Setting up a dynamic rules filter

Before you set up dynamic filtering, you must:

Then call TraceEvent() with one of these commands:

_NTO_TRACE_ADDCLASSEVHANDLER
Register a function to call whenever an event for the given class is emitted:
TraceEvent(_NTO_TRACE_ADDCLASSEVHANDLER, class,
           int (*event_hdlr)(event_data_t*),
           event_data_t* data_struct);
  
_NTO_TRACE_ADDEVENTHANDLER
Register a function to call whenever an event for the given class and event type is emitted:
TraceEvent(_NTO_TRACE_ADDEVENTHANDLER, class, event, 
           int (*event_hdlr)(event_data_t*), 
           event_data_t* data_struct);
  

The additional arguments are:

event_hdlr
A pointer to the function that you want to register. The prototype for the function is:
int event_hdlr (event_data_t *event_data);
  
data_struct
A pointer to a locally defined data structure, of type event_data_t, where the kernel can store event data to pass to the event handler (see below).