New constructs a fresh event instance with basic fields and parameters from the raw ETW event record.
(seq uint64, evt *etw.EventRecord)
| 49 | // New constructs a fresh event instance with basic fields and parameters |
| 50 | // from the raw ETW event record. |
| 51 | func New(seq uint64, evt *etw.EventRecord) *Event { |
| 52 | var ( |
| 53 | pid = evt.Header.ProcessID |
| 54 | tid = evt.Header.ThreadID |
| 55 | cpu = *(*uint8)(unsafe.Pointer(&evt.BufferContext.ProcessorIndex[0])) |
| 56 | ts = filetime.ToEpoch(evt.Header.Timestamp) |
| 57 | typ = NewTypeFromEventRecord(evt) |
| 58 | ) |
| 59 | |
| 60 | e := &Event{ |
| 61 | Seq: seq, |
| 62 | PID: pid, |
| 63 | Tid: tid, |
| 64 | CPU: cpu, |
| 65 | Type: typ, |
| 66 | Category: typ.Category(), |
| 67 | Name: typ.String(), |
| 68 | Params: make(map[string]*Param), |
| 69 | Timestamp: ts, |
| 70 | Host: hostname.Get(), |
| 71 | } |
| 72 | |
| 73 | e.produceParams(evt) |
| 74 | e.adjustPID() |
| 75 | |
| 76 | return e |
| 77 | } |
| 78 | |
| 79 | func (e *Event) adjustPID() { |
| 80 | switch e.Category { |
no test coverage detected