mirror of
https://github.com/repnz/etw-providers-docs
synced 2026-06-08 17:06:44 +00:00
repnz
44 lines
2.0 KiB
XML
44 lines
2.0 KiB
XML
<instrumentationManifest xmlns="http://schemas.microsoft.com/win/2004/08/events">
|
|
<instrumentation xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:win="http://manifests.microsoft.com/win/2004/08/windows/events">
|
|
<events>
|
|
<provider name="Microsoft-Windows-ProcessExitMonitor" guid="{fd771d53-8492-4057-8e35-8c02813af49b}" resourceFileName="Microsoft-Windows-ProcessExitMonitor" messageFileName="Microsoft-Windows-ProcessExitMonitor" symbol="MicrosoftWindowsProcessExitMonitor" source="Xml" >
|
|
<keywords>
|
|
</keywords>
|
|
<tasks>
|
|
<task name="task_0" message="$(string.task_task_0)" value="0">
|
|
>
|
|
<opcodes>
|
|
<opcode name="opcode_64" message="$(string.opcode_task_0opcode_64)" value="64"/>
|
|
</opcodes>
|
|
</task>
|
|
</tasks>
|
|
<events>
|
|
<event value="3000" symbol="task_0PCODE_64pcode_64" version="0" task="task_0" opcode="opcode_64" level="win:Always" template="task_0PCODE_64pcode_64Args"/>
|
|
<event value="3001" symbol="task_0PCODE_64pcode_643001" version="0" task="task_0" opcode="opcode_64" level="win:Always" template="task_0PCODE_64pcode_643001Args"/>
|
|
</events>
|
|
<templates>
|
|
<template tid="task_0PCODE_64pcode_64Args">
|
|
<data name="param1" inType="win:UnicodeString"/>
|
|
<data name="param2" inType="win:UnicodeString"/>
|
|
<data name="param3" inType="win:UnicodeString"/>
|
|
</template>
|
|
<template tid="task_0PCODE_64pcode_643001Args">
|
|
<data name="param1" inType="win:UnicodeString"/>
|
|
<data name="param2" inType="win:UnicodeString"/>
|
|
<data name="param3" inType="win:UnicodeString"/>
|
|
<data name="param4" inType="win:UnicodeString"/>
|
|
</template>
|
|
</templates>
|
|
</provider>
|
|
</events>
|
|
</instrumentation>
|
|
<localization>
|
|
<resources culture="en-US">
|
|
<stringTable>
|
|
<string id="task_task_0" value="task_0"/>
|
|
<string id="opcode_task_0opcode_64" value="opcode_64"/>
|
|
</stringTable>
|
|
</resources>
|
|
</localization>
|
|
</instrumentationManifest>
|