microsoft / krabsetw

KrabsETW provides a modern C++ wrapper and a .NET wrapper around the low-level ETW trace consumption functions.

microsoft/krabsetw Issues

NuGet feeds are not compliant with NuGet feed security requirements
Closed 2 months ago1
Couldn't installed KrabsETW nuget package via Visual Studio 2022
Updated 2 months ago
Wrong schema retrieval with TraceLogging events
Updated 4 months ago2
Does krabs etw handle trace closure in case of program crash? Can it cause a problem in enabling and starting the same session again?
Closed 4 months ago2
both Windows XP and Windows 2008 support ETW. Why not support these two systems?
Updated 4 months ago1
Can't query providers infomation using logman when setup a kernel trace using krabs::kernel::virtual_alloc_provider provider.
Closed 4 months ago1
Service Control Manager
Updated 5 months ago2
Why Service Control Manager provider doesn't generate any event id?
Updated 5 months ago2
Does krabs c++ library support c++11? What about v120 platform toolset?
Closed 5 months ago1
Possible ways to protect ETW trace sessions from getting stopped?
Closed 5 months ago1
Benefits and drawbacks of using a kernel_trace vs a user_trace for consuming an event which is in both?
Closed 5 months ago5
Expose ExtendedData
Updated 5 months ago1
Ability to control EVENT_FILTER_DESCRIPTOR
Updated 5 months ago1
Correct way for copying every info related to a given event in my event callback and passing it to another thread?
Closed 6 months ago1
No proper explanation for kernel_trace vs user_trace?
Closed 6 months ago3
Errors in file code
Updated 7 months ago
need support vs2022
Updated 8 months ago
Add out type for the property (_TDH_OUT_TYPE)
Closed 8 months ago1
[Help] i use c++ 11 and i create a payload filter then failed , status = ERROR_NOT_FOUND
Updated 10 months ago
The object_manager_provider does not support DuplicateHandle events
Updated a year ago1
Parsing .NET EventSource
Updated a year ago1
How to get the user mode call stack
Updated a year ago
Expose ExtendedData in a more general way.
Updated a year ago
Possible race condition
Updated 2 years ago1
heap alloc etw don't work
Updated 2 years ago1
Use krabsetw to detect .Net memory loading
Updated 2 years ago
"no_trace_sessions_remaining" exception
Closed 2 years ago1
Kernel image load event stackwalk not work
Updated 2 years ago
Question: possible inconsistency between schema, schema_key and the MS doc
Updated 2 years ago1
This repo is missing important files
Closed 2 years ago
get process id and thread id -1 from etw EventHeader on windows 7
Closed 3 years ago1
Unhandled exception thrown by get_event_schema_from_tdh() in ut::forward_events()
Updated 2 years ago6
ImageFileName cannot be parsed with wstring？
Updated 2 years ago1
System.TypeInitializationException under .NET Framework 4.7.2 and 4.8
Updated 2 years ago
Add option to specify timestamp type
Updated 2 years ago
Compilation error with Windows Kit 8.1 (EventNameOffset)
Updated 3 years ago3
Checking the project with a static analyzer
Updated 3 years ago
Native Nuget - Visual Studio / MsBuild integration is broken
Closed 3 years ago1
parse<boolean> is identified as UINT8
Updated 3 years ago4
Problem with determining the size of the property
Updated 3 years ago6
No Support For Consumption of Log Files
Updated 3 years ago2
schema::task_name() returns an invalid value.
Closed 3 years ago
Rundown events for Kernel logger are broken
Closed 3 years ago
Do IEventRecord objects get reused?
Closed 3 years ago8
C++ 20 Support
Closed 3 years ago3
How to log "clear log event (1102)"
Closed 3 years ago1
Microsoft-Windows-Security-Auditing not work on some versions
Closed 3 years ago2
how to handle map and unmap (excluding image files) event type in krabsetw
Updated 3 years ago6
how to get old_file_name, new_file_name from rename event in etw
Closed 3 years ago1
A Way to do have a 'catch-all' callback function
Closed 3 years ago5