TdhGetWppProperty function (tdh.h)

Retrieves a specific property associated with a WPP message.

Syntax

TDHSTATUS TdhGetWppProperty(
  [in]      TDH_HANDLE    Handle,
  [in]      PEVENT_RECORD EventRecord,
  [in]      PWSTR         PropertyName,
  [in, out] PULONG        BufferSize,
  [out]     PBYTE         Buffer
);

Parameters

[in] Handle

Type: TDH_HANDLE

A valid decoding handle.

[in] EventRecord

Type: PEVENT_RECORD

The event record passed to your EventRecordCallback callback.

[in] PropertyName

Type: PWSTR

The name of the property to retrieve.

For a list of possible values, see PROPERTY_DATA_DESCRIPTOR.

[in, out] BufferSize

Type: PULONG

Size of the Buffer parameter, in bytes.

[out] Buffer

Type: PBYTE

User-allocated buffer that receives the property data.

Return value

Type: ULONG

Returns ERROR_SUCCESS if successful. Otherwise, this function returns one of the following return codes in addition to others.

Return code	Description
ERROR_NOT_FOUND	The specified property was not found.
ERROR_INSUFFICIENT_BUFFER	BufferSize is too small. To get the required buffer size, call TdhGetWppProperty twice, once with a null buffer and a pointer to retrieve the buffer size and then again with the correctly sized buffer.
ERROR_INVALID_PARAMETER	One or more of the parameters is incorrect. This error is returned if the Handle, EventRecord, PropertyName, or Buffer parameter is NULL.

Remarks

To retrieve only the decoded event message without specifying a property name, call TdhGetWppMessage.

Requirements

Requirement	Value
Minimum supported client	Windows 8 [desktop apps only]
Minimum supported server	Windows Server 2012 [desktop apps only]
Target Platform	Windows
Header	tdh.h
Library	Tdh.lib
DLL	Tdh.dll

See also

EVENT_RECORD

EventRecordCallback

TdhGetPropertySize

TdhGetWppMessage