private bool DecodeEvent(EventRecord eventRecord, out DecodedEtwEvent decodedEvent)
{
decodedEvent = new DecodedEtwEvent {
EventRecord = eventRecord
};
if (false == ManifestCache.IsStringEvent(eventRecord))
{
var eventDefinition = this.etwManifestCache.GetEventDefinition(
eventRecord);
if (null == eventDefinition)
{
if (!EventSourceHelper.CheckForDynamicManifest(eventRecord.EventHeader.EventDescriptor))
{
// We couldn't decode this event. Skip it.
this.traceSource.WriteError(
this.logSourceId,
"Unable to decode ETW event. The event will be skipped. Event ID: {0}, Task: {1}, Level: {2}.",
eventRecord.EventHeader.EventDescriptor.Id,
eventRecord.EventHeader.EventDescriptor.Task,
eventRecord.EventHeader.EventDescriptor.Level);
}
return(false);
}
if (eventDefinition.IsChildEvent)
{
// Try to format the event. This causes the ETL reader to save information
// about this event. That information is later retrieved when the parent
// event is processed.
string childEventType;
string childEventText;
var childStringRepresentation = this.etwManifestCache.FormatEvent(
eventRecord,
out childEventType,
out childEventText);
// Only parent events can be decoded. Child events supply additional
// information about the parent event and cannot be decoded on their
// own.
return(false);
}
decodedEvent.TaskName = eventDefinition.TaskName;
}
else
{
decodedEvent.TaskName = EventFormatter.StringEventTaskName;
}
decodedEvent.Timestamp = DateTime.FromFileTimeUtc(eventRecord.EventHeader.TimeStamp);
decodedEvent.Level = eventRecord.EventHeader.EventDescriptor.Level;
decodedEvent.ThreadId = eventRecord.EventHeader.ThreadId;
decodedEvent.ProcessId = eventRecord.EventHeader.ProcessId;
decodedEvent.StringRepresentation = this.etwManifestCache.FormatEvent(
eventRecord,
out decodedEvent.EventType,
out decodedEvent.EventText);
if (null == decodedEvent.StringRepresentation)
{
if (!EventSourceHelper.CheckForDynamicManifest(eventRecord.EventHeader.EventDescriptor))
{
// We couldn't decode this event. Skip it.
this.traceSource.WriteError(
this.logSourceId,
"Unable to decode ETW event. The event will be skipped. Event ID: {0}, Task: {1}, Level: {2}.",
eventRecord.EventHeader.EventDescriptor.Id,
eventRecord.EventHeader.EventDescriptor.Task,
eventRecord.EventHeader.EventDescriptor.Level);
return(false);
}
}
// If this is an FMM event, update the last timestamp of FMM events
if ((WinFabricEtlType.DefaultEtl == this.windowsFabricEtlType) &&
decodedEvent.TaskName.Equals(Utility.FmmTaskName))
{
Utility.LastFmmEventTimestamp = decodedEvent.Timestamp;
}
return(true);
}
private void ProcessEtwEvent(EventRecord eventRecord, EtwEventTimestamp eventTimestamp)
{
try
{
// Get the event definition
EventDefinition eventDefinition = this.manifestCache.GetEventDefinition(
eventRecord);
// Ignore event source manifests and heartbeat events
if ((eventDefinition == null && eventRecord.EventHeader.EventDescriptor.Id == 0) ||
EventSourceHelper.CheckForDynamicManifest(eventRecord.EventHeader.EventDescriptor))
{
return;
}
bool unexpectedEvent = false;
if (eventDefinition.TaskName.Equals(HostingTaskName))
{
// Verify event name
if (eventDefinition.EventName.Equals(ServicePackageActivatedEventName))
{
this.ProcessServicePackageActiveEvent(
eventRecord,
eventDefinition.TaskName,
eventDefinition.EventName,
eventTimestamp,
MaxServicePackageActivatedEventVersion);
}
else if (eventDefinition.EventName.Equals(ServicePackageUpgradedEventName))
{
this.ProcessServicePackageActiveEvent(
eventRecord,
eventDefinition.TaskName,
eventDefinition.EventName,
eventTimestamp,
MaxServicePackageUpgradedEventVersion);
}
else if (eventDefinition.EventName.Equals(ServicePackageDeactivatedEventName))
{
this.ProcessServicePackageInactiveEvent(
eventRecord,
eventDefinition.TaskName,
eventDefinition.EventName,
eventTimestamp,
false);
}
else
{
unexpectedEvent = true;
}
}
else if (eventDefinition.TaskName.Equals(DcaTaskName))
{
if (eventDefinition.EventName.Equals(ServicePackageInactiveEventName))
{
this.ProcessServicePackageInactiveEvent(
eventRecord,
eventDefinition.TaskName,
eventDefinition.EventName,
eventTimestamp,
true);
}
else
{
unexpectedEvent = true;
}
}
else
{
unexpectedEvent = true;
}
if (unexpectedEvent)
{
Utility.TraceSource.WriteWarning(
TraceType,
"Unexpected event (task name {0}, event name {1}) encountered. Event will be ignored.",
eventDefinition.TaskName,
eventDefinition.EventName);
}
}
catch (Exception e)
{
Utility.TraceSource.WriteError(
TraceType,
"Exception encountered while processing event with ID {0}, Task {1}. Exception information: {2}.",
eventRecord.EventHeader.EventDescriptor.Id,
eventRecord.EventHeader.EventDescriptor.Task,
e);
}
}