403Webshell
Server IP : 209.209.40.120  /  Your IP : 216.73.217.112
Web Server : Microsoft-IIS/10.0
System : Windows NT NEWWWW 10.0 build 17763 (Windows Server 2019) i586
User : NEWWWW$ ( 0)
PHP Version : 8.3.30
Disable Function : NONE
MySQL : OFF  |  cURL : ON  |  WGET : OFF  |  Perl : OFF  |  Python : OFF  |  Sudo : OFF  |  Pkexec : OFF
Directory :  /Program Files (x86)/Windows Kits/10/Include/10.0.19041.0/um/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]

 

Command :


[ Back ]     

Current File : /Program Files (x86)/Windows Kits/10/Include/10.0.19041.0/um/eventman.xsd
<xs:schema targetNamespace="http://schemas.microsoft.com/win/2004/08/events" elementFormDefault="qualified" xmlns:man="http://schemas.microsoft.com/win/2004/08/events" xmlns:xs="http://www.w3.org/2001/XMLSchema">
  <xs:simpleType name="GUIDType">
    <xs:annotation>
      <xs:documentation>
        A globally unique identifier in Registry format.
        e.g. {12345678-4321-ABCD-1234-9ABCDEF012345678}.
        Use GUIDGen.exe or UUIDGen.exe to create a GUID.
      </xs:documentation>
    </xs:annotation>
    <xs:restriction base="xs:string">
      <xs:pattern value="\{[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}\}"/>
    </xs:restriction>
  </xs:simpleType>
  <xs:simpleType name="CSymbolType">
    <xs:annotation>
      <xs:documentation>
        Symbol is used for code-generation. It should be a valid C Symbol or an empty string.
      </xs:documentation>
    </xs:annotation>
    <xs:restriction base="xs:string">
      <xs:pattern value="()|([_a-zA-Z][_0-9a-zA-Z]*)"/>
    </xs:restriction>
  </xs:simpleType>
  <xs:simpleType name="NamespaceType">
    <xs:annotation>
      <xs:documentation>
        Is used for code-generation on namespaces which should be valid C++ symbols.
        E.g. Namespace1._Namespace2.Namespace2
      </xs:documentation>
    </xs:annotation>
    <xs:restriction base="xs:string">
      <xs:pattern value="([_a-zA-Z][_0-9a-zA-Z]*\.)*[_a-zA-Z][_0-9a-zA-Z]*"/>
    </xs:restriction>
  </xs:simpleType>  
  <xs:simpleType name="HexInt8Type">
    <xs:annotation>
      <xs:documentation> Hex 1-2 digits in size</xs:documentation>
    </xs:annotation>
    <xs:restriction base="xs:string">
      <xs:pattern value="0[xX][0-9A-Fa-f]{1,2}"/>
    </xs:restriction>
  </xs:simpleType>
  <xs:simpleType name="HexInt16Type">
    <xs:annotation>
      <xs:documentation> Hex 1-4 digits in size</xs:documentation>
    </xs:annotation>
    <xs:restriction base="xs:string">
      <xs:pattern value="0[xX][0-9A-Fa-f]{1,4}"/>
    </xs:restriction>
  </xs:simpleType>
  <xs:simpleType name="HexInt32Type">
    <xs:annotation>
      <xs:documentation> Hex 1-8 digits in size</xs:documentation>
    </xs:annotation>
    <xs:restriction base="xs:string">
      <xs:pattern value="0[xX][0-9A-Fa-f]{1,8}"/>
    </xs:restriction>
  </xs:simpleType>
  <xs:simpleType name="HexInt64Type">
    <xs:annotation>
      <xs:documentation>Hex 1-16 digits in size.</xs:documentation>
    </xs:annotation>
    <xs:restriction base="xs:string">
      <xs:pattern value="0[xX][0-9A-Fa-f]{1,16}"/>
    </xs:restriction>
  </xs:simpleType>
  <xs:simpleType name="UInt8Type">
    <xs:annotation>
      <xs:documentation> Hex 1-2 digits in size or unsignedByte</xs:documentation>
    </xs:annotation>
    <xs:union memberTypes="xs:unsignedByte man:HexInt8Type"/>
  </xs:simpleType>
  <xs:simpleType name="UInt16Type">
    <xs:annotation>
      <xs:documentation> Hex 1-4 digits in size or unsignedShort</xs:documentation>
    </xs:annotation>
    <xs:union memberTypes="xs:unsignedShort man:HexInt16Type"/>
  </xs:simpleType>
  <xs:simpleType name="UInt32Type">
    <xs:annotation>
      <xs:documentation>UnsignedInt or Hex 1-8 digits in size.</xs:documentation>
    </xs:annotation>
    <xs:union memberTypes="xs:unsignedInt man:HexInt32Type"/>
  </xs:simpleType>
  <xs:simpleType name="UInt64Type">
    <xs:annotation>
      <xs:documentation> Hex 1-16 digits in size or unsignedLong</xs:documentation>
    </xs:annotation>
    <xs:union memberTypes="xs:unsignedLong man:HexInt64Type"/>
  </xs:simpleType>
  <xs:simpleType name="LengthType">
    <xs:annotation>
      <xs:documentation> Length property name string or unsignedShort</xs:documentation>
    </xs:annotation>
    <xs:union memberTypes="xs:unsignedShort xs:string"/>
  </xs:simpleType>
  <xs:simpleType name="CountType">
    <xs:annotation>
      <xs:documentation> Count property name string or unsignedShort</xs:documentation>
    </xs:annotation>
    <xs:union memberTypes="xs:unsignedShort xs:string"/>
  </xs:simpleType>

  <xs:simpleType name="strTableRef">
    <xs:annotation>
      <xs:documentation>
        Value of this attribute should be of the form $(string.stringTableId),
        where stringTableId is the 'id' attribute of a &lt;string&gt; element
        defined in the &lt;stringTable&gt; section. Or it could be of the form
        $(mc.mcSymbolId), where mcSymbolId is the symbol of a message string
        defined in a .mc file.
      </xs:documentation>
    </xs:annotation>
    <xs:restriction base="xs:string">
      <xs:pattern value="(\$\([Ss]tring\..*\))|(\$\([Mm][Cc]\..*\))"/>
    </xs:restriction>
  </xs:simpleType>

  <xs:simpleType name="filePath">
    <xs:annotation>
      <xs:documentation>
        A fully-qualified path to a file. Standard Windows environment variables are
        allowed. Typically, the file is of type .exe, .dll, or .sys.
      </xs:documentation>
    </xs:annotation>
    <xs:restriction base="xs:string">
    </xs:restriction>
  </xs:simpleType>

  <xs:complexType name="FilterType" mixed="true">
    <xs:simpleContent>
      <xs:extension base="xs:string">
        <xs:attribute name="value" type="man:UInt8Type" use="required"/>
        <xs:attribute name="version" type="man:UInt8Type" use="optional"/>
        <xs:attribute name="name" type="xs:QName" use="required"/>
        <xs:attribute name="symbol" type="man:CSymbolType" use="optional"/>
        <xs:attribute name="message" type="man:strTableRef" use="optional"/>
        <xs:attribute name="tid" type="xs:token" use="optional"/>
      </xs:extension>
    </xs:simpleContent>
  </xs:complexType>

  <xs:complexType name="FilterListType" mixed="true">
    <xs:sequence>
      <xs:element name="filter" type="man:FilterType" minOccurs="0" maxOccurs="unbounded"/>
    </xs:sequence>
  </xs:complexType>

  <xs:complexType name="KeywordType" mixed="true">
    <xs:simpleContent>
      <xs:extension base="xs:string">
        <xs:attribute name="name" type="xs:QName" use="required">
          <xs:annotation>
            <xs:documentation>
              Each keyword must have a unique name, which is used to reference the keyword
              from the events section of the manifest.
            </xs:documentation>
          </xs:annotation>
        </xs:attribute>
        <xs:attribute name="symbol" type="man:CSymbolType" use="optional"/>
        <xs:attribute name="mask" type="man:HexInt64Type" use="required">
          <xs:annotation>
            <xs:documentation>
              Mask is a 64-bit value, in which, only one bit is set. Mask value cannot be zero.
              Leftmost 16 bits of the mask are reserved for use by winmeta.xml.
            </xs:documentation>
          </xs:annotation>
        </xs:attribute>
        <xs:attribute name="message" type="man:strTableRef" use="optional"/>
        <xs:anyAttribute namespace="##other" processContents="lax"/>
      </xs:extension>
    </xs:simpleContent>
  </xs:complexType>

  <xs:complexType name="KeywordListType">
    <xs:annotation>
      <xs:documentation>
        Use keywords to group events together. At run-time, it is possible to enable
        events belonging to only certain groups (i.e. keywords). This is one way to
        filter out unwanted events at the time of logging.
      </xs:documentation>
    </xs:annotation>
    <xs:sequence>
      <xs:element name="keyword" type="man:KeywordType" minOccurs="0" maxOccurs="unbounded"/>
    </xs:sequence>
  </xs:complexType>

  <xs:complexType name="OpcodeType" mixed="true">
    <xs:simpleContent>
      <xs:extension base="xs:string">
        <xs:attribute name="name" type="xs:QName" use="required"/>
        <xs:attribute name="symbol" type="man:CSymbolType" use="optional"/>
        <xs:attribute name="value" type="man:UInt8Type" use="required"/>
        <xs:attribute name="mofValue" type="man:UInt8Type" use="optional"/>
        <xs:attribute name="message" type="man:strTableRef" use="optional"/>
        <xs:anyAttribute namespace="##other" processContents="lax"/>
      </xs:extension>
    </xs:simpleContent>
  </xs:complexType>

  <xs:complexType name="OpcodeListType">
    <xs:annotation>
      <xs:documentation>
        Use opcodes, in conjunction with a task, to describe different milestones within
        an activity.
      </xs:documentation>
    </xs:annotation>
    <xs:sequence>
      <xs:element name="opcode" type="man:OpcodeType" minOccurs="0" maxOccurs="unbounded"/>
    </xs:sequence>
  </xs:complexType>

  <xs:complexType name="LevelType" mixed="true">
    <xs:simpleContent>
      <xs:extension base="xs:string">
        <xs:attribute name="name" type="xs:QName" use="required"/>
        <xs:attribute name="symbol" type="man:CSymbolType" use="optional"/>
        <xs:attribute name="value" type="man:UInt8Type" use="required"/>
        <xs:attribute name="message" type="man:strTableRef" use="optional"/>
        <xs:anyAttribute namespace="##other" processContents="lax"/>
      </xs:extension>
    </xs:simpleContent>
  </xs:complexType>

  <xs:complexType name="LevelListType">
    <xs:annotation>
      <xs:documentation>
        Use levels to control the verbosity of events during logging. At run-time,
        a provider can be enabled with a certain level value, and only events with
        a level value less than or equal to the specified value will get logged.
      </xs:documentation>
    </xs:annotation>
    <xs:sequence>
      <xs:element name="level" type="man:LevelType" minOccurs="0" maxOccurs="unbounded"/>
    </xs:sequence>
  </xs:complexType>

  <xs:complexType name="TaskType" mixed="true">
    <xs:sequence>
        <xs:element name="opcodes" type="man:OpcodeListType" minOccurs="0"/>
    </xs:sequence>
    <xs:attribute name="name" type="xs:QName" use="required"/>
    <xs:attribute name="symbol" type="man:CSymbolType" use="optional"/>
    <xs:attribute name="value" type="man:UInt16Type" use="required"/>
    <xs:attribute name="eventGUID" type="man:GUIDType" use="optional"/>
    <xs:attribute name="message" type="man:strTableRef" use="optional"/>
    <xs:anyAttribute namespace="##other" processContents="lax"/>
  </xs:complexType>

  <xs:complexType name="TaskListType">
    <xs:annotation>
      <xs:documentation>
        Use tasks to describe an activity. Use opcodes to describe each unit of work
        within an activity.
      </xs:documentation>
    </xs:annotation>
    <xs:sequence>
      <xs:element name="task" type="man:TaskType" minOccurs="0" maxOccurs="unbounded"/>
    </xs:sequence>
  </xs:complexType>

  <xs:complexType name="StringTableType">
    <xs:choice minOccurs="0" maxOccurs="unbounded">
      <xs:element name="string">
        <xs:complexType mixed="true">
          <xs:attribute name="id" type="xs:string" use="required"/>
          <xs:attribute name="value" type="xs:string" use="required"/>
          <xs:attribute name="stringType" type="xs:string" use="optional"/>
        </xs:complexType>
      </xs:element>
    </xs:choice>
    <xs:anyAttribute namespace="##other" processContents="lax"/>
  </xs:complexType>

  <xs:complexType name="ChannelLoggingType">
    <xs:annotation>
      <xs:documentation>Channel logging config</xs:documentation>
    </xs:annotation>
    <xs:sequence minOccurs="0">
      <xs:element name="autoBackup" type="xs:boolean" minOccurs="0"/>
      <xs:element name="retention" type="xs:boolean" default="false" minOccurs="0"/>
      <xs:element name="maxSize" type="man:UInt64Type" default="1048576" minOccurs="0"/>
      <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
    </xs:sequence>
    <xs:anyAttribute namespace="##other" processContents="lax"/>
  </xs:complexType>

  <xs:complexType name="ChannelPublishingType">
    <xs:annotation>
      <xs:documentation>Channel publishing config</xs:documentation>
    </xs:annotation>
    <xs:sequence minOccurs="0">
      <xs:element name="level" type="man:UInt8Type" default="0" minOccurs="0"/>
      <xs:element name="keywords" type="man:UInt64Type" default="0" minOccurs="0"/>
      <xs:element name="controlGuid" type="man:GUIDType" minOccurs="0"/>
      <xs:element name="bufferSize" type="man:UInt32Type" minOccurs="0">
        <xs:annotation>
          <xs:documentation>Amount of memory allocated for the session buffers (KB)</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="fileMax" type="man:UInt32Type" minOccurs="0">
        <xs:annotation>
          <xs:documentation>Number of etl files to create across enablement</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="minBuffers" type="man:UInt32Type" minOccurs="0">
        <xs:annotation>
          <xs:documentation>Minimum number of session buffers</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="maxBuffers" type="man:UInt32Type" minOccurs="0">
        <xs:annotation>
          <xs:documentation>Maximum number of session buffers</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="latency" type="man:UInt32Type" minOccurs="0">
        <xs:annotation>
          <xs:documentation>Buffer flush interval (sec)</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="clockType" default="SystemTime" minOccurs="0">
        <xs:annotation>
          <xs:documentation>Clock resolution</xs:documentation>
        </xs:annotation>
        <xs:simpleType>
          <xs:restriction base="xs:string">
            <xs:enumeration value="SystemTime"/>
            <xs:enumeration value="QPC"/>
          </xs:restriction>
        </xs:simpleType>
      </xs:element>
      <xs:element name="sidType" minOccurs="0">
        <xs:simpleType>
          <xs:restriction base="xs:string">
            <xs:enumeration value="None"/>
            <xs:enumeration value="Publishing"/>
          </xs:restriction>
        </xs:simpleType>
      </xs:element>
      <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
    </xs:sequence>
    <xs:anyAttribute namespace="##other" processContents="lax"/>
  </xs:complexType>

  <xs:complexType name="ChannelType" mixed="true">
    <xs:sequence>
      <xs:element name="logging" type="man:ChannelLoggingType" minOccurs="0"/>
      <xs:element name="publishing" type="man:ChannelPublishingType" minOccurs="0"/>
      <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
    </xs:sequence>
    <xs:attribute name="name" type="xs:anyURI" use="required"/>
    <xs:attribute name="chid" type="xs:token" use="optional"/>
    <xs:attribute name="type" use="required">
      <xs:simpleType>
        <xs:restriction base="xs:string">
          <xs:enumeration value="Admin"/>
          <xs:enumeration value="Operational"/>
          <xs:enumeration value="Analytic"/>
          <xs:enumeration value="Debug"/>
        </xs:restriction>
      </xs:simpleType>
    </xs:attribute>
    <xs:attribute name="symbol" type="man:CSymbolType" use="optional"/>
    <xs:attribute name="access" type="xs:string" use="optional"/>
    <xs:attribute name="isolation" use="optional">
      <xs:annotation>
        <xs:documentation>Default publishing session/security if not specified explicitly by the channel access attribute.</xs:documentation>
      </xs:annotation>
      <xs:simpleType>
        <xs:restriction base="xs:string">
          <xs:enumeration value="Application"/>
          <xs:enumeration value="System"/>
          <xs:enumeration value="Custom"/>
        </xs:restriction>
      </xs:simpleType>
    </xs:attribute>
    <xs:attribute name="enabled" type="xs:boolean" use="optional" default="false"/>
    <xs:attribute name="value" type="man:UInt8Type" use="optional"/>
    <xs:attribute name="message" type="man:strTableRef" use="optional"/>
    <xs:anyAttribute namespace="##other" processContents="lax"/>
  </xs:complexType>

  <xs:complexType name="ChannelListType">
    <xs:annotation>
      <xs:documentation>
        Use channels to describe the destinations for your events. Each channel you
        define here will show up in the Windows Event Viewer.
      </xs:documentation>
    </xs:annotation>
    <xs:choice minOccurs="0" maxOccurs="unbounded">
      <xs:element name="importChannel" type="man:ImportChannelType"/>
      <xs:element name="channel" type="man:ChannelType"/>
      <xs:any namespace="##other" processContents="lax"/>
    </xs:choice>
    <xs:anyAttribute namespace="##other"/>
  </xs:complexType>

  <xs:complexType name="DataDefinitionType" mixed="true">
    <xs:simpleContent>
      <xs:extension base="xs:string">
        <xs:attribute name="name" type="xs:string" use="required"/>
        <xs:attribute name="inType" type="xs:QName" use="required"/>
        <xs:attribute name="outType" type="xs:QName" use="optional"/>
        <xs:attribute name="map" type="xs:string" use="optional"/>
        <xs:attribute name="length" type="man:LengthType" use="optional"/>
        <xs:attribute name="count" type="man:CountType" use="optional"/>
        <xs:attribute name="tags" type="man:UInt32Type" use="optional">
          <xs:annotation>
            <xs:documentation>
              Tags is a 28-bit user-defined metadata value applied to this property. The
              event producer and consumer coordinate to define the semantics of the tags
              value. During event processing on Windows 10 Fall Creators Update (2017) or
              later, this value can be retrieved from the EVENT_PROPERTY_INFO Tags field.
            </xs:documentation>
          </xs:annotation>
        </xs:attribute>
        <xs:anyAttribute namespace="##other" processContents="lax"/>
      </xs:extension>
    </xs:simpleContent>
  </xs:complexType>

  <xs:complexType name="StructDefinitionType" mixed="true">
    <xs:sequence>
      <xs:element name="data" type="man:DataDefinitionType" maxOccurs="unbounded"/>
    </xs:sequence>
    <xs:attribute name="name" type="xs:string" use="required"/>
    <xs:attribute name="count" type="man:CountType" use="optional"/>
    <xs:attribute name="tags" type="man:UInt32Type" use="optional">
      <xs:annotation>
        <xs:documentation>
          Tags is a 28-bit user-defined metadata value applied to this property. The
          event producer and consumer coordinate to define the semantics of the tags
          value. During event processing on Windows 10 Fall Creators Update (2017) or
          later, this value can be retrieved from the EVENT_PROPERTY_INFO Tags field.
        </xs:documentation>
      </xs:annotation>
    </xs:attribute>
    <xs:anyAttribute namespace="##other" processContents="lax"/>
  </xs:complexType>

  <xs:complexType name="XmlType">
    <xs:sequence>
      <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
    </xs:sequence>
  </xs:complexType>

  <xs:complexType name="TemplateItemType">
    <xs:sequence maxOccurs="unbounded">
      <xs:choice minOccurs="0" maxOccurs="unbounded">
        <xs:element name="data" type="man:DataDefinitionType"/>
        <xs:element name="struct" type="man:StructDefinitionType"/>
      </xs:choice>
      <xs:element name="binary" minOccurs="0">
        <xs:annotation>
          <xs:documentation>Represents binary data in classic eventlog API</xs:documentation>
        </xs:annotation>
        <xs:complexType>
          <xs:attribute name="name" type="xs:string" use="optional"/>
        </xs:complexType>
      </xs:element>
      <xs:element name="UserData" type="man:XmlType" minOccurs="0"/>
    </xs:sequence>
    <xs:attribute name="tid" type="xs:token" use="required"/>
    <xs:attribute name="name" type="xs:string" use="optional"/>
    <xs:attribute name="tags" type="man:UInt32Type" use="optional">
      <xs:annotation>
        <xs:documentation>
          Tags is a 28-bit user-defined metadata value applied to each event that uses
          this template. The event producer and consumer coordinate to define the
          semantics of the tags value. During event processing on Windows 10 Fall
          Creators Update (2017) or later, this value can be retrieved from the
          TRACE_EVENT_INFO Tags field.
        </xs:documentation>
      </xs:annotation>
    </xs:attribute>
    <xs:anyAttribute namespace="##other" processContents="lax"/>
  </xs:complexType>

  <xs:complexType name="TemplateListType">
    <xs:annotation>
      <xs:documentation>
        Use templates to describe the payload logged by an event. Different events can
        share a template.
      </xs:documentation>
    </xs:annotation>
    <xs:sequence>
      <xs:element name="template" type="man:TemplateItemType" minOccurs="0" maxOccurs="unbounded"/>
    </xs:sequence>
  </xs:complexType>

  <xs:complexType name="XmlTypeListType">
    <xs:sequence>
      <xs:element name="xmlType" minOccurs="0" maxOccurs="unbounded">
        <xs:complexType>
          <xs:complexContent>
            <xs:extension base="man:XmlType">
              <xs:attribute name="name" type="xs:QName" use="required"/>
              <xs:attribute name="value" type="xs:string" use="required"/>
              <xs:attribute name="symbol" type="man:CSymbolType" use="required"/>
            </xs:extension>
          </xs:complexContent>
        </xs:complexType>
      </xs:element>
    </xs:sequence>
  </xs:complexType>

  <xs:complexType name="OutputType">
    <xs:simpleContent>
      <xs:extension base="xs:string">
        <xs:attribute name="default" type="xs:boolean" use="optional"/>
        <xs:attribute name="xmlType" type="xs:QName" use="required"/>
      </xs:extension>
    </xs:simpleContent>
  </xs:complexType>

  <xs:complexType name="InputType">
    <xs:sequence>
      <xs:element name="description" type="xs:string"/>
      <xs:element name="outType" type="man:OutputType" minOccurs="0" maxOccurs="unbounded"/>
      <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
    </xs:sequence>
    <xs:attribute name="name" type="xs:QName" use="required"/>
    <xs:attribute name="value" type="xs:string" use="required"/>
    <xs:attribute name="symbol" type="man:CSymbolType" use="required"/>
  </xs:complexType>

  <xs:complexType name="TypeListType">
    <xs:choice maxOccurs="unbounded">
      <xs:element name="xmlTypes" type="man:XmlTypeListType"/>
      <xs:element name="inTypes" type="man:InputTypeListType"/>
      <xs:any namespace="##other" processContents="lax" minOccurs="0"/>
    </xs:choice>
  </xs:complexType>

  <xs:complexType name="InputTypeListType">
    <xs:sequence>
      <xs:element name="inType" type="man:InputType" maxOccurs="unbounded"/>
    </xs:sequence>
  </xs:complexType>

  <xs:simpleType name="QNameList">
    <xs:list itemType="xs:QName"/>
  </xs:simpleType>

  <xs:complexType name="ImportChannelType" mixed="true">
    <xs:simpleContent>
      <xs:extension base="xs:string">
        <xs:attribute name="chid" type="xs:token" use="optional"/>
        <xs:attribute name="name" type="xs:anyURI" use="required"/>
        <xs:attribute name="symbol" type="man:CSymbolType" use="optional"/>
      </xs:extension>
    </xs:simpleContent>
  </xs:complexType>

  <xs:complexType name="EventDefinitionType">
    <xs:simpleContent>
      <xs:extension base="xs:string">
        <xs:attribute name="value" type="man:UInt32Type" use="required">
          <xs:annotation>
            <xs:documentation>
              Also referred to as the Event-Id. A manifest-based ETW event is uniquely
              identified by the {Provider-Guid,Event-Id,Event-Version} tuple.
            </xs:documentation>
          </xs:annotation>
        </xs:attribute>
        <xs:attribute name="name" type="xs:string" use="optional">
          <xs:annotation>
            <xs:documentation>
              Non-localized event name. During event processing on Windows 10 Fall
              Creators Update (2017) or later, this value can be retrieved from the
              TRACE_EVENT_INFO EventNameOffset field.
            </xs:documentation>
          </xs:annotation>
        </xs:attribute>
        <xs:attribute name="attributes" type="xs:string" use="optional">
          <xs:annotation>
            <xs:documentation>
              Non-localized event attributes. This should be a semicolon-delimited list of
              name=value attributes associated with the event. During event processing on
              Windows 10 Fall Creators Update (2017) or later, this value can be retrieved
              from the TRACE_EVENT_INFO EventAttributesOffset field.

              Defined attributes include:
              FILE=Filename of source code associated with event;
              LINE=Line number of source code associated with event;
              FUNC=Function name associated with event;
              MJ=Major component associated with event (component name);
              MN=Minor component associated with event (subcomponent name).
              Values containing semicolons or double-quotes should be quoted using
              double-quotes; double-quotes within the value should be doubled. Example:
              attributes='FILE=source.cpp;LINE=123;MJ="Value; ""Quoted"""'

              Note that most of these attributes are intended for use with tool-generated
              manifests and may not be appropriate for use with hand-maintained manifests. For
              example, the FILE ane LINE attributes are not generally appropriate for use in
              a hand-maintained manifest, since a single event might be emitted from multiple
              source code locations and the source code locations will change over time. The
              FILE and LINE attributes are intended for use in cases where the manifest is
              regenerated (with a new GUID) by a code generation tool each time the source
              code changes.
          </xs:documentation>
          </xs:annotation>
        </xs:attribute>
        <xs:attribute name="level" type="xs:QName" use="optional">
          <xs:annotation>
            <xs:documentation>
              Reference to a &lt;level&gt; element defined in the &lt;levels&gt; section.
              Refer to a level by its attribute 'name'.
            </xs:documentation>
          </xs:annotation>
        </xs:attribute>
        <xs:attribute name="template" type="xs:token" use="optional"/>
        <xs:attribute name="channel" type="xs:token" use="optional"/>
        <xs:attribute name="keywords" type="man:QNameList" use="optional"/>
        <xs:attribute name="task" type="xs:QName" use="optional"/>
        <xs:attribute name="opcode" type="xs:QName" use="optional"/>
        <xs:attribute name="symbol" type="man:CSymbolType" use="optional"/>
        <xs:attribute name="version" type="man:UInt8Type" use="optional">
          <xs:annotation>
            <xs:documentation>
              Increment the version of an event if its template is modified.
            </xs:documentation>
          </xs:annotation>
        </xs:attribute>
        <xs:attribute name="message" type="man:strTableRef" use="optional"/>
        <xs:attribute name="notLogged" type="xs:boolean" use="optional" default="false">
          <xs:annotation>
            <xs:documentation>
              Use this to indicate that this event has been removed and will not be logged
              by this version of the provider. The description of the event should be retained
              in this manifest so that if an etl file collected from an older version of the
              provider on a different machine is brought to this machine, it can be correctly
              decoded on this machine.
            </xs:documentation>
          </xs:annotation>
        </xs:attribute>
        <xs:attribute name="suppressProjection" type="xs:boolean" use="optional" default="false">
          <xs:annotation>
            <xs:documentation>
              Use this to indicate if the template associated with this event contains 
              valid WinRT types i.e. the event payload fields can come from arguments
              of projected WinRT methods. Ignore this attribute if the component which
              is hosting the provider does not use WinRT projection APIs to log the event.
            </xs:documentation>
          </xs:annotation>
        </xs:attribute>            
      </xs:extension>
    </xs:simpleContent>
  </xs:complexType>

  <xs:complexType name="MapType">
    <xs:choice maxOccurs="unbounded">
      <xs:element name="valueMap" type="man:ValueMapType"/>
      <xs:element name="bitMap" type="man:BitMapType"/>
    </xs:choice>
  </xs:complexType>

  <xs:complexType name="ValueMapType">
    <xs:sequence>
      <xs:element name="map" type="man:ValueMapValueType" maxOccurs="unbounded"/>
    </xs:sequence>
    <xs:attribute name="name" type="xs:string" use="required"/>
    <xs:attribute name="symbol" type="man:CSymbolType" use="optional"/>
  </xs:complexType>

  <xs:complexType name="ValueMapValueType" mixed="true">
    <xs:simpleContent>
      <xs:extension base="xs:string">
        <xs:attribute name="value" type="man:UInt32Type" use="required"/>
        <xs:attribute name="message" type="man:strTableRef" use="required"/>
        <xs:attribute name="symbol" type="man:CSymbolType" use="optional"/>
      </xs:extension>
    </xs:simpleContent>
  </xs:complexType>

  <xs:complexType name="BitMapType">
    <xs:sequence>
      <xs:element name="map" type="man:BitMapValueType" maxOccurs="unbounded"/>
    </xs:sequence>
    <xs:attribute name="name" type="xs:string" use="required"/>
    <xs:attribute name="symbol" type="man:CSymbolType" use="optional"/>
  </xs:complexType>

  <xs:complexType name="BitMapValueType" mixed="true">
    <xs:simpleContent>
      <xs:extension base="xs:string">
        <xs:attribute name="value" type="man:HexInt32Type" use="required"/>
        <xs:attribute name="message" type="man:strTableRef" use="required"/>
        <xs:attribute name="symbol" type="man:CSymbolType" use="optional"/>
      </xs:extension>
    </xs:simpleContent>
  </xs:complexType>

  <xs:complexType name="NamedQueryType">
    <xs:sequence>
      <xs:element name="patternMaps" type="man:PatternMapListType" minOccurs="0"/>
      <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
    </xs:sequence>
    <xs:anyAttribute namespace="##other" processContents="lax"/>
  </xs:complexType>

  <xs:complexType name="PatternMapListType">
    <xs:sequence>
      <xs:element name="patternMap" type="man:PatternMapType" maxOccurs="unbounded"/>
    </xs:sequence>
  </xs:complexType>

  <xs:complexType name="PatternMapType">
    <xs:sequence>
      <xs:element name="map" type="man:PatternMapValueType" maxOccurs="unbounded"/>
    </xs:sequence>
    <xs:attribute name="name" type="xs:QName" use="required"/>
    <xs:attribute name="format" type="xs:anyURI" use="required"/>
    <xs:attribute name="symbol" type="man:CSymbolType" use="optional"/>
  </xs:complexType>

  <xs:complexType name="PatternMapValueType">
    <xs:simpleContent>
      <xs:extension base="xs:string">
        <xs:attribute name="name" type="xs:string" use="required"/>
        <xs:attribute name="value" type="xs:string" use="required"/>
      </xs:extension>
    </xs:simpleContent>
  </xs:complexType>

  <xs:complexType name="DefinitionType">
    <xs:annotation>
      <xs:documentation>
        List all events logged by the provider in this section.
      </xs:documentation>
    </xs:annotation>
    <xs:choice minOccurs="0" maxOccurs="unbounded">
      <xs:element name="event" type="man:EventDefinitionType"/>
    </xs:choice>
  </xs:complexType>

  <xs:complexType name="TraitsType">
    <xs:annotation>
      <xs:documentation>
        Specifies values for this provider's provider traits. The provider traits
        consist of a small binary blob that is registered with the ETW runtime via
        EventSetInformation and included with each call to EventWrite. The traits
        blob contains information about a provider's name, decode GUID, and group
        GUID.
        When provider traits are needed (i.e. when the provider has different values
        for its control GUID and its decode GUID or when the traits element is
        present), the MC tool's -um or -km codegen will generate a provider traits
        blob, will generate code to automatically register the blob as part of
        EventRegister, and will include the blob in each call to EventWrite.
      </xs:documentation>
    </xs:annotation>
    <xs:attribute name="includeName" type="xs:boolean" use="optional">
      <xs:annotation>
        <xs:documentation>
          Optional. Default is false. If true, the provider's name will be included
          in the provider traits. If false, the provider's name will be left blank
          to reduce the size of the trace file. Including the provider name makes it
          possible to filter an event by provider name.
        </xs:documentation>
      </xs:annotation>
    </xs:attribute>
    <xs:attribute name="groupGuid" type="man:GUIDType" use="optional">
      <xs:annotation>
        <xs:documentation>
          Optional. Specifies that this provider is a member of the specified provider
          group. By default, the provider is not a member of any provider group.
        </xs:documentation>
      </xs:annotation>
    </xs:attribute>
  </xs:complexType>

  <xs:complexType name="ProviderType">
    <xs:choice minOccurs="0" maxOccurs="unbounded">
      <xs:element name="channels" type="man:ChannelListType"/>
      <xs:element name="levels" type="man:LevelListType"/>
      <xs:element name="tasks" type="man:TaskListType"/>
      <xs:element name="opcodes" type="man:OpcodeListType"/>
      <xs:element name="keywords" type="man:KeywordListType"/>
      <xs:element name="maps" type="man:MapType"/>
      <xs:element name="namedQueries" type="man:NamedQueryType"/>
      <xs:element name="templates" type="man:TemplateListType"/>
      <xs:element name="events" type="man:DefinitionType"/>
      <xs:element name="filters" type="man:FilterListType"/>
      <xs:element name="traits" type="man:TraitsType"/>
      <xs:any namespace="##other" processContents="lax"/>
    </xs:choice>
    <xs:attribute name="name" type="xs:anyURI" use="required"/>
    <xs:attribute name="namespace" type="man:NamespaceType" use="optional"/>
    <xs:attribute name="guid" type="man:GUIDType" use="required"/>
    <xs:attribute name="controlGuid" type="man:GUIDType" use="optional">
      <xs:annotation>
        <xs:documentation>
          A manifest-based ETW provider has a decode GUID (used to locate the manifest)
          and a control GUID (used to enable the provider or filter events). Normally,
          the same GUID (the provider guid) is used for both decode and control.
          If distinct values are needed for the decode and control GUIDs, set the
          "guid" attribute to the decode GUID and set the "controlGuid" attribute to the
          control GUID. Note that to avoid provider name conflicts, if the controlGuid
          attribute is used, the provider name must end with the decode guid, e.g.

            guid="{54bab802-bb0b-4b4a-9ce9-7360a0120b3e}"
            name="MyProvider.54bab802bb0b4b4a9ce97360a0120b3e"
            controlGuid="{74d557d9-4a8e-4a3f-9a32-3f1a0eab71ba}"
  
          If a provider uses distinct decode and control GUIDs, the resulting traces may
          not decode properly when decoded on Windows versions prior to Windows 10
          Fall Creators Update (2017).

          (Note that distinct decode and control GUIDs are typically used to support
          tool-generated manifests and are generally unnecessary for hand-maintained
          manifests.)
        </xs:documentation>
      </xs:annotation>
    </xs:attribute>
    <xs:attribute name="resourceFileName" type="man:filePath" use="optional">
      <xs:annotation>
        <xs:documentation>
          Name of the executable file to which the provider's metadata resource is linked,
          usually the same as the provider's binary.
        </xs:documentation>
      </xs:annotation>
    </xs:attribute>
    <xs:attribute name="messageFileName" type="man:filePath" use="optional">
      <xs:annotation>
        <xs:documentation>
          Name of the executable file to which the provider's localizable message resource
          is linked, usually the same as the provider's binary.
        </xs:documentation>
      </xs:annotation>
    </xs:attribute>
    <xs:attribute name="parameterFileName" type="man:filePath" use="optional"/>
    <xs:attribute name="helpLink" type="xs:anyURI" use="optional"/>
    <xs:attribute name="symbol" type="man:CSymbolType" use="required"/>
    <xs:attribute name="message" type="man:strTableRef" use="optional"/>
    <xs:attribute name="source" use="optional" default="Xml">
      <xs:simpleType>
        <xs:restriction base="xs:string">
          <xs:enumeration value="Xml"/>
          <xs:enumeration value="Wbem"/>
        </xs:restriction>
      </xs:simpleType>
    </xs:attribute>
    <xs:attribute name="warnOnApplicationCompatibilityError" type="xs:boolean" use="optional" default="false"/>
    <xs:anyAttribute namespace="##other" processContents="lax"/>
  </xs:complexType>

  <xs:complexType name="MetadataType">
    <xs:sequence>
      <xs:element name="channels" type="man:ChannelListType"/>
      <xs:element name="levels" type="man:LevelListType"/>
      <xs:element name="tasks" type="man:TaskListType"/>
      <xs:element name="opcodes" type="man:OpcodeListType" minOccurs="0"/>
      <xs:element name="keywords" type="man:KeywordListType" minOccurs="0"/>
      <xs:element name="types" type="man:TypeListType" minOccurs="0"/>
      <xs:element name="namedQueries" type="man:NamedQueryType" minOccurs="0"/>
      <xs:element name="messageTable" minOccurs="0">
        <xs:complexType>
          <xs:sequence>
            <xs:element name="message" minOccurs="0" maxOccurs="unbounded">
              <xs:complexType>
                <xs:attribute name="value" type="man:UInt32Type" use="required"/>
                <xs:attribute name="mid" type="xs:string" use="optional"/>
                <xs:attribute name="message" type="man:strTableRef" use="required"/>
                <xs:attribute name="symbol" type="man:CSymbolType" use="optional"/>
              </xs:complexType>
            </xs:element>
          </xs:sequence>
        </xs:complexType>
      </xs:element>
      <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
    </xs:sequence>
    <xs:attribute name="name" type="xs:anyURI" use="required"/>
    <xs:anyAttribute namespace="##other" processContents="lax"/>
  </xs:complexType>

  <xs:complexType name="LocalizationType">
    <xs:choice minOccurs="0" maxOccurs="unbounded">
      <xs:element name="resources">
        <xs:complexType>
          <xs:choice minOccurs="0" maxOccurs="unbounded">
            <xs:element name="stringTable" type="man:StringTableType"/>
          </xs:choice>
          <xs:attribute name="culture" type="xs:string" use="required"/>
          <xs:anyAttribute namespace="##other" processContents="lax"/>
        </xs:complexType>
      </xs:element>
      <xs:any namespace="##other" processContents="lax"/>
    </xs:choice>
    <xs:attribute name="fallbackCulture" type="xs:string" use="optional" default="en-us"/>
    <xs:anyAttribute namespace="##other" processContents="lax"/>
  </xs:complexType>

  <xs:complexType name="EventsType">
    <xs:choice maxOccurs="unbounded">
      <xs:element name="provider" type="man:ProviderType"/>
      <xs:element name="messageTable" minOccurs="0">
        <xs:complexType>
          <xs:sequence>
            <xs:element name="message" minOccurs="0" maxOccurs="unbounded">
              <xs:complexType>
                <xs:attribute name="value" type="xs:string" use="required"/>
                <xs:attribute name="mid" type="xs:string" use="optional"/>
                <xs:attribute name="message" type="man:strTableRef" use="required"/>
                <xs:attribute name="symbol" type="man:CSymbolType" use="optional"/>
              </xs:complexType>
            </xs:element>
          </xs:sequence>
        </xs:complexType>
      </xs:element>
      <xs:any namespace="##other" processContents="lax" minOccurs="0"/>
    </xs:choice>
    <xs:anyAttribute namespace="##other"/>
  </xs:complexType>

  <xs:complexType name="InstrumentationType">
    <xs:choice minOccurs="0" maxOccurs="unbounded">
      <xs:element name="events" type="man:EventsType"/>
      <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
    </xs:choice>
    <xs:anyAttribute namespace="##other" processContents="lax"/>
  </xs:complexType>

  <xs:complexType name="InstrumentationManifestType"/>

  <xs:element name="instrumentationManifest">
    <xs:complexType>
      <xs:complexContent>
        <xs:extension base="man:InstrumentationManifestType">
          <xs:choice maxOccurs="3">
            <xs:choice>
              <xs:element name="metadata" type="man:MetadataType"/>
              <xs:element name="instrumentation" type="man:InstrumentationType"/>
            </xs:choice>
            <xs:element name="localization" type="man:LocalizationType"/>
            <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
          </xs:choice>
        </xs:extension>
      </xs:complexContent>
    </xs:complexType>
  </xs:element>
  <xs:element name="events" type="man:EventsType"/>

</xs:schema>

Youez - 2016 - github.com/yon3zu
LinuXploit