Method Open

internal/etw/trace.go:392–405

Open opens an ETW trace processing handle for consuming events from an ETW real-time trace. It specifies the callbacks the consumer wants to use to receive the events or trace buffer statistics. The first callback function that receives buffer-related statistics for each buffer ETW flushes. ETW call

(consumer *Consumer, errs chan error)

// it delivers all the events in the buffer. The second callback function
// that ETW calls for each event in the buffer.
func (t *Trace) Open(consumer *Consumer, errs chan error) error {
	t.consumer = consumer
	t.errs = errs
	logfile := etw.NewEventTraceLogfile(t.Name)
	logfile.SetEventCallback(windows.NewCallback(t.processEventCallback))
	logfile.SetBufferCallback(windows.NewCallback(t.bufferStatsCallback))
	logfile.SetModes(etw.ProcessTraceModeRealtime | etw.ProcessTraceModeEventRecord)

	t.openHandle = etw.OpenTrace(logfile)
	if !t.openHandle.IsValid() {
		return fmt.Errorf("unable to open %s trace: %v", t.Name, windows.GetLastError().Error())
	}
	return nil
}

// processEventCallback is the event callback function signature that is called each time
// a new event is available on the session buffer. It does the heavy lifting of parsing incoming