/// <summary>
        /// ctor.
        /// </summary>
        /// <param name="sessionName">Name of the session.</param>
        /// <param name="guid">The GUID.</param>
        public EtwTraceController(string sessionName, Guid guid)
        {
            Debug.Assert(!String.IsNullOrEmpty(sessionName), "!String.IsNullOrEmpty(sessionName)");
            CDFMonitor.LogOutputHandler("DEBUG:EtwTraceController.ctor: new trace:" + sessionName);
            _sessionName = sessionName;
            if (String.Compare(_sessionName, Properties.Resources.KernelSessionName, true) == 0)
            {
                // then its a controller for kernel
                _isKernelController = true;
            }

            //_strguid = strGUID;
            _guid = new NativeMethods.publicGuid(guid.ToByteArray());
        }
Beispiel #2
0
 /// <summary>
 /// Initializes a new instance of the <see cref="EtwTraceWriter" /> class.
 /// </summary>
 public EtwTraceWriter()
 {
     // EventRegister only works on vista+ no xp or 2k3
     if (CDFMonitor.Instance.Config.IsWinVistaOrHigher())
     {
         NativeMethods.publicGuid guid = new NativeMethods.publicGuid(EtwTraceGuid.ToByteArray());
         uint ret2 = EventRegister(ref guid, IntPtr.Zero, IntPtr.Zero, ref _traceHandle);
         Debug.Print("DEBUG:EtwTraceWriter:eventregister return:" + ret2.ToString());
         _writerDisabled = false;
     }
     else
     {
         Debug.Print("DEBUG:EtwTraceWriter:eventregister not supported.");
     }
 }
        /// <summary>
        /// Enable/Disable the ETW session.
        /// </summary>
        /// <param name="enable">Indicates if the session should be enabled or disabled</param>
        /// <param name="strguid">The strguid.</param>
        /// <returns><c>true</c> if XXXX, <c>false</c> otherwise</returns>
        public bool EnableTrace(bool enable, string strguid)
        {
            Debug.Assert(!_isKernelController, "!_isKernelController");
            NativeMethods.publicGuid guid = new NativeMethods.publicGuid();
            try
            {
                CDFMonitor.LogOutputHandler(string.Format("DEBUG:EnableTrace:enabling trace:strguid:{0}", strguid));
                guid = new NativeMethods.publicGuid(new Guid(strguid).ToByteArray());
                Debug.Assert(_handle != 0 && NativeMethods.IsValidHandle(_handle),
                             "_handle != 0 && NativeMethods.IsValidHandle(_handle)");

                NativeMethods.EventTraceProperties properties = CommonEventTraceProperties();

                if (properties.EnableFlags != 0)
                {
                    CDFMonitor.LogOutputHandler(string.Format("EnableTrace:KernelFlags configured/enabled. overriding EnableFlags and modules. returning:{0}", strguid));
                    return(true);
                }

                uint flags         = 0xffffffff;
                uint processResult = NativeMethods.EnableTrace(enable ? 1U : 0U, flags /* enableFlag */, (uint)CDFMonitor.Instance.Config.AppSettings.LogLevel /* enableLevel */, ref guid, _handle);

                if (processResult != NativeMethods.ERROR_SUCCESS &&
                    processResult != NativeMethods.ERROR_CANCELLED)
                {
                    CDFMonitor.LogOutputHandler("DEBUG:EnableTrace:enabling trace error:" + processResult.ToString());
                    return(false);
                }

                return(true);
            }
            catch (Exception e)
            {
                CDFMonitor.LogOutputHandler(string.Format("EnableTrace: exception enabling trace error:{0} guid:{1}", e, guid.ToString()));
                return(false);
            }
        }
Beispiel #4
0
 public static extern uint EventRegister([In] ref NativeMethods.publicGuid eventTraceProvider, IntPtr enableCallBackNotUsed, IntPtr pcallbackContextNotUsed, ref long traceHandle);