private bool DecodeEvent(ref EventRecord eventRecord, out DecodedEtwEvent decodedEvent, out string originalEventName)
{
decodedEvent = new DecodedEtwEvent {
EventRecord = eventRecord
};
originalEventName = string.Empty;
if (false == ManifestCache.IsStringEvent(eventRecord))
{
var eventDefinition = this.etwManifestCache.GetEventDefinition(
eventRecord);
if (null == eventDefinition)
{
if (eventRecord.EventHeader.EventDescriptor.Task != (ushort)FabricEvents.EventSourceTaskId)
{
// We couldn't decode this event. Skip it.
this.traceSource.WriteError(
this.logSourceId,
"Unable to decode ETW event. The event will be skipped. Event ID: {0}, Task: {1}, Level: {2}.",
eventRecord.EventHeader.EventDescriptor.Id,
eventRecord.EventHeader.EventDescriptor.Task,
eventRecord.EventHeader.EventDescriptor.Level);
}
return(false);
}
if (eventDefinition.IsChildEvent)
{
// Try to format the event. This causes the ETL reader to save information
// about this event. That information is later retrieved when the parent
// event is processed.
string childEventType;
string childEventText;
var childStringRepresentation = this.etwManifestCache.FormatEvent(
eventRecord,
out childEventType,
out childEventText);
// Only parent events can be decoded. Child events supply additional
// information about the parent event and cannot be decoded on their
// own.
return(false);
}
decodedEvent.TaskName = eventDefinition.TaskName;
originalEventName = eventDefinition.OriginalEventName;
}
else
{
decodedEvent.TaskName = EventFormatter.StringEventTaskName;
}
decodedEvent.Timestamp = DateTime.FromFileTimeUtc(eventRecord.EventHeader.TimeStamp);
decodedEvent.Level = eventRecord.EventHeader.EventDescriptor.Level;
decodedEvent.ThreadId = eventRecord.EventHeader.ThreadId;
decodedEvent.ProcessId = eventRecord.EventHeader.ProcessId;
decodedEvent.StringRepresentation = this.etwManifestCache.FormatEvent(
eventRecord,
out decodedEvent.EventType,
out decodedEvent.EventText,
0);
if (null == decodedEvent.StringRepresentation)
{
if (eventRecord.EventHeader.EventDescriptor.Task != (ushort)FabricEvents.EventSourceTaskId)
{
// We couldn't decode this event. Skip it.
this.traceSource.WriteError(
this.logSourceId,
"Unable to decode ETW event. The event will be skipped. Event ID: {0}, Task: {1}, Level: {2}.",
eventRecord.EventHeader.EventDescriptor.Id,
eventRecord.EventHeader.EventDescriptor.Task,
eventRecord.EventHeader.EventDescriptor.Level);
return(false);
}
}
// in case it is a string event and the eventName is not give by the eventDefinition
if (string.IsNullOrEmpty(originalEventName))
{
originalEventName = decodedEvent.EventType;
}
// If this is an FMM event, update the last timestamp of FMM events
if (decodedEvent.TaskName.Equals(Utility.FmmTaskName))
{
Utility.LastFmmEventTimestamp = decodedEvent.Timestamp;
}
return(true);
}
private bool DecodeEvent(EventRecord eventRecord, out DecodedEtwEvent decodedEvent)
{
decodedEvent = new DecodedEtwEvent {
EventRecord = eventRecord
};
if (false == ManifestCache.IsStringEvent(eventRecord))
{
var eventDefinition = this.etwManifestCache.GetEventDefinition(
eventRecord);
if (null == eventDefinition)
{
if (!EventSourceHelper.CheckForDynamicManifest(eventRecord.EventHeader.EventDescriptor))
{
// We couldn't decode this event. Skip it.
this.traceSource.WriteError(
this.logSourceId,
"Unable to decode ETW event. The event will be skipped. Event ID: {0}, Task: {1}, Level: {2}.",
eventRecord.EventHeader.EventDescriptor.Id,
eventRecord.EventHeader.EventDescriptor.Task,
eventRecord.EventHeader.EventDescriptor.Level);
}
return(false);
}
if (eventDefinition.IsChildEvent)
{
// Try to format the event. This causes the ETL reader to save information
// about this event. That information is later retrieved when the parent
// event is processed.
string childEventType;
string childEventText;
var childStringRepresentation = this.etwManifestCache.FormatEvent(
eventRecord,
out childEventType,
out childEventText);
// Only parent events can be decoded. Child events supply additional
// information about the parent event and cannot be decoded on their
// own.
return(false);
}
decodedEvent.TaskName = eventDefinition.TaskName;
}
else
{
decodedEvent.TaskName = EventFormatter.StringEventTaskName;
}
decodedEvent.Timestamp = DateTime.FromFileTimeUtc(eventRecord.EventHeader.TimeStamp);
decodedEvent.Level = eventRecord.EventHeader.EventDescriptor.Level;
decodedEvent.ThreadId = eventRecord.EventHeader.ThreadId;
decodedEvent.ProcessId = eventRecord.EventHeader.ProcessId;
decodedEvent.StringRepresentation = this.etwManifestCache.FormatEvent(
eventRecord,
out decodedEvent.EventType,
out decodedEvent.EventText);
if (null == decodedEvent.StringRepresentation)
{
if (!EventSourceHelper.CheckForDynamicManifest(eventRecord.EventHeader.EventDescriptor))
{
// We couldn't decode this event. Skip it.
this.traceSource.WriteError(
this.logSourceId,
"Unable to decode ETW event. The event will be skipped. Event ID: {0}, Task: {1}, Level: {2}.",
eventRecord.EventHeader.EventDescriptor.Id,
eventRecord.EventHeader.EventDescriptor.Task,
eventRecord.EventHeader.EventDescriptor.Level);
return(false);
}
}
// If this is an FMM event, update the last timestamp of FMM events
if ((WinFabricEtlType.DefaultEtl == this.windowsFabricEtlType) &&
decodedEvent.TaskName.Equals(Utility.FmmTaskName))
{
Utility.LastFmmEventTimestamp = decodedEvent.Timestamp;
}
return(true);
}