mirror of
https://github.com/repnz/etw-providers-docs
synced 2026-06-08 17:06:44 +00:00
repnz
155 lines
10 KiB
XML
155 lines
10 KiB
XML
<instrumentationManifest xmlns="http://schemas.microsoft.com/win/2004/08/events">
|
|
<instrumentation xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:win="http://manifests.microsoft.com/win/2004/08/windows/events">
|
|
<events>
|
|
<provider name="Microsoft-Windows-UAC-FileVirtualization" guid="{c02afc2b-e24e-4449-ad76-bcc2c2575ead}" resourceFileName="Microsoft-Windows-UAC-FileVirtualization" messageFileName="Microsoft-Windows-UAC-FileVirtualization" symbol="MicrosoftWindowsUACFileVirtualization" source="Xml" >
|
|
<keywords>
|
|
</keywords>
|
|
<tasks>
|
|
<task name="task_0" message="$(string.task_task_0)" value="0"/>
|
|
</tasks>
|
|
<maps>
|
|
<bitMap name="Flags">
|
|
<map value="0x1" message="$(string.map_FlagsKernel caller)"/>
|
|
<map value="0x2" message="$(string.map_FlagsImpersonated caller)"/>
|
|
<map value="0x4" message="$(string.map_FlagsDirectory file)"/>
|
|
<map value="0x8" message="$(string.map_FlagsNon-directory file)"/>
|
|
<map value="0x10" message="$(string.map_FlagsDelayed virtualization)"/>
|
|
<map value="0x20" message="$(string.map_FlagsOplock requested)"/>
|
|
<map value="0x40" message="$(string.map_FlagsOpened target directory)"/>
|
|
<map value="0x80" message="$(string.map_FlagsCopied global file)"/>
|
|
<map value="0x100" message="$(string.map_FlagsSource file was virtual)"/>
|
|
<map value="0x200" message="$(string.map_FlagsTarget file was virtual)"/>
|
|
</bitMap>
|
|
</maps>
|
|
<events>
|
|
<event value="2000" symbol="task_0" version="0" task="task_0" level="win:Error" template="task_0Args"/>
|
|
<event value="2001" symbol="task_02001" version="0" task="task_0" level="win:Error" template="task_0Args"/>
|
|
<event value="2002" symbol="task_02002" version="0" task="task_0" level="win:Error" template="task_0Args"/>
|
|
<event value="2003" symbol="task_02003" version="0" task="task_0" level="win:Error" template="task_0Args"/>
|
|
<event value="2004" symbol="task_02004" version="0" task="task_0" level="win:Error" template="task_0Args"/>
|
|
<event value="2005" symbol="task_02005" version="0" task="task_0" level="win:Error" template="task_0Args"/>
|
|
<event value="2006" symbol="task_02006" version="0" task="task_0" level="win:Error" template="task_02006Args"/>
|
|
<event value="2007" symbol="task_02007" version="0" task="task_0" level="win:Error" template="task_02007Args"/>
|
|
<event value="2008" symbol="task_02008" version="0" task="task_0" level="win:Error" template="task_02007Args"/>
|
|
<event value="2009" symbol="task_02009" version="0" task="task_0" level="win:Error" template="task_02007Args"/>
|
|
<event value="2010" symbol="task_02010" version="0" task="task_0" level="win:Error" template="task_02007Args"/>
|
|
<event value="2011" symbol="task_02011" version="0" task="task_0" level="win:Error" template="task_02007Args"/>
|
|
<event value="2012" symbol="task_02012" version="0" task="task_0" level="win:Error" template="task_02007Args"/>
|
|
<event value="2013" symbol="task_02013" version="0" task="task_0" level="win:Error" template="task_02007Args"/>
|
|
<event value="2014" symbol="task_02014" version="0" task="task_0" level="win:Error" template="task_02007Args"/>
|
|
<event value="2015" symbol="task_02015" version="0" task="task_0" level="win:Error" template="task_02007Args"/>
|
|
<event value="2016" symbol="task_02016" version="0" task="task_0" level="win:Error" template="task_02007Args"/>
|
|
<event value="2017" symbol="task_02017" version="0" task="task_0" level="win:Error" template="task_02007Args"/>
|
|
<event value="2018" symbol="task_02018" version="0" task="task_0" level="win:Error" template="task_02007Args"/>
|
|
<event value="2019" symbol="task_02019" version="0" task="task_0" level="win:Error" template="task_02007Args"/>
|
|
<event value="4000" symbol="task_04000" version="0" task="task_0" level="win:Informational" template="task_04000Args"/>
|
|
<event value="4001" symbol="task_04001" version="0" task="task_0" level="win:Informational" template="task_04001Args"/>
|
|
<event value="4002" symbol="task_04002" version="0" task="task_0" level="win:Informational" template="task_04002Args"/>
|
|
<event value="5000" symbol="task_05000" version="0" task="task_0" level="win:Verbose" template="task_05000Args"/>
|
|
<event value="5002" symbol="task_05002" version="0" task="task_0" level="win:Verbose" template="task_05002Args"/>
|
|
<event value="5003" symbol="task_05003" version="0" task="task_0" level="win:Verbose" template="task_04002Args"/>
|
|
<event value="5004" symbol="task_05004" version="0" task="task_0" level="win:Verbose" template="task_04002Args"/>
|
|
</events>
|
|
<templates>
|
|
<template tid="task_0Args">
|
|
<data name="Error" inType="win:UInt32"/>
|
|
</template>
|
|
<template tid="task_02006Args">
|
|
<data name="Flags" inType="win:UInt32" map="Flags"/>
|
|
<data name="SidLength" inType="win:UInt32"/>
|
|
<data name="Sid" inType="win:SID" length="SidLength"/>
|
|
<data name="FileNameLength" inType="win:UInt16"/>
|
|
<data name="FileNameBuffer" inType="win:UnicodeString" length="FileNameLength"/>
|
|
<data name="ProcessImageNameLength" inType="win:UInt16"/>
|
|
<data name="ProcessImageNameBuffer" inType="win:UnicodeString" length="ProcessImageNameLength"/>
|
|
<data name="Error" inType="win:UInt32"/>
|
|
</template>
|
|
<template tid="task_02007Args">
|
|
<data name="Flags" inType="win:UInt32"/>
|
|
<data name="SidLength" inType="win:UInt32"/>
|
|
<data name="Sid" inType="win:SID" length="SidLength"/>
|
|
<data name="FileNameLength" inType="win:UInt16"/>
|
|
<data name="FileNameBuffer" inType="win:UnicodeString" length="FileNameLength"/>
|
|
<data name="ProcessImageNameLength" inType="win:UInt16"/>
|
|
<data name="ProcessImageNameBuffer" inType="win:UnicodeString" length="ProcessImageNameLength"/>
|
|
<data name="Error" inType="win:UInt32"/>
|
|
</template>
|
|
<template tid="task_04000Args">
|
|
<data name="Flags" inType="win:UInt32"/>
|
|
<data name="SidLength" inType="win:UInt32"/>
|
|
<data name="Sid" inType="win:SID" length="SidLength"/>
|
|
<data name="FileNameLength" inType="win:UInt16"/>
|
|
<data name="FileNameBuffer" inType="win:UnicodeString" length="FileNameLength"/>
|
|
<data name="ProcessImageNameLength" inType="win:UInt16"/>
|
|
<data name="ProcessImageNameBuffer" inType="win:UnicodeString" length="ProcessImageNameLength"/>
|
|
<data name="CreateOptions" inType="win:UInt32"/>
|
|
<data name="DesiredAccess" inType="win:UInt32"/>
|
|
<data name="IrpMajorFunction" inType="win:UInt8"/>
|
|
</template>
|
|
<template tid="task_04001Args">
|
|
<data name="Flags" inType="win:UInt32"/>
|
|
<data name="SidLength" inType="win:UInt32"/>
|
|
<data name="Sid" inType="win:SID" length="SidLength"/>
|
|
<data name="FileNameLength" inType="win:UInt16"/>
|
|
<data name="FileNameBuffer" inType="win:UnicodeString" length="FileNameLength"/>
|
|
<data name="ProcessImageNameLength" inType="win:UInt16"/>
|
|
<data name="ProcessImageNameBuffer" inType="win:UnicodeString" length="ProcessImageNameLength"/>
|
|
<data name="TargetFileNameLength" inType="win:UInt16"/>
|
|
<data name="TargetFileNameBuffer" inType="win:UnicodeString" length="TargetFileNameLength"/>
|
|
</template>
|
|
<template tid="task_04002Args">
|
|
<data name="Flags" inType="win:UInt32"/>
|
|
<data name="SidLength" inType="win:UInt32"/>
|
|
<data name="Sid" inType="win:SID" length="SidLength"/>
|
|
<data name="FileNameLength" inType="win:UInt16"/>
|
|
<data name="FileNameBuffer" inType="win:UnicodeString" length="FileNameLength"/>
|
|
<data name="ProcessImageNameLength" inType="win:UInt16"/>
|
|
<data name="ProcessImageNameBuffer" inType="win:UnicodeString" length="ProcessImageNameLength"/>
|
|
</template>
|
|
<template tid="task_05000Args">
|
|
<data name="Flags" inType="win:UInt32"/>
|
|
<data name="SidLength" inType="win:UInt32"/>
|
|
<data name="Sid" inType="win:SID" length="SidLength"/>
|
|
<data name="FileNameLength" inType="win:UInt16"/>
|
|
<data name="FileNameBuffer" inType="win:UnicodeString" length="FileNameLength"/>
|
|
<data name="ProcessImageNameLength" inType="win:UInt16"/>
|
|
<data name="ProcessImageNameBuffer" inType="win:UnicodeString" length="ProcessImageNameLength"/>
|
|
<data name="CreateOptions" inType="win:UInt32"/>
|
|
<data name="DesiredAccess" inType="win:UInt32"/>
|
|
<data name="IrpMajorFunction" inType="win:UInt8"/>
|
|
<data name="Exclusions" inType="win:UInt32"/>
|
|
</template>
|
|
<template tid="task_05002Args">
|
|
<data name="Flags" inType="win:UInt32"/>
|
|
<data name="SidLength" inType="win:UInt32"/>
|
|
<data name="Sid" inType="win:SID" length="SidLength"/>
|
|
<data name="FileNameLength" inType="win:UInt16"/>
|
|
<data name="FileNameBuffer" inType="win:UnicodeString" length="FileNameLength"/>
|
|
<data name="ProcessImageNameLength" inType="win:UInt16"/>
|
|
<data name="ProcessImageNameBuffer" inType="win:UnicodeString" length="ProcessImageNameLength"/>
|
|
<data name="CreateOptions" inType="win:UInt32"/>
|
|
<data name="DesiredAccess" inType="win:UInt32"/>
|
|
</template>
|
|
</templates>
|
|
</provider>
|
|
</events>
|
|
</instrumentation>
|
|
<localization>
|
|
<resources culture="en-US">
|
|
<stringTable>
|
|
<string id="task_task_0" value="task_0"/>
|
|
<string id="map_FlagsKernel caller" value="Kernel caller"/>
|
|
<string id="map_FlagsImpersonated caller" value="Impersonated caller"/>
|
|
<string id="map_FlagsDirectory file" value="Directory file"/>
|
|
<string id="map_FlagsNon-directory file" value="Non-directory file"/>
|
|
<string id="map_FlagsDelayed virtualization" value="Delayed virtualization"/>
|
|
<string id="map_FlagsOplock requested" value="Oplock requested"/>
|
|
<string id="map_FlagsOpened target directory" value="Opened target directory"/>
|
|
<string id="map_FlagsCopied global file" value="Copied global file"/>
|
|
<string id="map_FlagsSource file was virtual" value="Source file was virtual"/>
|
|
<string id="map_FlagsTarget file was virtual" value="Target file was virtual"/>
|
|
</stringTable>
|
|
</resources>
|
|
</localization>
|
|
</instrumentationManifest>
|