- 1 year ago
TdhGetEventInformation return 1168 (NOT FOUND) - How PerfView can get the info?
The TdhGetEventInformation
function is used to retrieve information about an event from an event trace log. If you are getting an error code 1168 (NOT FOUND) when calling TdhGetEventInformation
, it indicates that the event information for the specified event is not found.
PerfView, a performance analysis tool from Microsoft, has the ability to retrieve event information even if TdhGetEventInformation
returns a NOT FOUND error. PerfView achieves this by utilizing its own event metadata and mapping it to the event data.
PerfView captures and processes events independently from TdhGetEventInformation
. It has its own mechanism to collect event information, including parsing and interpreting event data, which allows it to provide detailed event information even if the native TdhGetEventInformation
function fails to do so.
PerfView uses its own event parsers and heuristics to decode event data and provide meaningful information. It leverages predefined knowledge of event structures and data formats for various event sources, allowing it to extract relevant information from the events.
It's important to note that PerfView's ability to retrieve event information even when TdhGetEventInformation
fails depends on its own event decoding capabilities and knowledge about specific event formats. It may not be able to provide detailed information for all event sources or scenarios.
If you are specifically interested in understanding how PerfView retrieves event information despite TdhGetEventInformation
returning a NOT FOUND error, you can refer to the PerfView source code or documentation for more insights into its event decoding mechanisms and event source support.