/// <summary> /// Enable a provider. /// </summary> /// <param name="provider_id">The GUID of the provider.</param> /// <param name="level">The level for the events.</param> /// <param name="match_any_keyword">Any keywords to match.</param> /// <param name="match_all_keyword">All keywords to match.</param> /// <param name="timeout">The timeout.</param> /// <param name="descriptors">List of optional descriptors.</param> /// <param name="throw_on_error">True to throw on error.</param> /// <returns>The resulting status code.</returns> public NtStatus EnableProvider(Guid provider_id, EventTraceLevel level, ulong match_any_keyword, ulong match_all_keyword, int timeout, IEnumerable <EventFilterDescriptor> descriptors, bool throw_on_error) { var ds = descriptors.Select(d => new EVENT_FILTER_DESCRIPTOR() { Ptr = d.Ptr.ToInt64(), Size = d.Size, Type = d.Type }).ToArray(); using (var buffer = ds.ToBuffer()) { ENABLE_TRACE_PARAMETERS enable_trace = new ENABLE_TRACE_PARAMETERS { Version = 2, SourceId = SessionGuid, EnableFilterDesc = buffer.DangerousGetHandle(), FilterDescCount = ds.Length }; NtStatus status = Win32NativeMethods.EnableTraceEx2( _handle, ref provider_id, EventControlCode.EnableProvider, level, match_any_keyword, match_all_keyword, timeout, enable_trace ).MapDosErrorToStatus().ToNtException(throw_on_error); if (status.IsSuccess()) { _providers.Add(new EnabledProvider() { ProviderId = provider_id, Level = level }); } return(status); } }