTask4"
|
|
template="T_Int32_HResult"
|
|
value="702"
|
|
/>
|
|
<!--duplicate event id but different version-->
|
|
<event
|
|
channel="C1"
|
|
level="win:Critical"
|
|
message="$(string.event.122)"
|
|
opcode="SampleOpcode4"
|
|
symbol="SampleEvt_INT8_V1"
|
|
task="SampleTask4"
|
|
template="T_INT8"
|
|
value="102"
|
|
version="1"
|
|
/>
|
|
<event
|
|
channel="C1"
|
|
level="win:Critical"
|
|
message="$(string.event.123)"
|
|
opcode="SampleOpcode5"
|
|
symbol="SampleEvt_INT8_V2"
|
|
task="SampleTask4"
|
|
template="T_INT8"
|
|
value="102"
|
|
version="2"
|
|
/>
|
|
<event
|
|
channel="C2"
|
|
level="win:Informational"
|
|
message="$(string.event.211)"
|
|
opcode="win:Extension"
|
|
symbol="SampleEvt_UnicodeString_V1"
|
|
task="SampleTask5"
|
|
template="T_UnicodeString"
|
|
value="200"
|
|
version="1"
|
|
/>
|
|
<event
|
|
channel="C4"
|
|
level="win:Warning"
|
|
message="$(string.event.300)"
|
|
opcode="win:Reply"
|
|
symbol="SampleEvt_FixedCount_Int8_V1"
|
|
task="SampleTask5"
|
|
template="T_FixedCount_Int8"
|
|
value="300"
|
|
version="1"
|
|
/>
|
|
<event
|
|
channel="C4"
|
|
level="win:Warning"
|
|
message="$(string.event.300)"
|
|
opcode="SampleOpcode3"
|
|
symbol="SampleEvt_FixedCount_Int8_V3"
|
|
task="SampleTask5"
|
|
template="T_FixedCount_Int8"
|
|
value="300"
|
|
version="3"
|
|
/>
|
|
<event
|
|
channel="C5"
|
|
level="win:Warning"
|
|
message="$(string.event.400)"
|
|
opcode="SampleOpcode4"
|
|
symbol="SampleEvt_Int32_HResult_V2"
|
|
task="SampleTask5"
|
|
template="T_Int32_HResult"
|
|
value="702"
|
|
version="2"
|
|
/>
|
|
</events>
|
|
</provider>
|
|
</events>
|
|
</instrumentation>
|
|
<localization>
|
|
<resources culture="en-US">
|
|
<stringTable>
|
|
<string
|
|
id="Task.SampleTask1"
|
|
value="Task ID: Sample Task 1"
|
|
/>
|
|
<string
|
|
id="Task.SampleTask2"
|
|
value="Task ID: Sample Task 2"
|
|
/>
|
|
<string
|
|
id="Task.SampleTask3"
|
|
value="Task ID: Sample Task 3"
|
|
/>
|
|
<string
|
|
id="Task.SampleTask4"
|
|
value="Task ID: Sample Task 4"
|
|
/>
|
|
<string
|
|
id="Task.SampleTask5"
|
|
value="Task ID: Sample Task 5"
|
|
/>
|
|
<string
|
|
id="Level.SampleLevel"
|
|
value="Level ID: Sample Level"
|
|
/>
|
|
<string
|
|
id="Opcode.SampleOpcode1"
|
|
value="Opcode ID: Sample Opcode 1"
|
|
/>
|
|
<string
|
|
id="Opcode.SampleOpcode2"
|
|
value="Opcode ID: Sample Opcode 2"
|
|
/>
|
|
<string
|
|
id="Opcode.SampleOpcode3"
|
|
value="Opcode ID: Sample Opcode 3"
|
|
/>
|
|
<string
|
|
id="Opcode.SampleOpcode4"
|
|
value="Opcode ID: Sample Opcode 4"
|
|
/>
|
|
<string
|
|
id="Opcode.SampleOpcode5"
|
|
value="Opcode ID: Sample Opcode 5"
|
|
/>
|
|
<string
|
|
id="event.100"
|
|
value="Event Message ID: event.100 - Event data: %1"
|
|
/>
|
|
<string
|
|
id="event.101"
|
|
value="Event Message ID: event.101 - Event data: %1"
|
|
/>
|
|
<string
|
|
id="event.102"
|
|
value="Event Message ID: event.102 - Event data: %1"
|
|
/>
|
|
<string
|
|
id="event.103"
|
|
value="Event Message ID: event.103 - Event data: %1"
|
|
/>
|
|
<string
|
|
id="event.104"
|
|
value="Event Message ID: event.104 - Event data: %1"
|
|
/>
|
|
<string
|
|
id="event.105"
|
|
value="Event Message ID: event.105 - Event data: %1"
|
|
/>
|
|
<string
|
|
id="event.106"
|
|
value="Event Message ID: event.106 - Event data: %1"
|
|
/>
|
|
<string
|
|
id="event.107"
|
|
value="Event Message ID: event.107 - Event data: %1"
|
|
/>
|
|
<string
|
|
id="event.108"
|
|
value="Event Message ID: event.108 - Event data: %1"
|
|
/>
|
|
<string
|
|
id="event.109"
|
|
value="Event Message ID: event.109 - Event data: %1"
|
|
/>
|
|
<string
|
|
id="event.110"
|
|
value="Event Message ID: event.110 - Event data: %1"
|
|
/>
|
|
<string
|
|
id="event.111"
|
|
value="Event Message ID: event.111 - Event data: %1"
|
|
/>
|
|
<string
|
|
id="event.112"
|
|
value="Event Message ID: event.112 - Event data: %1"
|
|
/>
|
|
<string
|
|
id="event.113"
|
|
value="Event Message ID: event.113 - Event data: %1"
|
|
/>
|
|
<string
|
|
id="event.114"
|
|
value="Event Message ID: event.114 - Event data: %1"
|
|
/>
|
|
<string
|
|
id="event.115"
|
|
value="Event Message ID: event.115 - Event data: %1"
|
|
/>
|
|
<string
|
|
id="event.116"
|
|
value="Event Message ID: event.116 - Event data: %1"
|
|
/>
|
|
<string
|
|
id="event.117"
|
|
value="Event Message ID: event.117 - Event data: %1"
|
|
/>
|
|
<string
|
|
id="event.118"
|
|
value="Event Message ID: event.118 - Event data: %1"
|
|
/>
|
|
<string
|
|
id="event.119"
|
|
value="Event Message ID: event.119 - Event data: %1"
|
|
/>
|
|
<string
|
|
id="event.120"
|
|
value="Event Message ID: event.120 - Event data: %1"
|
|
/>
|
|
<string
|
|
id="event.121"
|
|
value="Event Message ID: event.121 - Event data: %1"
|
|
/>
|
|
<string
|
|
id="event.122"
|
|
value="Event Message ID: event.122 - Event data: %1"
|
|
/>
|
|
<string
|
|
id="event.123"
|
|
value="Event Message ID: event.123 - Event data: %1"
|
|
/>
|
|
<string
|
|
id="event.124"
|
|
value="Event Message ID: event.124 - Event data: %1"
|
|
/>
|
|
<string
|
|
id="event.125"
|
|
value="Event Message ID: event.125 - Event data: %1"
|
|
/>
|
|
<string
|
|
id="event.126"
|
|
value="Event Message ID: event.126 - Event data: %1"
|
|
/>
|
|
<string
|
|
id="event.127"
|
|
value="Event Message ID: event.127 - Event data: %1"
|
|
/>
|
|
<string
|
|
id="event.128"
|
|
value="Event Message ID: event.128 - Event data: %1"
|
|
/>
|
|
<string
|
|
id="event.129"
|
|
value="Event Message ID: event.129 - Event data: %1"
|
|
/>
|
|
<string
|
|
id="event.300"
|
|
value="Event Message ID: event.300 - Event data: %1"
|
|
/>
|
|
<string
|
|
id="event.400"
|
|
value="Event Message ID: event.400 - Event data: %1"
|
|
/>
|
|
<string
|
|
id="event.200"
|
|
value="Event Message ID: event.200 - Event data: %1"
|
|
/>
|
|
<string
|
|
id="event.201"
|
|
value="Event Message ID: event.201 - Event data: %1"
|
|
/>
|
|
<string
|
|
id="event.202"
|
|
value="Event Message ID: event.202 - Event data: %1"
|
|
/>
|
|
<string
|
|
id="event.203"
|
|
value="Event Message ID: event.203 - Event data: %1"
|
|
/>
|
|
<string
|
|
id="event.204"
|
|
value="Event Message ID: event.204 - Event data: %1"
|
|
/>
|
|
<string
|
|
id="event.205"
|
|
value="Event Message ID: event.205 - Event data: %1"
|
|
/>
|
|
<string
|
|
id="event.206"
|
|
value="Event Message ID: event.206 - Event data: %1"
|
|
/>
|
|
<string
|
|
id="event.207"
|
|
value="Event Message ID: event.207 - Event data: %1"
|
|
/>
|
|
<string
|
|
id="event.208"
|
|
value="Event Message ID: event.208 - Event data: %1"
|
|
/>
|
|
<string
|
|
id="event.209"
|
|
value="Event Message ID: event.209 - Event data: %1"
|
|
/>
|
|
<string
|
|
id="event.210"
|
|
value="Event Message ID: event.210 - Event data: %1"
|
|
/>
|
|
<string
|
|
id="event.211"
|
|
value="Event Message ID: event.211 - Event data: %1"
|
|
/>
|
|
<string
|
|
id="VMap.ok"
|
|
value="OK"
|
|
/>
|
|
<string
|
|
id="VMap.bad"
|
|
value="BAD"
|
|
/>
|
|
<string
|
|
id="VMap.good"
|
|
value="GOOD"
|
|
/>
|
|
<string
|
|
id="BMap.red"
|
|
value="RED"
|
|
/>
|
|
<string
|
|
id="BMap.green"
|
|
value="GREEN"
|
|
/>
|
|
<string
|
|
id="BMap.blue"
|
|
value="BLUE"
|
|
/>
|
|
<string
|
|
id="AnalyticChannelMessage"
|
|
value="Analytic channel localized message goes here."
|
|
/>
|
|
<string
|
|
id="OperationalChannelMessage"
|
|
value="Operational channel localized message goes here."
|
|
/>
|
|
<string
|
|
id="providermessage"
|
|
value="Localized message goes here. provider name: Microsoft-Windows-SDKSample-AdvancedProvider."
|
|
/>
|
|
<string
|
|
id="resourcelimitkeywordmsg"
|
|
value="resource limit keyword message goes here."
|
|
/>
|
|
</stringTable>
|
|
</resources>
|
|
</localization>
|
|
</instrumentationManifest> |