Access user data associated with event provided using TraceLoggingWrite - c++

Question

I am able to generate tracelogging events from my application(able to view them in Windows Performance Analyzer) using this method.
The event emitted is as follows
HRESULT CTracelogger::PublishEvent(void *pData)
{
if (pData)
{
EVENT_H sHEvent = *(static_cast<EVENT_H *>(pData));
TraceLoggingWrite(g_hEventProvider,
"HEvent",
TraceLoggingStruct(5, "HEventData"),
TraceLoggingUInt32(sHEvent.m_eEventType, "eEventType"),
TraceLoggingUInt32(sHEvent.m_uiVersion, "Version"),
TraceLoggingUInt32(sHEvent.m_uiPid, "Pid"),
TraceLoggingUInt32(sHEvent.m_uiSize, "Size"),
TraceLoggingWideString(sHEvent.m_wszHName, "HName")
);
}
return S_OK;
}
I am trying to consume the same events in a different application by writing a custom consumer, the consumer is receiving the events(as the corresponding provider GUID events are being received). I am trying to access the user data associated with the event using TdhGetProperty() as shown in documentation here but the function TdhGetEventInformation() is failing with ERROR_NOT_FOUND if the variable buffersize is initialized to 0 and fails with error ERROR_INVALID_PARAMETER if buffersize is initialized to a non-zero value.
Is the above approach taken correct to retrieve the data associated with the tracelogging event?
If yes, then why TdhGetEventInformation() is failing?
VOID WINAPI CEventLogger::EventRecordCallback(PEVENT_RECORD pEvent)
{
DWORD status = ERROR_SUCCESS;
PTRACE_EVENT_INFO pInfo = NULL;
char msgbuf[4096];
DWORD BufferSize = 0;
status = TdhGetEventInformation(pEvent, 0, nullptr, pInfo, &BufferSize);
if (ERROR_INSUFFICIENT_BUFFER == status)
{
pInfo = (TRACE_EVENT_INFO*)malloc(BufferSize);
if (pInfo == NULL)
{
OutputDebugString("Failed to allocate memory for event info");
status = ERROR_OUTOFMEMORY;
return;
}
else
{
OutputDebugString("successful memory allocation");
}
// Retrieve the event metadata.
status = TdhGetEventInformation(pEvent, 0, nullptr, pInfo, &BufferSize);
}
if (ERROR_SUCCESS != status)
{
sprintf_s(msgbuf, "TdhGetEventInformation failed status[%d], buffersize[%d]", status, BufferSize);
OutputDebugString(msgbuf);
}
else
{
sprintf_s(msgbuf, "TdhGetEventInformation successful, buffersize[%d]", BufferSize);
OutputDebugString(msgbuf);
}
}

Answer 1

The code above looks reasonable. My guess is that the problem is with your call to OpenTrace. By default (for backwards-compatibility with very old code), OpenTrace assumes that your callback wants to receive an EVENT_TRACE structure. However, your callback wants to receive an EVENT_RECORD. To tell OpenTrace to use the newer EVENT_RECORD format, you have to set ProcessTraceMode to PROCESS_TRACE_MODE_EVENT_RECORD.