EtwWriteString function (wdm.h)
The EventWriteString function is a tracing function that you can use when no sophisticated data is required. This function is similar to a debug print statement.
Syntax
NTSTATUS EtwWriteString(
[in] REGHANDLE RegHandle,
[in] UCHAR Level,
[in] ULONGLONG Keyword,
[in, optional] LPCGUID ActivityId,
[in] PCWSTR String
);
Parameters
[in] RegHandle
A Pointer to the event provider registration handle, which is returned by the EtwRegister function if the event provider registration is successful.
[in] Level
The level at which the event is active.
[in] Keyword
The keyword for the event. A keyword is a bitmask that makes general statements about the category of the event or error. Because the keyword is a bitmask, you can apply more than one keyword to a single event. You can define the keywords and bit positions, or you can use Windows-standard keywords, or you can use combination of your own keywords and the Windows keywords.
[in, optional] ActivityId
The identifier that indicates the activity associated with the event. The ActivityId provides a way to group related events and is used in end-to-end tracing. This identifier is optional and can be NULL.
[in] String
A null-terminated string (WCHAR).
Return value
The function returns STATUS_SUCCESS if the event is published successfully.
Remarks
Because the string produced by EventWriteString function is not localizable, this function is not recommended for use in production code. This function should not be used to log highly visible events.
You can call EtwWriteString at any IRQL. However, when IRQL is greater than APC_LEVEL, any data passed to the EtwWrite, EtwWriteEx, EtwWriteString, and EtwWriteTransfer functions must not be pageable. That is, any kernel-mode routine that is running at IRQL greater than APC_LEVEL cannot access pageable memory. Data passed to the EtwWrite, EtwWriteEx, EtwWriteString, and EtwWriteTransfer functions must reside in system-space memory, regardless of what the IRQL is.
Requirements
| Requirement | Value |
|---|---|
| Minimum supported client | Available in Windows Vista and later versions of Windows. |
| Target Platform | Universal |
| Header | wdm.h (include Wdm.h, Ntddk.h) |
| Library | NtosKrnl.lib |
| DLL | NtosKrnl.exe |
| IRQL | Any level (See Comments section.) |