A Way to do have a 'catch-all' callback function

[pathtofile]

Sometimes you can subscribe to a provider, but the events received are for a different GUID. For example if you subscribe to a Provider Group. This currently can be annoying to debug, as Krabs will just silently drop these events.

It would be very useful to have some sort of 'catch-all' callback for a session, to receive events that aren't handled by the specified Krabs::Providers. Otherwise, it would be very useful for Krabs to print/log that there are events from a particular Provider GUID that are being dropped.

Possible Options could be:

• Overload GUID_NULL Provider to mean 'match all events'
• Create and manage a callback in the Session object, that gets called if no providers handle the event
• Print/Log when an event is dropped as there is no corresponding GUID, with the Provider GUID so a user can re-run a session with that Provider enabled.

If this is already sort possibly great, I'd love to know how :-)

[jdu2600]

The EventTrace library has this feature - and it's very useful. :-)

Implementing a per-trace "catch all" callback is pretty straight forward - but I don't think it meets your entire requirement? i.e. it'll be called for all events, not just unhandled ones? Note - I already use GUID_NULL as a valid guid to match when handling WPP events...this is what TDH returns when a schema lookup fails. :-) See WppTrace001.cs I have a quick poc for this here - is this approach "good enough"?

The middle option is really the most useful - a callback to call only if no callbacks handle the event. However, I think this is an API breaking change. The callbacks are currently blindly called if the provider guid matches. They'll all need to return a (bool) indicator of whether they have handled the event or not.

[jdu2600]

Actually, I misread your options. A callback to call if no providers are registered for that guid is more straightforward. I've updated the poc.

(I was originally envisioning checking to see if any filters for a given provider matched etc).

[jdu2600]

Tidied it up and submitted a PR.

[pathtofile]

PR looks to provide what I was looking for (ha), lgtm

[swannman]

Resolved by #151. Thanks for submitting this @jdu2600!