| 166 | } |
| 167 | |
| 168 | void EventMetadata::AddMetadata(EVENT_RECORD* eventRecord) |
| 169 | { |
| 170 | if (eventRecord->EventHeader.EventDescriptor.Opcode == Microsoft_Windows_EventMetadata::EventInfo::Opcode) { |
| 171 | auto userData = (uint8_t const*) eventRecord->UserData; |
| 172 | auto tei = (TRACE_EVENT_INFO const*) userData; |
| 173 | |
| 174 | if (tei->DecodingSource == DecodingSourceTlg || tei->EventDescriptor.Channel == 0xB) { |
| 175 | return; // Don't store tracelogging metadata |
| 176 | } |
| 177 | |
| 178 | // Store metadata (overwriting any previous) |
| 179 | EventMetadataKey key; |
| 180 | key.guid_ = tei->ProviderGuid; |
| 181 | key.desc_ = tei->EventDescriptor; |
| 182 | metadata_[key].assign(userData, userData + eventRecord->UserDataLength); |
| 183 | } |
| 184 | } |
| 185 | |
| 186 | // Look up metadata for this provider/event and use it to look up the property. |
| 187 | // If the metadata isn't found look it up using TDH. Then, look up each |