EVENT_TRACE_HEADER

The EVENT_TRACE_HEADER is one of several types of fixed-size header that introduce variable-size data for events that are logged through Event Tracing for Windows (ETW). As with other types of event, those that begin with an EVENT_TRACE_HEADER accumulate first in trace buffers. To have these events persist in this raw form for ready inspection, configure the event tracing session to flush the trace buffers to an Event Trace Log (ETL) file.

Documentation Status

The EVENT_TRACE_HEADER structure is documented.

Layout

The EVENT_TRACE_HEADER is 0x30 bytes in both 32-bit and 64-bit Windows in all known versions.

Offset Definition
0x00
USHORT Size;
0x02
union {
    USHORT FieldTypeFlags;
    struct {
        UCHAR HeaderType;
        UCHAR MarkerFlags;
    };
};
0x04
union {
    ULONG Version;
    struct {
        UCHAR Type;
        UCHAR Level;
        USHORT Version;
    } Class;
};
0x08
ULONG ThreadId;
0x0C
ULONG ProcessId;
0x10
LARGE_INTEGER TimeStamp;
0x18
union {
    GUID Guid;
    ULONGLONG GuidPtr;
};
0x28
union {
    struct {
        ULONG KernelTime;
        ULONG UserTime;
    };
    ULONG64 ProcessorTime;
    struct {
        ULONG ClientContext;
        ULONG Flags;
    };
};

The first 4 bytes have common elements in all the various Trace Headers. All have the high two bits set in the MarkerFlags. What distinguishes a header as continuing specifically as an EVENT_TRACE_HEADER is the HeaderType:

Value Name Implied Layout
0x0A TRACE_HEADER_TYPE_FULL_HEADER32 0x30 bytes of header followed by 32-bit event data
0x14 TRACE_HEADER_TYPE_FULL_HEADER64 0x30 bytes of header followed by 64-bit event data