microsoft / microsoft/krabsetw

Question: possible inconsistency between schema, schema_key and the MS doc

Open
#195 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

question
Dominant language
C++
Stars
801
Forks
167
Avg merge
3d 15m
Merged PRs (30d)
2

Description

Hello. Reading at the Microsoft documentation, krabsetw (and its Rust-counterpart ferrisetw), I am puzzled about how to distinguish different schemas.

The doc says (emphasis mine):

For manifest-based ETW, the combination Provider.DecodeGuid + Event.Id + Event.Version should uniquely identify an event, i.e. all events with the same DecodeGuid, Id, and Version should have the same set of fields with no changes in field names, field types, or field ordering.

AFAICT, this would mean that a schema_key would only need to contain these 3 fields.
However, struct schema_key also contains opcode and level. Is there a reason for it?
Is it to support "non-manifest-based ETW"?

Besides, schema_key::operator== consistently compares these 5 fields. But schema::operator== only compares the 3 fields described in the documentation.
I am not knowledgeable enough in ETW to tell whether this is an inconsistency, or whether that's fine.

Do you have any ideas on this matter?

(Note: I saw this potential inconsistency in ferrisetw, then I saw that it mirrored what you've written here, so I'm asking at the source of truth 😄 I hope I'll find my answers here)

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Compare schema_key in krabs/schema_locator.hpp with schema::operator== in krabs/schema.hpp, then consult the linked Microsoft Event Descriptor documentation. Determine whether opcode and level belong in schema identity and whether the differing comparisons represent a defect; done means documenting the rationale or recording the required correction.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
operating-systems
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.