PRB: Filters May Not Behave as Expected when Using cVSAEventStandard (243262)

MORE INFORMATION

Consider the following code fragment. The event is being fired from the MyProc.exe process.

const int MAXPARAMS = 2;

DWORD rgTypes[ MAXPARAMS ] =
{
     //custom parameter whose value will be an ANSI string
     cVSAParameterKeyString | cVSAParameterValueANSIString,
     //standard parameter SourceMachine
     cVSAParameterValueANSIString
};

DWORD rgKeys[ MAXPARAMS ] =
{
     //custom parameter name
     (DWORD) L"CustomParam",
     //SourceMachine
     cVSAStandardParameterSourceMachine
};     

DWORD rgValues[ MAXPARAMS ] =
{
     //value for CustomParam
     (DWORD) "This is a Custom Parameter",
     //value for SourceMachine
     (DWORD) "MyPc"
};

if( S_OK == pIEventFire->IsActive() )
{
     //fire the custom event
     pIEventFire->FireEvent(MYPROC_EVENT_1,MAXPARAMS,rgKeys,rgValues,rgTypes,0, 0, cVSAEventStandard );
}
				

The following filter will evaluate to false as there is no default value set for SourceProcess:

( SourceProcess = "MyProc" )
				

The following filter will evaluate to true as you have explicitly provided your own value for SourceMachine:

( SourceMachine = "MyPc" )
				

Modifying the dwFlags parameter to generate default parameters will cause both filters to evaluate to true:

pIEventFire->FireEvent(MYPROC_EVENT_1,MAXPARAMS,rgKeys,rgValues,rgTypes,0, 0, cVSAEventDefaultSource | cVSAEventDefaultTarget );