Method OnEventRecord

WinSysCore/TraceManager.cpp:257–320

}

void TraceManager::OnEventRecord(PEVENT_RECORD rec) {
	if (_handle == 0 || _isPaused)
		return;

	auto pid = rec->EventHeader.ProcessId;
	auto& eventName = GetKernelEventName(rec);
	if (eventName.empty() && _dumpUnnamedEvents)
		return;

	// use the separate heap
	std::shared_ptr<EventData> data(new EventData(rec, GetProcessImageById(pid), eventName, ++_index));

	// force copying properties
	data->GetProperties();

	if (rec->EventHeader.ProviderId == StackWalkGuid) {
		_index--;
		if (_lastEvent) {
			if (_lastEvent->GetThreadId() != data->GetProperty(L"StackThread")->GetValue<DWORD>())
				return;

			_lastEvent->SetStackEventData(data);
			_lastEvent.reset();
		}
		_lastExcluded = nullptr;
		return;
	}

	bool processEvent = ParseProcessStartStop(data.get());

	if (!processEvent && data->GetProcessId() == 0 || data->GetProcessId() == (DWORD)-1) {
		HandleNoProcessId(data.get());
	}

	if (!_filters.empty()) {
		// evaluate filters
		FilterContext context = { data.get() };
		auto result = FilterAction::None;
		for (auto& filter : _filters) {
			if (!filter->IsEnabled())
				continue;
			auto action = filter->Eval(context);
			if (action == FilterAction::Exclude) {
				result = action;
				break;
			}

			if (action == FilterAction::Include) {
				result = action;
				break;
			}
		}
		if (result == FilterAction::Exclude) {
			_filteredEvents++;
			_lastExcluded = data;
			return;
		}
	}