mirror of
https://github.com/microsoft/krabsetw
synced 2026-06-06 16:14:32 +00:00
John U
c526c45e5b
* add support for MOF providers, and update WPP example (#143) * updated predicate vector example doco Co-authored-by: Matt Swann <mswann@Microsoft.com>
45 lines
1.5 KiB
C++
45 lines
1.5 KiB
C++
// Copyright (c) Microsoft. All rights reserved.
|
|
// Licensed under the MIT license. See LICENSE file in the project root for full license information.
|
|
|
|
// This example shows how to use the any_of/all_of/none_of filter predicate vectors.
|
|
|
|
#include <iostream>
|
|
#include <cassert>
|
|
|
|
#include "..\..\krabs\krabs.hpp"
|
|
#include "examples.h"
|
|
|
|
void user_trace_006_predicate_vectors::start()
|
|
{
|
|
krabs::user_trace trace(L"My Named Trace");
|
|
|
|
// We will use the Process Trace
|
|
krabs::provider<> provider(L"Microsoft-Windows-Kernel-Process");
|
|
provider.any(0x10);
|
|
|
|
// We'll log events where one of the following is true
|
|
// - The Opcode is 1,
|
|
// - The Event ID is 2, or
|
|
// - The Version is 3
|
|
krabs::predicates::opcode_is opcode_is_1 = krabs::predicates::opcode_is(1);
|
|
krabs::predicates::id_is eventid_is_2 = krabs::predicates::id_is(2);
|
|
krabs::predicates::version_is version_is_3 = krabs::predicates::version_is(3);
|
|
|
|
krabs::event_filter filter(
|
|
krabs::predicates::any_of({
|
|
&opcode_is_1,
|
|
&eventid_is_2,
|
|
&version_is_3,
|
|
})
|
|
);
|
|
filter.add_on_event_callback([](const EVENT_RECORD& record, const krabs::trace_context& trace_context) {
|
|
krabs::schema schema(record, trace_context.schema_locator);
|
|
assert(schema.event_id() == 1 || schema.event_id() == 2);
|
|
printf("Event ID: %d || Opcode: %d || Version %d\n", schema.event_id(), schema.event_opcode(), schema.event_version());
|
|
});
|
|
|
|
provider.add_filter(filter);
|
|
trace.enable(provider);
|
|
trace.start();
|
|
}
|