| 202 | return S_OK; |
| 203 | } |
| 204 | HRESULT STDMETHODCALLTYPE OnEvent(ITraceEvent* pEvent, ITraceRelogger* pRelogger) |
| 205 | { |
| 206 | EVENT_RECORD* pEvt = nullptr; |
| 207 | pEvent->GetEventRecord(&pEvt); |
| 208 | const auto& hdr = pEvt->EventHeader; |
| 209 | const auto& desc = hdr.EventDescriptor; |
| 210 | const auto ts = (uint64_t)hdr.TimeStamp.QuadPart; |
| 211 | if (!firstTimestamp_) { |
| 212 | firstTimestamp_ = ts; |
| 213 | if (trimRangeMs_) { |
| 214 | trimRangeQpc_ = { |
| 215 | ts + uint64_t(trimRangeMs_->first * 10'000), |
| 216 | ts + uint64_t(trimRangeMs_->second * 10'000), |
| 217 | }; |
| 218 | } |
| 219 | } |
| 220 | lastTimestamp_ = ts; |
| 221 | eventCount_++; |
| 222 | if (hdr.ProviderId == Microsoft_Windows_EventMetadata::GUID) { |
| 223 | metadataEventCount_++; |
| 224 | } |
| 225 | bool canDiscard = true; |
| 226 | if (trimRangeQpc_) { |
| 227 | // tail events always discardable |
| 228 | if (ts > trimRangeQpc_->second) { |
| 229 | return S_OK; |
| 230 | } |
| 231 | // if we are trimming by time range, we probably want to preserve state events |
| 232 | if (!trimState_) { |
| 233 | if (auto pProducerFilter = stateFilter_.LookupProvider(hdr.ProviderId)) { |
| 234 | if (pProducerFilter->MatchesId(desc.Id)) { |
| 235 | canDiscard = false; |
| 236 | } |
| 237 | } |
| 238 | } |
| 239 | // trim non-state events in head preceding the trim range |
| 240 | if (canDiscard && ts < trimRangeQpc_->first) { |
| 241 | return S_OK; |
| 242 | } |
| 243 | } |
| 244 | // filter only if we have a filter object and not skipping filter step |
| 245 | if (canDiscard && pFilter_) { |
| 246 | if (auto pProducerFilter = pFilter_->LookupProvider(hdr.ProviderId)) { |
| 247 | // if filtering by event id, discard if id not allowed by producer filter |
| 248 | if (byId_ && !pProducerFilter->MatchesId(desc.Id)) { |
| 249 | return S_OK; |
| 250 | } |
| 251 | } |
| 252 | else { |
| 253 | return S_OK; |
| 254 | } |
| 255 | } |
| 256 | keepCount_++; |
| 257 | if (mode_ == Mode::Trim) { |
| 258 | pRelogger->Inject(pEvent); |
| 259 | } |
| 260 | if (listProcesses_) { |
| 261 | eventCountByProcess_[hdr.ProcessId]++; |
nothing calls this directly
no test coverage detected