search

microsoft / krabsetw

KrabsETW provides a modern C++ wrapper and a .NET wrapper around the low-level ETW trace consumption functions.
Other
610 stars 149 forks source link

Question: can I use krabsetw for past events? #246

Open LucioDonda opened 1 month ago

LucioDonda commented 1 month ago

Hi everyone, sorry if this is not the rightplace where to write this: I'm using Krabsetw for monitoring the ETW events on Windows but I wanted to use some bookmarking to resume where I left before the app is terminated. Is that possible or Krabsetw only works with real-time events? AFAIK using EvtSubscribeStartAfterBookmark in the flags of eventSubscribe this was possible in the old winevt.h.

TIA, you've done a wonderful job here, congrats!

swannman commented 1 month ago

Good question! Krabsetw only supports real-time events, but some ETW providers can be subscribed to using the Event Log as described here. If the provider you're interested in is compatible with that approach, then you might be able to use a combination of direct ETW + EvtSubscribeStartAfterBookmark to backfill events that you missed?