ferrisetw
ferrisetw copied to clipboard
Implement event filtering
Info ETW allows filters to be defined for a Provider in a session. MSDN - Defining Filters. KrabsETW already provides a mechanism to do filtering either by events_id or by using more complicated predicates
- https://github.com/microsoft/krabsetw/tree/master/krabs/krabs/filtering
TODO
- [ ] Research best way to introduce filters into Ferris
- [x] Implement a basic filtering based on events_id
- [ ] Research and implement a filtering based on more complex predicates
We're now able to filter by Event ID.
Predicates are left TODO