microsoft / microsoft/krabsetw
Question: possible inconsistency between schema, schema_key and the MS doc
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 801
- Forks
- 167
- Avg merge
- 3d 15m
- Merged PRs (30d)
- 2
Description
Hello. Reading at the Microsoft documentation, krabsetw (and its Rust-counterpart ferrisetw), I am puzzled about how to distinguish different schemas.
The doc says (emphasis mine):
For manifest-based ETW, the combination Provider.DecodeGuid + Event.Id + Event.Version should uniquely identify an event, i.e. all events with the same DecodeGuid, Id, and Version should have the same set of fields with no changes in field names, field types, or field ordering.
AFAICT, this would mean that a schema_key would only need to contain these 3 fields.
However, struct schema_key also contains opcode and level. Is there a reason for it?
Is it to support "non-manifest-based ETW"?
Besides, schema_key::operator== consistently compares these 5 fields. But schema::operator== only compares the 3 fields described in the documentation.
I am not knowledgeable enough in ETW to tell whether this is an inconsistency, or whether that's fine.
Do you have any ideas on this matter?
(Note: I saw this potential inconsistency in ferrisetw, then I saw that it mirrored what you've written here, so I'm asking at the source of truth 😄 I hope I'll find my answers here)
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Compare schema_key in krabs/schema_locator.hpp with schema::operator== in krabs/schema.hpp, then consult the linked Microsoft Event Descriptor documentation. Determine whether opcode and level belong in schema identity and whether the differing comparisons represent a defect; done means documenting the rationale or recording the required correction.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- operating-systems
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100