ferrisetw

https://docs.rs/ferrisetw/latest/ferrisetw/
Admin
ferrisetw is a Rust crate that provides safe abstractions over the Event Tracing for Windows (ETW)...
Tokens:11,355
Snippets:199
Trust Score:9.1
Update:2 months ago
Show doc for...
Tokens:
Raw
### pub fn start(self) -> Result<(FileTrace, TraceHandle), TraceError>

Source: https://docs.rs/ferrisetw/latest/ferrisetw/trace/struct.FileTraceBuilder.html

Builds the FileTrace and starts the trace session.

```APIDOC
## pub fn start(self) -> Result<(FileTrace, TraceHandle), TraceError>

### Description
Builds the `FileTrace` and starts the trace session. Refer to `TraceBuilder::start` for additional details.

### Returns
- **Result<(FileTrace, TraceHandle), TraceError>** - A result containing the FileTrace and TraceHandle on success, or a TraceError on failure.
```

--------------------------------

### TraceBuilder::start

Source: https://docs.rs/ferrisetw/latest/ferrisetw/trace/struct.TraceBuilder.html

Builds the trace session and starts it, returning the trace object and a handle.

```APIDOC
## pub fn start(self) -> Result<(T, TraceHandle), TraceError>

### Description
Builds the UserTrace or KernelTrace and starts the trace session. Internally calls StartTraceW, EnableTraceEx2, and OpenTraceW.
```

--------------------------------

### FileTrace::process

Source: https://docs.rs/ferrisetw/latest/ferrisetw/trace/struct.FileTrace.html

Starts the trace session and begins triggering callbacks.

```APIDOC
## pub fn process(&mut self) -> Result<(), TraceError>

### Description
This method is blocking and starts triggering the callbacks for events read from the file.
```

--------------------------------

### KernelTrace::new

Source: https://docs.rs/ferrisetw/latest/ferrisetw/trace/struct.KernelTrace.html

Creates a new builder instance for configuring and starting a KernelTrace session.

```APIDOC
## pub fn new() -> TraceBuilder<KernelTrace>

### Description
Creates a new `TraceBuilder` for `KernelTrace`. This is the entry point for initializing a real-time trace session.

### Returns
- **TraceBuilder<KernelTrace>** - A builder object used to configure and start the trace session.
```

--------------------------------

### pub fn start_and_process(self) -> Result<FileTrace, TraceError>

Source: https://docs.rs/ferrisetw/latest/ferrisetw/trace/struct.FileTraceBuilder.html

Convenience method that starts the trace session and processes it on a spawned thread.

```APIDOC
## pub fn start_and_process(self) -> Result<FileTrace, TraceError>

### Description
Convenience method that calls `TraceBuilder::start` then `process`. Note that `process` is called on a spawned thread, so this method does not provide a way to retrieve errors from the processing step.

### Returns
- **Result<FileTrace, TraceError>** - A result containing the FileTrace on success, or a TraceError on failure.
```

--------------------------------

### process

Source: https://docs.rs/ferrisetw/latest/ferrisetw/trace/trait.TraceTrait.html

Starts processing the trace in a blocking manner, triggering callbacks.

```APIDOC
## fn process(&mut self) -> Result<(), TraceError>

### Description
Starts triggering callbacks for the trace. This method is blocking and should typically be called from a background thread.
```

--------------------------------

### UserTrace::process

Source: https://docs.rs/ferrisetw/latest/ferrisetw/trace/struct.UserTrace.html

Starts processing trace events.

```APIDOC
## pub fn process(&mut self) -> Result<(), TraceError>

### Description
Starts a blocking operation that processes trace events and triggers associated callbacks.

### Returns
- **Result<(), TraceError>** - Returns Ok(()) on success, or a TraceError if the operation fails.
```

--------------------------------

### TraceBuilder::start_and_process

Source: https://docs.rs/ferrisetw/latest/ferrisetw/trace/struct.TraceBuilder.html

A convenience method that starts the trace and begins processing events on a spawned thread.

```APIDOC
## pub fn start_and_process(self) -> Result<T, TraceError>

### Description
Convenience method that calls TraceBuilder::start then process on a spawned thread.
```

--------------------------------

### Provider::by_guid

Source: https://docs.rs/ferrisetw/latest/ferrisetw/provider/struct.Provider.html

Creates a Provider builder defined by its GUID. Accepts various types that implement Into<GUID>.

```APIDOC
## pub fn by_guid<G: Into<GUID>>(guid: G) -> ProviderBuilder

### Description
Creates a Provider defined by its GUID. Many types implement `Into<GUID>` and are acceptable as an argument, including `GUID` themselves and `&str`.
```

--------------------------------

### GUID Struct Definition

Source: https://docs.rs/ferrisetw/latest/ferrisetw/struct.GUID.html

The memory-aligned structure definition for a GUID.

```rust
#[repr(C)]
pub struct GUID {
    pub data1: u32,
    pub data2: u16,
    pub data3: u16,
    pub data4: [u8; 8],
}
```

--------------------------------

### KernelProvider struct definition

Source: https://docs.rs/ferrisetw/latest/ferrisetw/provider/kernel_providers/struct.KernelProvider.html

The structure definition for KernelProvider containing the GUID and flags.

```rust
pub struct KernelProvider {
    pub guid: GUID,
    pub flags: u32,
}
```

--------------------------------

### Access Extended Data

Source: https://docs.rs/ferrisetw/latest/ferrisetw/struct.EventRecord.html

Example of retrieving extended data from an EventRecord using a callback.

```rust
use windows::Win32::System::Diagnostics::Etw::EVENT_HEADER_EXT_TYPE_RELATED_ACTIVITYID;

let my_callback = |record: &EventRecord, schema_locator: &SchemaLocator| {
    let schema = schema_locator.event_schema(record).unwrap();
    let activity_id = record
        .extended_data()
        .iter()
        .find(|edata| edata.data_type() as u32 == EVENT_HEADER_EXT_TYPE_RELATED_ACTIVITYID)
        .map(|edata| edata.to_extended_data_item());
};
```

--------------------------------

### Define RealTimeTraceTrait

Source: https://docs.rs/ferrisetw/latest/ferrisetw/trace/trait.RealTimeTraceTrait.html

The trait definition requiring TraceTrait and PrivateRealTimeTraceTrait, with methods for retrieving the trace GUID and name.

```rust
pub trait RealTimeTraceTrait: TraceTrait + PrivateRealTimeTraceTrait {
    // Required methods
    fn trace_guid() -> GUID;
    fn trace_name(&self) -> OsString;
}
```

--------------------------------

### stop_trace_by_name

Source: https://docs.rs/ferrisetw/latest/ferrisetw/trace/fn.stop_trace_by_name.html

Stops a trace given its name. This function is intended to close a trace you did not start yourself.

```APIDOC
## Function: stop_trace_by_name

### Description
Stop a trace given its name. This function is intended to close a trace you did not start yourself. Otherwise, you should prefer `UserTrace::stop()` or `KernelTrace::stop()`.

### Signature
`pub fn stop_trace_by_name(trace_name: &str) -> Result<(), TraceError>`

### Parameters
- **trace_name** (&str) - The name of the trace to stop.

### Returns
- **Result<(), TraceError>** - Returns `Ok(())` if the trace was successfully stopped, or a `TraceError` if an error occurred.
```

--------------------------------

### Create a Parser instance

Source: https://docs.rs/ferrisetw/latest/ferrisetw/parser/struct.Parser.html

Shows the initialization of a Parser using an EventRecord and its corresponding Schema.

```rust
let my_callback = |record: &EventRecord, schema_locator: &SchemaLocator| {
    let schema = schema_locator.event_schema(record).unwrap();
    let parser = Parser::create(record, &schema);
};
```

--------------------------------

### Create a new KernelProvider

Source: https://docs.rs/ferrisetw/latest/ferrisetw/provider/kernel_providers/struct.KernelProvider.html

Use the new constructor to initialize a KernelProvider instance.

```rust
pub const fn new(guid: GUID, flags: u32) -> KernelProvider
```

--------------------------------

### Access DISK_IO_INIT_PROVIDER

Source: https://docs.rs/ferrisetw/latest/ferrisetw/provider/kernel_providers/static.DISK_IO_INIT_PROVIDER.html

Displays the static definition of the Disk IO Init Kernel Provider.

```rust
pub static DISK_IO_INIT_PROVIDER: KernelProvider
```

--------------------------------

### Build the provider instance

Source: https://docs.rs/ferrisetw/latest/ferrisetw/provider/struct.ProviderBuilder.html

Finalizes the configuration and constructs the Provider object.

```rust
Provider::by_guid("22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716") // Microsoft-Windows-Kernel-Process
  .add_callback(process_callback)
  .build();
```

--------------------------------

### Create a Provider by Name

Source: https://docs.rs/ferrisetw/latest/ferrisetw/provider/struct.Provider.html

Initializes a provider using its string name. Note that this operation is slow as it queries the ITraceDataProviderCollection interface.

```rust
let my_provider = Provider::by_name("Microsoft-Windows-WinINet").unwrap().build();
```

--------------------------------

### Access FILE_INIT_IO_PROVIDER constant

Source: https://docs.rs/ferrisetw/latest/ferrisetw/provider/kernel_providers/static.FILE_INIT_IO_PROVIDER.html

Displays the static definition of the FILE_INIT_IO_PROVIDER constant.

```rust
pub static FILE_INIT_IO_PROVIDER: KernelProvider
```

--------------------------------

### Create a new FileTrace

Source: https://docs.rs/ferrisetw/latest/ferrisetw/trace/struct.FileTrace.html

Initializes a new trace session that reads events from a specified file path using a callback function.

```rust
pub fn new<T>(path: PathBuf, callback: T) -> FileTraceBuilder
where T: FnMut(&EventRecord, &SchemaLocator) + Send + Sync + 'static,
```

--------------------------------

### KernelProvider::new

Source: https://docs.rs/ferrisetw/latest/ferrisetw/provider/kernel_providers/struct.KernelProvider.html

Creates a new instance of a KernelProvider, which can be used to configure kernel providers within the system.

```APIDOC
## KernelProvider::new

### Description
Creates a new KernelProvider instance with the specified GUID and flags.

### Signature
`pub const fn new(guid: GUID, flags: u32) -> KernelProvider`

### Parameters
- **guid** (GUID) - The unique identifier for the kernel provider.
- **flags** (u32) - The configuration flags for the kernel provider.
```

--------------------------------

### Implement ETW Trace Processing

Source: https://docs.rs/ferrisetw/latest/ferrisetw/index.html

Defines a callback for event processing and initializes a user-mode trace session. Requires the ferrisetw crate and appropriate Windows privileges.

```rust
use ferrisetw::EventRecord;
use ferrisetw::schema_locator::SchemaLocator;
use ferrisetw::parser::Parser;
use ferrisetw::provider::Provider;
use ferrisetw::trace::{UserTrace, TraceTrait};

fn process_callback(record: &EventRecord, schema_locator: &SchemaLocator) {
    // Basic event scrutinizing can be done directly from the `EventRecord`
    if record.event_id() == 2 {
        // More advanced info can be retrieved from the event schema
        // (the SchemaLocator caches the schema for a given kind of event, so this call is cheap in case you've already encountered the same event kind previously)
        match schema_locator.event_schema(record) {
            Err(err) => println!("Error {:?}", err),
            Ok(schema) => {
                println!("Received an event from provider {}", schema.provider_name());

                // Finally, properties for a given event can be retrieved using a Parser
                let parser = Parser::create(record, &schema);

                // You'll need type inference to tell ferrisetw what type you want to parse into
                // In actual code, be sure to correctly handle Err values!
                let process_id: u32 = parser.try_parse("ProcessID").unwrap();
                let image_name: String = parser.try_parse("ImageName").unwrap();
                println!("PID: {} ImageName: {}", process_id, image_name);
            }
        }
    }
}

fn main() {
    // First we build a Provider
    let process_provider = Provider
        ::by_guid("22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716") // Microsoft-Windows-Kernel-Process
        .add_callback(process_callback)
        // .add_callback(process_callback) // it is possible to add multiple callbacks for a given provider
        // .add_filter(event_filters)      // it is possible to filter by event ID, process ID, etc.
        .build();

    // We start a real-time trace session for the previously registered provider
    // Callbacks will be run in a separate thread.
    let mut trace = UserTrace::new()
        .named(String::from("MyTrace"))
        .enable(process_provider)
        // .enable(other_provider) // It is possible to enable multiple providers on the same trace.
        // .set_etl_dump_file(...) // It is possible to dump the events that the callbacks are processing into a file
        .start_and_process()       // This call will spawn the thread for you.
                                   // See the doc for alternative ways of processing the trace,
                                   // with more or less flexibility regarding this spawned thread.
        .unwrap();

    std::thread::sleep(std::time::Duration::from_secs(3));

    // We stop the trace
    trace.stop();
}
```

--------------------------------

### Set the any flag in the Provider instance

Source: https://docs.rs/ferrisetw/latest/ferrisetw/provider/struct.ProviderBuilder.html

Configures the 'any' keyword mask for the provider.

```rust
let my_provider = Provider::by_guid("1EDEEE53-0AFE-4609-B846-D8C0B2075B1F").any(0xf0010000000003ff).build();
```

--------------------------------

### FileTrace::new

Source: https://docs.rs/ferrisetw/latest/ferrisetw/trace/struct.FileTrace.html

Creates a new trace session that reads events from a specified file path.

```APIDOC
## pub fn new<T>(path: PathBuf, callback: T) -> FileTraceBuilder

### Description
Creates a trace that will read events from a file. The provided callback is executed for each event record.

### Parameters
- **path** (PathBuf) - Required - The path to the ETL file.
- **callback** (T) - Required - A closure or function that implements FnMut(&EventRecord, &SchemaLocator) + Send + Sync + 'static.
```

--------------------------------

### Set the all flag in the Provider instance

Source: https://docs.rs/ferrisetw/latest/ferrisetw/provider/struct.ProviderBuilder.html

Configures the 'all' keyword mask for the provider.

```rust
let my_provider = Provider::by_guid("1EDEEE53-0AFE-4609-B846-D8C0B2075B1F").all(0x4000000000000000).build();
```

--------------------------------

### UserTrace::new

Source: https://docs.rs/ferrisetw/latest/ferrisetw/trace/struct.UserTrace.html

Creates a new builder for a UserTrace session.

```APIDOC
## pub fn new() -> TraceBuilder<UserTrace>

### Description
Creates a new UserTrace builder to configure and initialize a real-time trace session.

### Returns
- **TraceBuilder<UserTrace>** - A builder instance for configuring the trace.
```

--------------------------------

### Parse ETW event properties

Source: https://docs.rs/ferrisetw/latest/ferrisetw/parser/struct.Parser.html

Demonstrates how to initialize a Parser and extract properties using type inference or the turbofish operator.

```rust
let my_callback = |record: &EventRecord, schema_locator: &SchemaLocator| {
    let schema = schema_locator.event_schema(record).unwrap();
    let parser = Parser::create(record, &schema);

    // There are several ways to define the type requested for `try_parse`
    // It is possible to use type inference...
    let property1: Option<String> = parser.try_parse("PropertyName").ok();

    // ...or to use the turbofish operator
    match parser.try_parse::<u32>("OtherPropertyName") {
        Ok(_) => println!("OtherPropertyName is a valid u32"),
        Err(_) => println!("OtherPropertyName is invalid"),
    }
};
```

--------------------------------

### TraceBuilder::enable

Source: https://docs.rs/ferrisetw/latest/ferrisetw/trace/struct.TraceBuilder.html

Enables a specific provider for the trace session.

```APIDOC
## pub fn enable(self, provider: Provider) -> Self

### Description
Enables a Provider for this trace. The provider's callback will be invoked whenever an event is available.

### Parameters
- **provider** (Provider) - Required - The provider to enable.
```

--------------------------------

### Define a Provider

Source: https://docs.rs/ferrisetw/latest/ferrisetw/provider/struct.Provider.html

Shows the structure definition for the Provider type.

```rust
pub struct Provider { /* private fields */ }
```

--------------------------------

### Parser::create

Source: https://docs.rs/ferrisetw/latest/ferrisetw/parser/struct.Parser.html

Creates a new instance of a Parser for a specific event record and schema.

```APIDOC
## fn create(event_record: &EventRecord, schema: &Schema) -> Parser

### Description
Creates a new Parser instance associated with a specific ETW event record and its corresponding schema.

### Arguments
- **event_record** (&EventRecord) - The event record to be parsed.
- **schema** (&Schema) - The schema associated with the ETW event.
```

--------------------------------

### Provider::kernel

Source: https://docs.rs/ferrisetw/latest/ferrisetw/provider/struct.Provider.html

Creates a Provider builder for a Kernel Provider.

```APIDOC
## pub fn kernel(kernel_provider: &KernelProvider) -> ProviderBuilder

### Description
Creates a Kernel Provider. You can pass either a KernelProvider you have created yourself, or one of the standard providers from `crate::provider::kernel_providers`.
```

--------------------------------

### ALPC_PROVIDER Definition

Source: https://docs.rs/ferrisetw/latest/ferrisetw/provider/kernel_providers/static.ALPC_PROVIDER.html

The static definition of the ALPC_PROVIDER kernel provider.

```rust
pub static ALPC_PROVIDER: KernelProvider
```

--------------------------------

### VIRTUAL_ALLOC_PROVIDER Definition

Source: https://docs.rs/ferrisetw/latest/ferrisetw/provider/kernel_providers/static.VIRTUAL_ALLOC_PROVIDER.html

The static definition of the VIRTUAL_ALLOC_PROVIDER constant.

```rust
pub static VIRTUAL_ALLOC_PROVIDER: KernelProvider
```

--------------------------------

### Access VAMAP_PROVIDER definition

Source: https://docs.rs/ferrisetw/latest/ferrisetw/provider/kernel_providers/static.VAMAP_PROVIDER.html

Displays the static definition of the VAMAP_PROVIDER constant.

```rust
pub static VAMAP_PROVIDER: KernelProvider
```

--------------------------------

### DISK_IO_PROVIDER Definition

Source: https://docs.rs/ferrisetw/latest/ferrisetw/provider/kernel_providers/static.DISK_IO_PROVIDER.html

The static definition of the DISK_IO_PROVIDER constant.

```rust
pub static DISK_IO_PROVIDER: KernelProvider
```

--------------------------------

### stop

Source: https://docs.rs/ferrisetw/latest/ferrisetw/trace/trait.TraceTrait.html

Stops the trace and consumes the instance.

```APIDOC
## fn stop(self) -> Result<(), TraceError>

### Description
Stops the trace. This consumes the trace instance, rendering it unusable afterwards.
```

--------------------------------

### Accessing FILE_IO_PROVIDER

Source: https://docs.rs/ferrisetw/latest/ferrisetw/provider/kernel_providers/static.FILE_IO_PROVIDER.html

Displays the static definition of the FILE_IO_PROVIDER constant.

```rust
pub static FILE_IO_PROVIDER: KernelProvider
```

--------------------------------

### Access PROCESS_COUNTER_PROVIDER definition

Source: https://docs.rs/ferrisetw/latest/ferrisetw/provider/kernel_providers/static.PROCESS_COUNTER_PROVIDER.html

Displays the static definition of the PROCESS_COUNTER_PROVIDER constant.

```rust
pub static PROCESS_COUNTER_PROVIDER: KernelProvider
```

--------------------------------

### DPC_PROVIDER Definition

Source: https://docs.rs/ferrisetw/latest/ferrisetw/provider/kernel_providers/static.DPC_PROVIDER.html

The static definition of the DPC Kernel Provider.

```rust
pub static DPC_PROVIDER: KernelProvider
```

--------------------------------

### Provider::by_name

Source: https://docs.rs/ferrisetw/latest/ferrisetw/provider/struct.Provider.html

Creates a Provider builder defined by its name.

```APIDOC
## pub fn by_name(name: &str) -> Result<ProviderBuilder, PlaError>

### Description
Create a Provider defined by its name. This function looks for the Provider GUID using the ITraceDataProviderCollection interface.

### Remark
This function is considerably slow; prefer using the `by_guid` function when possible.
```

--------------------------------

### as_unix_timestamp

Source: https://docs.rs/ferrisetw/latest/ferrisetw/native/time/struct.SystemTime.html

Converts the SystemTime instance to a unix timestamp with millisecond granularity.

```APIDOC
## pub fn as_unix_timestamp(&self) -> i64

### Description
Converts the SystemTime instance to a unix timestamp with millisecond granularity.

### Returns
- **i64** - The unix timestamp in milliseconds.
```

--------------------------------

### TraceBuilder::set_etl_dump_file

Source: https://docs.rs/ferrisetw/latest/ferrisetw/trace/struct.TraceBuilder.html

Configures the trace to dump events to a file on disk, typically with a .etl extension.

```APIDOC
## pub fn set_etl_dump_file(self, params: DumpFileParams) -> Self

### Description
Defines a dump file for the events. Events will be written to disk and processed by registered callbacks.

### Parameters
- **params** (DumpFileParams) - Required - Configuration parameters for the dump file.
```

--------------------------------

### as_unix_timestamp_nanos

Source: https://docs.rs/ferrisetw/latest/ferrisetw/native/time/struct.SystemTime.html

Converts the SystemTime instance to a unix timestamp with nanosecond granularity.

```APIDOC
## pub fn as_unix_timestamp_nanos(&self) -> i128

### Description
Converts the SystemTime instance to a unix timestamp with nanosecond granularity.

### Returns
- **i128** - The unix timestamp in nanoseconds.
```

--------------------------------

### SPLIT_IO_PROVIDER Definition

Source: https://docs.rs/ferrisetw/latest/ferrisetw/provider/kernel_providers/static.SPLIT_IO_PROVIDER.html

The static definition of the SPLIT_IO_PROVIDER constant.

```rust
pub static SPLIT_IO_PROVIDER: KernelProvider
```

--------------------------------

### Access CONTEXT_SWITCH_PROVIDER

Source: https://docs.rs/ferrisetw/latest/ferrisetw/provider/kernel_providers/static.CONTEXT_SWITCH_PROVIDER.html

Represents the static KernelProvider instance for context switching.

```rust
pub static CONTEXT_SWITCH_PROVIDER: KernelProvider
```

--------------------------------

### as_unix_timestamp_nanos

Source: https://docs.rs/ferrisetw/latest/ferrisetw/native/time/struct.FileTime.html

Converts the FileTime instance to a Unix timestamp with nanosecond granularity.

```APIDOC
## pub fn as_unix_timestamp_nanos(&self) -> i128

### Description
Converts the FileTime structure to a Unix timestamp represented as an i128, with nanosecond granularity.

### Returns
- **i128** - The Unix timestamp in nanoseconds.
```

--------------------------------

### Retrieve Opcode Name from Schema

Source: https://docs.rs/ferrisetw/latest/ferrisetw/schema/struct.Schema.html

Obtain the Opcode name from the TRACE_EVENT_INFO.

```rust
let my_callback = |record: &EventRecord, schema_locator: &SchemaLocator| {
    let schema = schema_locator.event_schema(record).unwrap();
    let opcode_name = schema.opcode_name();
};
```

--------------------------------

### Add a callback function to the Provider

Source: https://docs.rs/ferrisetw/latest/ferrisetw/provider/struct.ProviderBuilder.html

Registers a closure to handle events. Note that the callback executes on a background thread blocked on the process function.

```rust
let provider = Provider::by_guid("1EDEEE53-0AFE-4609-B846-D8C0B2075B1F").add_callback(|record: &EventRecord, schema_locator: &SchemaLocator| {
    // Handle Event
}).build();
UserTrace::new().enable(provider).start().unwrap();
```

--------------------------------

### Retrieve Provider Name from Schema

Source: https://docs.rs/ferrisetw/latest/ferrisetw/schema/struct.Schema.html

Obtain the Provider name from the TRACE_EVENT_INFO.

```rust
let my_callback = |record: &EventRecord, schema_locator: &SchemaLocator| {
    let schema = schema_locator.event_schema(record).unwrap();
    let provider_name = schema.provider_name();
};
```

--------------------------------

### process_from_handle

Source: https://docs.rs/ferrisetw/latest/ferrisetw/trace/trait.TraceTrait.html

Processes a trace directly using its TraceHandle.

```APIDOC
## fn process_from_handle(handle: TraceHandle) -> Result<(), TraceError>

### Description
Processes a trace given its specific TraceHandle.
```

--------------------------------

### as_unix_timestamp

Source: https://docs.rs/ferrisetw/latest/ferrisetw/native/time/struct.FileTime.html

Converts the FileTime instance to a Unix timestamp with millisecond granularity.

```APIDOC
## pub fn as_unix_timestamp(&self) -> i64

### Description
Converts the FileTime structure to a Unix timestamp represented as an i64, with millisecond granularity.

### Returns
- **i64** - The Unix timestamp in milliseconds.
```

--------------------------------

### SessionlessInfo Definition

Source: https://docs.rs/ferrisetw/latest/ferrisetw/query/struct.SessionlessInfo.html

The definition of the SessionlessInfo struct.

```rust
pub struct SessionlessInfo;
```

--------------------------------

### Set the trace_flags flag in the Provider instance

Source: https://docs.rs/ferrisetw/latest/ferrisetw/provider/struct.ProviderBuilder.html

Configures specific trace properties for the provider.

```rust
let my_provider = Provider::by_guid("1EDEEE53-0AFE-4609-B846-D8C0B2075B1F").trace_flags(TraceFlags::EVENT_ENABLE_PROPERTY_SID).build();
```

--------------------------------

### Accessing DEBUG_PRINT_PROVIDER

Source: https://docs.rs/ferrisetw/latest/ferrisetw/provider/kernel_providers/static.DEBUG_PRINT_PROVIDER.html

Displays the static definition of the Dbg Print Kernel Provider.

```rust
pub static DEBUG_PRINT_PROVIDER: KernelProvider
```

--------------------------------

### Add filters to the Provider

Source: https://docs.rs/ferrisetw/latest/ferrisetw/provider/struct.ProviderBuilder.html

Applies event filters to the provider. Multiple filters are combined with an AND relationship.

```rust
let only_events_18_or_42 = EventFilter::ByEventIds(vec![18, 42]);
let only_pid_1234 = EventFilter::ByPids(vec![1234]);

Provider::by_guid("22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716")
    .add_filter(only_events_18_or_42)
    .add_filter(only_pid_1234)
    .build();
```

--------------------------------

### Define DumpFileParams struct

Source: https://docs.rs/ferrisetw/latest/ferrisetw/trace/struct.DumpFileParams.html

The structure definition for configuring ETL dump file parameters.

```rust
pub struct DumpFileParams {
    pub file_path: PathBuf,
    pub file_logging_mode: DumpFileLoggingMode,
    pub max_size: Option<u32>,
}
```

--------------------------------

### TraceBuilder::set_trace_properties

Source: https://docs.rs/ferrisetw/latest/ferrisetw/trace/struct.TraceBuilder.html

Configures low-level properties of the trace session, mapping to EVENT_TRACE_PROPERTIES.

```APIDOC
## pub fn set_trace_properties(self, props: TraceProperties) -> Self

### Description
Defines several low-level properties of the trace at once.

### Parameters
- **props** (TraceProperties) - Required - The properties configuration object.
```

--------------------------------

### Accessing SYSTEM_CALL_PROVIDER

Source: https://docs.rs/ferrisetw/latest/ferrisetw/provider/kernel_providers/static.SYSTEM_CALL_PROVIDER.html

Represents the SystemCall Kernel Provider.

```rust
pub static SYSTEM_CALL_PROVIDER: KernelProvider
```

--------------------------------

### Access DISK_FILE_IO_PROVIDER

Source: https://docs.rs/ferrisetw/latest/ferrisetw/provider/kernel_providers/static.DISK_FILE_IO_PROVIDER.html

The static constant representing the Disk File IO Kernel Provider.

```rust
pub static DISK_FILE_IO_PROVIDER: KernelProvider
```

--------------------------------

### Accessing TCP_IP_PROVIDER

Source: https://docs.rs/ferrisetw/latest/ferrisetw/provider/kernel_providers/static.TCP_IP_PROVIDER.html

The static instance representing the TCP-IP Kernel Provider.

```rust
pub static TCP_IP_PROVIDER: KernelProvider
```

--------------------------------

### TraceBuilder::named

Source: https://docs.rs/ferrisetw/latest/ferrisetw/trace/struct.TraceBuilder.html

Sets the name of the trace session. Note that for kernel traces on Windows versions older than Windows 8, this name is ignored and defaults to 'NT Kernel Logger'.

```APIDOC
## pub fn named(self, name: String) -> Self

### Description
Defines the trace name for the session.

### Parameters
- **name** (String) - Required - The name to assign to the trace session.
```

--------------------------------

### Re-exporting SchemaLocator

Source: https://docs.rs/ferrisetw/latest/ferrisetw/index.html

Exposes the SchemaLocator type from the schema_locator module.

```rust
pub use crate::schema_locator::SchemaLocator;
```

--------------------------------

### Define TraceProperties struct

Source: https://docs.rs/ferrisetw/latest/ferrisetw/trace/struct.TraceProperties.html

The structure definition for TraceProperties, representing configuration settings for an EVENT_TRACE_PROPERTIES object.

```rust
pub struct TraceProperties {
    pub buffer_size: u32,
    pub min_buffer: u32,
    pub max_buffer: u32,
    pub flush_timer: Duration,
    pub log_file_mode: LoggingMode,
}
```

--------------------------------

### Set the level flag in the Provider instance

Source: https://docs.rs/ferrisetw/latest/ferrisetw/provider/struct.ProviderBuilder.html

Sets the logging level for the provider, such as Verbose or Error.

```rust
// LogAlways (0x0)
// Critical (0x1)
// Error (0x2)
// Warning (0x3)
// Information (0x4)
// Verbose (0x5)
let my_provider = Provider::by_guid("1EDEEE53-0AFE-4609-B846-D8C0B2075B1F").level(0x5).build();
```

--------------------------------

### trace_handle

Source: https://docs.rs/ferrisetw/latest/ferrisetw/trace/trait.TraceTrait.html

Retrieves the TraceHandle associated with the current trace instance.

```APIDOC
## fn trace_handle(&self) -> TraceHandle

### Description
Returns the handle for the current trace instance.
```

--------------------------------

### TraceBuilder Definition

Source: https://docs.rs/ferrisetw/latest/ferrisetw/trace/struct.TraceBuilder.html

The internal structure definition for TraceBuilder.

```rust
pub struct TraceBuilder<T: RealTimeTraceTrait> { /* private fields */ }
```

--------------------------------

### Accessing IMAGE_LOAD_PROVIDER

Source: https://docs.rs/ferrisetw/latest/ferrisetw/provider/kernel_providers/static.IMAGE_LOAD_PROVIDER.html

The static definition of the IMAGE_LOAD_PROVIDER constant.

```rust
pub static IMAGE_LOAD_PROVIDER: KernelProvider
```

--------------------------------

### Define EventRecord Structure

Source: https://docs.rs/ferrisetw/latest/ferrisetw/struct.EventRecord.html

The internal structure definition for EventRecord.

```rust
pub struct EventRecord(/* private fields */);
```

--------------------------------

### FileTrace Structure Definition

Source: https://docs.rs/ferrisetw/latest/ferrisetw/trace/struct.FileTrace.html

The internal structure definition for FileTrace.

```rust
pub struct FileTrace { /* private fields */ }
```

--------------------------------

### Retrieve Task Name from Schema

Source: https://docs.rs/ferrisetw/latest/ferrisetw/schema/struct.Schema.html

Obtain the Task name from the TRACE_EVENT_INFO.

```rust
let my_callback = |record: &EventRecord, schema_locator: &SchemaLocator| {
    let schema = schema_locator.event_schema(record).unwrap();
    let task_name = schema.task_name();
};
```

--------------------------------

### Define EVENT_EXTENDED_ITEM_STACK_TRACE32 Struct

Source: https://docs.rs/ferrisetw/latest/ferrisetw/native/struct.EVENT_EXTENDED_ITEM_STACK_TRACE32.html

The structure definition for EVENT_EXTENDED_ITEM_STACK_TRACE32, marked with repr(C) for FFI compatibility.

```rust
#[repr(C)]
pub struct EVENT_EXTENDED_ITEM_STACK_TRACE32 {
    pub MatchId: u64,
    pub Address: [u32; 1],
}
```

--------------------------------

### SessionlessInfo::sample_interval

Source: https://docs.rs/ferrisetw/latest/ferrisetw/query/struct.SessionlessInfo.html

Retrieves the sample interval for a given profile source.

```APIDOC
## pub fn sample_interval(source: ProfileSource) -> Result<u32, TraceError>

### Description
Retrieves the sample interval for the specified profile source.

### Parameters
- **source** (ProfileSource) - Required - The source of the profile to query.

### Returns
- **Result<u32, TraceError>** - Returns the sample interval as a u32 on success, or a TraceError if the operation fails.
```

--------------------------------

### Accessing the INTERRUPT_PROVIDER

Source: https://docs.rs/ferrisetw/latest/ferrisetw/provider/kernel_providers/static.INTERRUPT_PROVIDER.html

The static definition of the Interrupt Kernel Provider.

```rust
pub static INTERRUPT_PROVIDER: KernelProvider
```

--------------------------------

### EVENT_EXTENDED_ITEM_INSTANCE Struct Definition

Source: https://docs.rs/ferrisetw/latest/ferrisetw/native/struct.EVENT_EXTENDED_ITEM_INSTANCE.html

The structure definition for EVENT_EXTENDED_ITEM_INSTANCE with its memory layout specified as C-compatible.

```rust
#[repr(C)]
pub struct EVENT_EXTENDED_ITEM_INSTANCE {
    pub InstanceId: u32,
    pub ParentInstanceId: u32,
    pub ParentGuid: GUID,
}
```

--------------------------------

### Accessing the PROCESS_PROVIDER

Source: https://docs.rs/ferrisetw/latest/ferrisetw/provider/kernel_providers/static.PROCESS_PROVIDER.html

The PROCESS_PROVIDER is a static instance of KernelProvider used for process-related kernel events.

```rust
pub static PROCESS_PROVIDER: KernelProvider
```

--------------------------------

### Accessing the REGISTRY_PROVIDER constant

Source: https://docs.rs/ferrisetw/latest/ferrisetw/provider/kernel_providers/static.REGISTRY_PROVIDER.html

The REGISTRY_PROVIDER is a static KernelProvider instance used for registry-related kernel operations.

```rust
pub static REGISTRY_PROVIDER: KernelProvider
```

--------------------------------

### Retrieve DecodingSource from Schema

Source: https://docs.rs/ferrisetw/latest/ferrisetw/schema/struct.Schema.html

Obtain the DecodingSource from the event, which identifies the source used to parse the event data.

```rust
let my_callback = |record: &EventRecord, schema_locator: &SchemaLocator| {
    let schema = schema_locator.event_schema(record).unwrap();
    let decoding_source = schema.decoding_source();
};
```

--------------------------------

### Access MEMORY_HARD_FAULT_PROVIDER

Source: https://docs.rs/ferrisetw/latest/ferrisetw/provider/kernel_providers/static.MEMORY_HARD_FAULT_PROVIDER.html

Displays the static definition of the Memory Hard Fault Kernel Provider.

```rust
pub static MEMORY_HARD_FAULT_PROVIDER: KernelProvider
```

--------------------------------

### Accessing the PROFILE_PROVIDER constant

Source: https://docs.rs/ferrisetw/latest/ferrisetw/provider/kernel_providers/static.PROFILE_PROVIDER.html

The PROFILE_PROVIDER is a static instance of KernelProvider used for profile-related kernel operations.

```rust
pub static PROFILE_PROVIDER: KernelProvider
```

--------------------------------

### Pointer struct definition

Source: https://docs.rs/ferrisetw/latest/ferrisetw/parser/struct.Pointer.html

The basic definition of the Pointer struct.

```rust
pub struct Pointer(/* private fields */);
```

--------------------------------

### Accessing MEMORY_PAGE_FAULT_PROVIDER

Source: https://docs.rs/ferrisetw/latest/ferrisetw/provider/kernel_providers/static.MEMORY_PAGE_FAULT_PROVIDER.html

Defines the static constant for the Memory Page Fault Kernel Provider.

```rust
pub static MEMORY_PAGE_FAULT_PROVIDER: KernelProvider
```

--------------------------------

### UserTrace Struct Definition

Source: https://docs.rs/ferrisetw/latest/ferrisetw/trace/struct.UserTrace.html

The internal structure definition for UserTrace.

```rust
pub struct UserTrace { /* private fields */ }
```

--------------------------------

### Re-exporting FileTrace

Source: https://docs.rs/ferrisetw/latest/ferrisetw/index.html

Exposes the FileTrace type from the trace module.

```rust
pub use crate::trace::FileTrace;
```

--------------------------------

### DumpFileLoggingMode struct definition

Source: https://docs.rs/ferrisetw/latest/ferrisetw/trace/struct.DumpFileLoggingMode.html

The internal structure definition for DumpFileLoggingMode.

```rust
pub struct DumpFileLoggingMode { /* private fields */ }
```

--------------------------------

### Parser::try_parse

Source: https://docs.rs/ferrisetw/latest/ferrisetw/parser/struct.Parser.html

Attempts to parse a property from the event record into a specified type.

```APIDOC
## fn try_parse<T>(&self, name: &str) -> Result<T, ParserError>

### Description
Retrieves a property by name from the event record and attempts to convert it into the requested type T.

### Parameters
- **name** (&str) - The name of the property to extract.

### Returns
- **Result<T, ParserError>** - Returns the parsed value if successful, or a ParserError (e.g., InvalidType) if parsing fails.
```

--------------------------------

### Define EVENT_EXTENDED_ITEM_STACK_TRACE64 Struct

Source: https://docs.rs/ferrisetw/latest/ferrisetw/native/struct.EVENT_EXTENDED_ITEM_STACK_TRACE64.html

The struct is defined with a C-compatible representation, containing a match ID and a stack trace address array.

```rust
#[repr(C)]
pub struct EVENT_EXTENDED_ITEM_STACK_TRACE64 {
    pub MatchId: u64,
    pub Address: [u64; 1],
}
```

--------------------------------

### Re-exporting UserTrace

Source: https://docs.rs/ferrisetw/latest/ferrisetw/index.html

Exposes the UserTrace type from the trace module.

```rust
pub use crate::trace::UserTrace;
```

--------------------------------

### Re-exporting KernelTrace

Source: https://docs.rs/ferrisetw/latest/ferrisetw/index.html

Exposes the KernelTrace type from the trace module.

```rust
pub use crate::trace::KernelTrace;
```

--------------------------------

### Retrieve an ETW event schema

Source: https://docs.rs/ferrisetw/latest/ferrisetw/schema_locator/struct.SchemaLocator.html

Use the event_schema method within a callback to resolve the schema for a given EventRecord.

```rust
let my_callback = |record: &EventRecord, schema_locator: &SchemaLocator| {
    let schema = schema_locator.event_schema(record).unwrap();
};
```

--------------------------------

### KernelTrace struct definition

Source: https://docs.rs/ferrisetw/latest/ferrisetw/trace/struct.KernelTrace.html

The internal structure definition for KernelTrace.

```rust
pub struct KernelTrace { /* private fields */ }
```

--------------------------------

### FileTrace::stop

Source: https://docs.rs/ferrisetw/latest/ferrisetw/trace/struct.FileTrace.html

Stops the active trace session.

```APIDOC
## pub fn stop(self) -> Result<(), TraceError>

### Description
Stops the trace session.
```

--------------------------------

### Access THREAD_DISPATCHER_PROVIDER

Source: https://docs.rs/ferrisetw/latest/ferrisetw/provider/kernel_providers/static.THREAD_DISPATCHER_PROVIDER.html

Represents the Thread Dispatcher Kernel Provider.

```rust
pub static THREAD_DISPATCHER_PROVIDER: KernelProvider
```

--------------------------------

### Accessing THREAD_PROVIDER

Source: https://docs.rs/ferrisetw/latest/ferrisetw/provider/kernel_providers/static.THREAD_PROVIDER.html

The THREAD_PROVIDER is a static instance of KernelProvider used for thread-related kernel operations.

```rust
pub static THREAD_PROVIDER: KernelProvider
```

--------------------------------

### SessionlessInfo::max_pmc

Source: https://docs.rs/ferrisetw/latest/ferrisetw/query/struct.SessionlessInfo.html

Retrieves the maximum number of performance monitoring counters (PMC).

```APIDOC
## pub fn max_pmc() -> Result<u32, TraceError>

### Description
Retrieves the maximum number of performance monitoring counters available.

### Returns
- **Result<u32, TraceError>** - Returns the maximum PMC count as a u32 on success, or a TraceError if the operation fails.
```

--------------------------------

### UserTrace::stop

Source: https://docs.rs/ferrisetw/latest/ferrisetw/trace/struct.UserTrace.html

Stops the active trace session.

```APIDOC
## pub fn stop(self) -> Result<(), TraceError>

### Description
Stops the trace session. This consumes the UserTrace instance, meaning it cannot be used after this call. Dropping the instance achieves the same result.

### Returns
- **Result<(), TraceError>** - Returns Ok(()) on success, or a TraceError if the operation fails.
```

--------------------------------

### events_handled

Source: https://docs.rs/ferrisetw/latest/ferrisetw/trace/trait.TraceTrait.html

Returns the number of events that have been processed by the trace.

```APIDOC
## fn events_handled(&self) -> usize

### Description
Returns the count of events handled by the trace instance.
```

--------------------------------

### SID Struct Definition

Source: https://docs.rs/ferrisetw/latest/ferrisetw/struct.SID.html

The definition of the SID struct, which is re-exported from windows-rs.

```rust
#[repr(C)]
pub struct SID {
    pub Revision: u8,
    pub SubAuthorityCount: u8,
    pub IdentifierAuthority: SID_IDENTIFIER_AUTHORITY,
    pub SubAuthority: [u32; 1],
}
```

--------------------------------

### LoggingMode Struct Definition

Source: https://docs.rs/ferrisetw/latest/ferrisetw/trace/struct.LoggingMode.html

The definition of the LoggingMode struct, which contains private fields.

```rust
pub struct LoggingMode { /* private fields */ }
```

--------------------------------

### TraceTrait Definition

Source: https://docs.rs/ferrisetw/latest/ferrisetw/trace/trait.TraceTrait.html

The core trait definition for trace management, requiring implementation of handle retrieval and event counting.

```rust
pub trait TraceTrait: PrivateTraceTrait + Sized {
    // Required methods
    fn trace_handle(&self) -> TraceHandle;
    fn events_handled(&self) -> usize;

    // Provided methods
    fn process(&mut self) -> Result<(), TraceError> { ... }
    fn process_from_handle(handle: TraceHandle) -> Result<(), TraceError> { ... }
    fn stop(self) -> Result<(), TraceError> { ... }
}
```

--------------------------------

### KernelTrace::stop

Source: https://docs.rs/ferrisetw/latest/ferrisetw/trace/struct.KernelTrace.html

Stops an active KernelTrace session.

```APIDOC
## pub fn stop(self) -> Result<(), TraceError>

### Description
Stops the current trace session. This method consumes the `KernelTrace` instance, meaning it cannot be used further after calling this method. Dropping the instance achieves the same result.

### Returns
- **Result<(), TraceError>** - Returns `Ok(())` on success, or a `TraceError` if the operation fails.
```

--------------------------------

### DecodingSource Enum Definition

Source: https://docs.rs/ferrisetw/latest/ferrisetw/native/enum.DecodingSource.html

The definition of the DecodingSource enum showing its available variants.

```rust
pub enum DecodingSource {
    DecodingSourceXMLFile,
    DecodingSourceWbem,
    DecodingSourceWPP,
    DecodingSourceTlg,
    DecodingSourceMax,
}
```

--------------------------------

### Define ProfileSource Enum

Source: https://docs.rs/ferrisetw/latest/ferrisetw/query/enum.ProfileSource.html

The ProfileSource enum is represented as a u32 and currently supports the ProfileTime variant.

```rust
#[repr(u32)]
pub enum ProfileSource {
    ProfileTime = 0,
}
```

--------------------------------

### ExtendedDataItem Enum Definition

Source: https://docs.rs/ferrisetw/latest/ferrisetw/native/enum.ExtendedDataItem.html

The structure of the ExtendedDataItem enum, which maps to various Windows event extended data types.

```rust
pub enum ExtendedDataItem {
    Unsupported,
    RelatedActivityId(GUID),
    Sid(SID),
    TsId(u32),
    InstanceInfo(EVENT_EXTENDED_ITEM_INSTANCE),
    StackTrace32(StackTraceItem<u32>),
    StackTrace64(StackTraceItem<u64>),
    TraceLogging(String),
    EventKey(u64),
    ProcessStartKey(u64),
}
```

--------------------------------

### SchemaLocator::event_schema

Source: https://docs.rs/ferrisetw/latest/ferrisetw/schema_locator/struct.SchemaLocator.html

Retrieves the schema for a given ETW event record. This method is used to look up the schema from the internal cache based on the event's provider, descriptor, and version information.

```APIDOC
## pub fn event_schema(&self, event: &EventRecord) -> Result<Arc<Schema>, SchemaError>

### Description
Retrieves the Schema of an ETW Event. This method looks up the schema associated with the provided event record.

### Parameters
- **event** (&EventRecord) - Required - The EventRecord that is passed to the callback.

### Returns
- **Result<Arc<Schema>, SchemaError>** - Returns the schema wrapped in an Arc on success, or a SchemaError if the schema cannot be located.
```

--------------------------------

### Accessing the DRIVER_PROVIDER constant

Source: https://docs.rs/ferrisetw/latest/ferrisetw/provider/kernel_providers/static.DRIVER_PROVIDER.html

The DRIVER_PROVIDER constant is a static instance of KernelProvider representing the Driver Kernel Provider.

```rust
pub static DRIVER_PROVIDER: KernelProvider
```

--------------------------------

### TraceHandle Struct Representation

Source: https://docs.rs/ferrisetw/latest/ferrisetw/native/type.TraceHandle.html

The underlying structure definition for the TraceHandle type.

```rust
#[repr(C)]
pub struct TraceHandle {
    pub Value: u64,
}
```

--------------------------------

### trace::stop_trace_by_name

Source: https://docs.rs/ferrisetw/latest/ferrisetw/all.html

Stops an ETW trace session by its specified name.

```APIDOC
## Function: trace::stop_trace_by_name

### Description
Stops an active ETW trace session identified by the provided name.

### Signature
`pub fn stop_trace_by_name(name: &str) -> Result<(), TraceError>`
```

--------------------------------

### Define SddlNativeError Enum

Source: https://docs.rs/ferrisetw/latest/ferrisetw/native/enum.SddlNativeError.html

The structure of the SddlNativeError enum, containing variants for UTF-8 parsing errors and standard IO errors.

```rust
pub enum SddlNativeError {
    SidParseError(Utf8Error),
    IoError(Error),
}
```

--------------------------------

### ControlHandle Struct Representation

Source: https://docs.rs/ferrisetw/latest/ferrisetw/native/type.ControlHandle.html

The underlying structure definition for the ControlHandle type.

```rust
#[repr(C)]
pub struct ControlHandle {
    pub Value: u64,
}
```

--------------------------------

### stop_trace_by_name function signature

Source: https://docs.rs/ferrisetw/latest/ferrisetw/trace/fn.stop_trace_by_name.html

The function signature for stopping a trace by name, returning a Result indicating success or a TraceError.

```rust
pub fn stop_trace_by_name(trace_name: &str) -> Result<(), TraceError>
```

--------------------------------

### TraceHandle Type Alias Definition

Source: https://docs.rs/ferrisetw/latest/ferrisetw/native/type.TraceHandle.html

The primary type alias definition for TraceHandle.

```rust
pub type TraceHandle = PROCESSTRACE_HANDLE;
```

--------------------------------

### EvntraceNativeError Enum Definition

Source: https://docs.rs/ferrisetw/latest/ferrisetw/native/enum.EvntraceNativeError.html

The structure of the EvntraceNativeError enum, containing variants for handle, existence, and IO-related errors.

```rust
pub enum EvntraceNativeError {
    InvalidHandle,
    AlreadyExist,
    IoError(Error),
}
```

--------------------------------

### Define ParserError Enum

Source: https://docs.rs/ferrisetw/latest/ferrisetw/parser/enum.ParserError.html

The structure of the ParserError enum, listing all possible error variants for the parser module.

```rust
pub enum ParserError {
    NotFound,
    InvalidType,
    ParseError,
    LengthMismatch,
    PropertyError(String),
    Utf8Error(Utf8Error),
    SliceError(TryFromSliceError),
    SddlNativeError(SddlNativeError),
    TdhNativeError(TdhNativeError),
}
```

--------------------------------

### ControlHandle Type Alias Definition

Source: https://docs.rs/ferrisetw/latest/ferrisetw/native/type.ControlHandle.html

The primary type alias definition for ControlHandle.

```rust
pub type ControlHandle = CONTROLTRACE_HANDLE;
```

--------------------------------

### Define EventFilter Enum

Source: https://docs.rs/ferrisetw/latest/ferrisetw/provider/enum.EventFilter.html

The structure of the EventFilter enum, supporting filtering by PIDs or Event IDs.

```rust
pub enum EventFilter {
    ByPids(Vec<u16>),
    ByEventIds(Vec<u16>),
}
```

--------------------------------

### ProviderError Enum Definition

Source: https://docs.rs/ferrisetw/latest/ferrisetw/provider/enum.ProviderError.html

The definition of the ProviderError enum, which currently contains a single variant for wrapping PlaError.

```rust
pub enum ProviderError {
    ComProvider(PlaError),
}
```

--------------------------------

### TraceError Enum Definition

Source: https://docs.rs/ferrisetw/latest/ferrisetw/trace/enum.TraceError.html

The definition of the TraceError enum, including variants for invalid trace names and native ETW error wrapping.

```rust
pub enum TraceError {
    InvalidTraceName,
    EtwNativeError(EvntraceNativeError),
}
```

--------------------------------

### Define PlaError Enum

Source: https://docs.rs/ferrisetw/latest/ferrisetw/native/enum.PlaError.html

The structure of the PlaError enum, which includes variants for missing providers and COM errors.

```rust
pub enum PlaError {
    NotFound,
    ComError(Error),
}
```

--------------------------------

### Define SchemaError Enum

Source: https://docs.rs/ferrisetw/latest/ferrisetw/schema_locator/enum.SchemaError.html

The structure of the SchemaError enum, which currently contains a single variant for TdhNativeError.

```rust
pub enum SchemaError {
    TdhNativeError(TdhNativeError),
}
```

--------------------------------

### Define TdhNativeError Enum

Source: https://docs.rs/ferrisetw/latest/ferrisetw/native/enum.TdhNativeError.html

The structure of the TdhNativeError enum, which includes variants for allocation and IO errors.

```rust
pub enum TdhNativeError {
    AllocationError,
    IoError(Error),
}
```
Tokens:
Raw