enableFlagsDynamically crafts the system logger event mask depending on the compiled rules result or the config state. System logger flags is a bitmask that indicates which kernel events are delivered to the consumer when system logger session is started. At minimum, process events are published to
(config config.EventSourceConfig)
| 470 | // and initializing the EnableFlags field of the etw.EventTraceProperties |
| 471 | // structure for non-system logger providers will result in an error. |
| 472 | func (t *Trace) enableFlagsDynamically(config config.EventSourceConfig) etw.EventTraceFlags { |
| 473 | var flags etw.EventTraceFlags |
| 474 | |
| 475 | if !t.IsKernelTrace() { |
| 476 | return flags |
| 477 | } |
| 478 | |
| 479 | flags |= etw.Process |
| 480 | |
| 481 | if config.EnableThreadEvents { |
| 482 | flags |= etw.Thread |
| 483 | } |
| 484 | if config.EnableModuleEvents { |
| 485 | flags |= etw.Module |
| 486 | } |
| 487 | if config.EnableNetEvents { |
| 488 | flags |= etw.NetTCPIP |
| 489 | } |
| 490 | if config.EnableRegistryEvents { |
| 491 | flags |= etw.Registry |
| 492 | } |
| 493 | if config.EnableFileIOEvents { |
| 494 | flags |= etw.DiskFileIO | etw.FileIO | etw.FileIOInit |
| 495 | } |
| 496 | if config.EnableVAMapEvents { |
| 497 | flags |= etw.VaMap |
| 498 | } |
| 499 | if config.EnableMemEvents { |
| 500 | flags |= etw.VirtualAlloc |
| 501 | } |
| 502 | if config.EnableRegistryEvents { |
| 503 | flags |= etw.Registry |
| 504 | } |
| 505 | |
| 506 | return flags |
| 507 | } |