Method IsRundownProcessed

pkg/event/event_windows.go:194–204

IsRundownProcessed checks if the rundown events was processed to discard writing the snapshot state if the process/module is already present. This usually happens when we purposely alter the tracing session to induce the arrival of rundown events by calling into the `etw.SetTraceInformation` Windows

()

// For more pointers check `internal/etw/trace.go` and the
// `etw.SetTraceInformation` API function.
func (e *Event) IsRundownProcessed() bool {
	mu.Lock()
	defer mu.Unlock()
	key := e.RundownKey()
	_, isProcessed := rundowns[key]
	if isProcessed {
		return true
	}
	rundowns[key] = true
	return false
}

func (e *Event) IsCreateFile() bool             { return e.Type == CreateFile }
func (e *Event) IsCreateProcess() bool          { return e.Type == CreateProcess }