microsoft / krabsetw

KrabsETW provides a modern C++ wrapper and a .NET wrapper around the low-level ETW trace consumption functions.
Other
588 stars 147 forks source link

Gracefully handle schema errors when applying filters #174

Closed swannman closed 3 years ago

swannman commented 3 years ago

A schema lookup occurs when a predicate filter is applied to a record. If the schema lookup fails, a krabs::could_not_find_schema exception is thrown. This exception was previously unhandled and caused an exception to propagate on the main trace thread.

A better way to handle this is by catching the schema exception and notifying the application via an OnError delegate. This existed on the Provider flow but not on EventFilter.

This change adds an OnError delegate to the C++/CLI EventFilter class, wires it up to a callback in event_filter, and adds an appropriate try/catch in event_filter::on_event to use the new callback.