Ejemplo n.º 1
0
        /// <summary>
        /// Creates a listener to ETW real-time session for BinaryEnvelope events. These Events have EventId 0, 1 and 2.
        /// and belong to specified provider.
        /// </summary>
        /// <param name="providerId">Identifier of ETW provider.</param>
        /// <param name="sessionName">Session name.</param>
        /// <returns>Sequence of events ordered by timestamp.</returns>
        public static IObservable <IEnvelope> FromSession(
            Guid providerId,
            string sessionName)
        {
            var parser = new BinaryEtwParser(providerId);

            var etwObservable = EtwObservable.FromSession(sessionName);

            return(etwObservable
                   .Select(parser.Parse)
                   .Where(item => item != null));
        }
Ejemplo n.º 2
0
        /// <summary>
        /// Takes an array of files and creates an observer that retrieves all BinaryEnvelope type events. These Events have EventId 0, 1 and 2.
        /// and belong to specified provider.
        /// </summary>
        /// <param name="providerId">Identifier of ETW provider.</param>
        /// <param name="useSequentialReader">Flag to specify if the input ETL files are already ordered by timestamp.</param>
        /// <param name="startTime">Start time of sequence of events, if null then DateTime.MinValue will be used.</param>
        /// <param name="endTime">End time of sequence of events, if null then DateTime.MaxValue will be used.</param>
        /// <param name="files">Either unlimited number of ETL files containing events ordered by timestamp or up to 63 files to read.</param>
        /// <returns>Sequence of events ordered by timestamp.</returns>
        public static IObservable <IEnvelope> FromFiles(
            Guid providerId,
            bool useSequentialReader,
            DateTime?startTime,
            DateTime?endTime,
            params string[] files)
        {
            var parser = new BinaryEtwParser(providerId);

            var etwObservable = CreateEtwObservable(useSequentialReader, startTime, endTime, files);

            return(etwObservable
                   .Select(parser.Parse)
                   .Where(item => item != null));
        }
Ejemplo n.º 3
0
        public static IObservable<EventManifest> BinaryManifestFromFiles(
            Guid providerId,
            bool useSequentialReader,
            DateTime? startTime, 
            DateTime? endTime, 
            params string[] files)
        {
            var parser = new BinaryEtwParser(providerId);

            var etwObservable = CreateEtwObservable(useSequentialReader, startTime, endTime, files);

            return etwObservable
                .Select(parser.ParseManifest)
                .Where(item => item != null);
        }
Ejemplo n.º 4
0
        /// <summary>
        /// Creates a listener to ETW real-time session for BinaryEnvelope events. These Events have EventId 0, 1 and 2.
        /// and belong to specified provider.
        /// </summary>
        /// <param name="providerId">Identifier of ETW provider.</param>
        /// <param name="sessionName">Session name.</param>
        /// <returns>Sequence of events ordered by timestamp.</returns>
        public static IObservable<IEnvelope> FromSession(
            Guid providerId,
            string sessionName)
        {
            var parser = new BinaryEtwParser(providerId);

            var etwObservable = EtwObservable.FromSession(sessionName);

            return etwObservable
                .Select(parser.Parse)
                .Where(item => item != null);
        }