Question: can I use krabsetw for past events?

[LucioDonda]

Hi everyone, sorry if this is not the rightplace where to write this:
I'm using Krabsetw for monitoring the ETW events on Windows but I wanted to use some bookmarking to resume where I left before the app is terminated.
Is that possible or Krabsetw only works with real-time events? AFAIK using EvtSubscribeStartAfterBookmark in the flags of eventSubscribe this was possible in the old winevt.h.

TIA, you've done a wonderful job here, congrats!

[swannman]

Good question! Krabsetw only supports real-time events, but some ETW providers can be subscribed to using the Event Log as described here. If the provider you're interested in is compatible with that approach, then you might be able to use a combination of direct ETW + EvtSubscribeStartAfterBookmark to backfill events that you missed?