Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
The CeLogData function that your DLL implements receives a data buffer that might not be a DWORD-aligned size. However, the log file format requires all events to begin on 4-byte, DWORD-sized boundaries. You might need to insert one or more bytes of padding between events to achieve 4-byte alignment.
The event header should still contain the unaligned size, but the next event header should begin on the next 4-byte boundary following the end of the event.
For example, if your CeLogData function is passed a wLen value of 6, then the CEL_HEADER that you write should contain a Length value of 6. After the header, write 8 bytes of data, because 8 is the next 4-byte boundary after 6.
Viewing tools such as Remote Kernel Tracker and Readlog.exe do not use the remaining 2 bytes of data. Those tools skip the pad bytes, and jump to the 4-byte boundary to read the next event.
See Also
Working with Data Alignment Issues | CeLog Buffering Scheme | Implementing an Event Tracking Library
Send Feedback on this topic to the authors