从多个进程和同一进程内注册相同的 ETW TraceLogging Provider GUID

Question

来自TraceLogging 文档：

如果您尝试注册已注册的提供商，注册将会失败。

目前尚不清楚“provider”是指 GUID 还是由 表示的对象hProvider。任何人都可以确认从 1. 多个进程 2. 同一进程中的多个模块（DLL/EXE） 3. 同一模块内注册相同的 GUID 是否是有效的操作？

我已经尝试过 {1} 和 {2}，它们一直在工作 - 我可以从两个进程/模块获取事件。只需确保这是预期的行为。

Answer 1

我想说它指的是句柄对象本身。

The scope of a TraceLogging provider handle is strictly limited to the module (the DLL or EXE) in which it is defined. The provider handle from one module must not be shared with code in other modules. In other words, for any handle g_hProvider, all instances of TraceLoggingWrite(g_hProvider, ...) must reside in the same EXE or DLL as the TRACELOGGING_DEFINE_PROVIDER(g_hProvider, ...) definition. If this rule is not followed, the behavior of TraceLoggingWrite is unpredictable, especially regarding the way it handles event IDs (e.g. event ID collisions are likely).

中的一条评论TraceLoggingProvider.h