_IRPMNDRV_SETTINGS struct

Summary

Global IRPMon driver statistics and settings.

Definition

typedef struct _IRPMNDRV_SETTINGS {
    volatile LONG ReqQueueLastRequestId;
    volatile LONG ReqQueueLength;
    volatile LONG ReqQueueNonPagedLength;
    volatile LONG ReqQueuePagedLength;
    BOOLEAN ReqQueueConnected;
    BOOLEAN ReqQueueClearOnDisconnect;
    BOOLEAN ReqQueueCollectWhenDisconnected;
    BOOLEAN ProcessEventsCollect;
    BOOLEAN FileObjectEventsCollect;
    BOOLEAN DriverSnapshotEventsCollect;
    BOOLEAN ProcessEmulateOnConnect;
    BOOLEAN DriverSnapshotOnConnect;
    ULONG DataStripThreshold;
    BOOLEAN StripData;
} IRPMNDRV_SETTINGS, *PIRPMNDRV_SETTINGS;

Members

ReqQueueLastRequestId

Specifies ID of the newest event/request generated by the driver. This member is read-only.

ReqQueueLength

Total number of events/requests currently present in the Event Queue. This member is read-only.

ReqQueueNonPagedLength

Specifies number of events allocated from nonpaged pool currently present in the Event Queue. This member is read only.

ReqQueuePagedLength

Specifies number of events allocated from paged pool currently present in the Event Queue. This member is read only.

ReqQueueConnected

Indicates whether someone is connected to the driver event queue, thus receiving requests detected by the driver. This is a read-only member.

ReqQueueClearOnDisconnect

If set to TRUE, the Event Queue is cleared (all requests in it discared) when disconnected.

ReqQueueCollectWhenDisconnected

Set this member to TRUE to instruct the driver to store requests in the Event Queue even when no one is connected to it. By default, the driver puts requests into the queue only if a library instance is connected to it (i.e. there is a consumer).

ProcessEventsCollect

Instructs the driver to collect process-related events (process creation, process exit).

FileObjectEventsCollect

Instructs the driver to collect events about file objects (file object name assignment and deletion).

DriverSnapshotEventsCollect

Instructs the driver to generate events when a new driver or device object are detected.

ProcessEmulateOnConnect

If set to TRUE, any library instance that connects to the Event Queue gets process creation event for all processes currently running in the system. Thus, the instance needs not to enumerate running processes by itself.

DriverSnapshotOnConnect

If set to TRUE, any library instance that connects to the Event Queue gets driver detected and device detected events for all drivers and devices currently present in the system. Thus, the instance needs not to obtain this information by itself (e.g. via IRPMonDllSnapshotRetrieve).

DataStripThreshold

Defines maximum amount of data that can be associated with an event. Set this to zero to disable the limit.

StripData

Defines driver behavior for events with associated data of length greater than the limit (IRPMNDRV_SETTINGS.DataStripThreshold). If set to FALSE the limit is not enforced. If set to TRUE, data are stripped to match the limit, if necessary.

See also

• IRPMNDRV_SETTINGS.DataStripThreshold
• IRPMonDllSnapshotRetrieve

Requirements

Header	general-types.h