What makes ProcessTrace() function to exit without error?

NTDEV
1

Hi,

I’m using ProcessTrace() function to process real-time manifest-based ETW events on Windows 7/8 and seeing ProcessTrace() to return with ERROR_SUCCESS while the ETW session is still active. This is happening on few of my customer’s environment.

As far as I know, ProcessTrace() will not return until:

  1. All events between StartTime and EndTime are processed, or
  2. BufferCallback function returns FALSE, or
  3. The ETW session closes.

My code calls ProcessTrace() with StartTime = NULL and EndTime = NULL. So, they cannot be the reason for ProcessTrace() to exit. My code doesn’t have BufferCallback routine (EVENT_TRACE_LOGFILE.BufferCallback = NULL) either. And, neither my code or user (intentionally) stops the ETW session.

Is there any other reason for ProcessTrace() to exit?

Thanks,
Susumu