private static NativeMethods.EventTraceProperties ControlTrace( string sessionName, NativeMethods.TraceControl traceControl, out int errorCode) { lock (sharedBufferLock) { var traceProperties = new NativeMethods.EventTraceProperties { LoggerNameOffset = TracePropertiesSize, LogFileNameOffset = TracePropertiesSize + (MaxNameSize * sizeof(char)), Wnode = new NativeMethods.WnodeHeader { BufferSize = TracePropertiesSize + ExtSize, } }; NativeMethods.ZeroMemory(sharedBuffer, traceProperties.Wnode.BufferSize); Marshal.StructureToPtr(traceProperties, sharedBuffer, true); errorCode = NativeMethods.ControlTrace( 0, sessionName, sharedBuffer, (uint)traceControl); traceProperties = (NativeMethods.EventTraceProperties)Marshal.PtrToStructure( sharedBuffer, typeof(NativeMethods.EventTraceProperties)); return(traceProperties); } }
public static NativeMethods.EventTraceProperties GetProperties(string sessionName, Guid providerGuid, string path) { NativeMethods.EventTraceProperties properties = new NativeMethods.EventTraceProperties(); NativeMethods.LogFileMode fileMode = NativeMethods.LogFileMode.EVENT_TRACE_FILE_MODE_NEWFILE; properties.etp.wnode.bufferSize = (uint)Marshal.SizeOf(properties); properties.etp.wnode.guid = providerGuid; properties.etp.wnode.flags = NativeMethods.WnodeFlagTracedGuid; properties.etp.wnode.clientContext = 1; // Query performance counter for time stamp properties.etp.bufferSize = 64; properties.etp.minimumBuffers = 10; properties.etp.maximumBuffers = 10; properties.etp.maximumFileSize = 10 * 1024; properties.etp.logFileMode = (uint)(fileMode | NativeMethods.LogFileMode.EVENT_TRACE_USE_PAGED_MEMORY | NativeMethods.LogFileMode.EVENT_TRACE_USE_LOCAL_SEQUENCE); properties.etp.flushTimer = (uint)10; properties.etp.enableFlags = 0; properties.etp.logFileNameOffset = (uint)Marshal.OffsetOf(typeof(NativeMethods.EventTraceProperties), "logFileName"); properties.etp.loggerNameOffset = (uint)Marshal.OffsetOf(typeof(NativeMethods.EventTraceProperties), "loggerName"); properties.logFileName = path; properties.loggerName = sessionName; return(properties); }
public static bool TryGetCurrentFileOfSession(string sessionName, out string currentSessionFile) { currentSessionFile = null; lock (sharedBufferLock) { var traceProperties = new NativeMethods.EventTraceProperties { LoggerNameOffset = TracePropertiesSize, LogFileNameOffset = TracePropertiesSize + (MaxNameSize * sizeof(char)), Wnode = new NativeMethods.WnodeHeader { BufferSize = TracePropertiesSize + ExtSize, } }; NativeMethods.ZeroMemory(sharedBuffer, traceProperties.Wnode.BufferSize); Marshal.StructureToPtr(traceProperties, sharedBuffer, true); var errorCode = NativeMethods.ControlTrace( 0, sessionName, sharedBuffer, (int)NativeMethods.TraceControl.Query); var tracePropertiesPtr = (NativeMethods.EventTraceProperties *)sharedBuffer; if (errorCode == NativeMethods.ErrorSuccess && tracePropertiesPtr->LogFileNameOffset > 0) { currentSessionFile = new string((char *)(tracePropertiesPtr + (int)tracePropertiesPtr->LogFileNameOffset)); } return(errorCode == NativeMethods.ErrorSuccess && currentSessionFile != null); } }
public static NativeMethods.EventTraceProperties GetProperties(string sessionName, Guid providerGuid, string path) { NativeMethods.EventTraceProperties properties = new NativeMethods.EventTraceProperties(); NativeMethods.LogFileMode fileMode = NativeMethods.LogFileMode.EVENT_TRACE_FILE_MODE_NEWFILE; properties.etp.wnode.bufferSize = (uint)Marshal.SizeOf(properties); properties.etp.wnode.guid = providerGuid; properties.etp.wnode.flags = NativeMethods.WnodeFlagTracedGuid; properties.etp.wnode.clientContext = 1; // Query performance counter for time stamp properties.etp.bufferSize = 64; properties.etp.minimumBuffers = 10; properties.etp.maximumBuffers = 10; properties.etp.maximumFileSize = 10 * 1024; properties.etp.logFileMode = (uint)(fileMode | NativeMethods.LogFileMode.EVENT_TRACE_USE_PAGED_MEMORY | NativeMethods.LogFileMode.EVENT_TRACE_USE_LOCAL_SEQUENCE); properties.etp.flushTimer = (uint)10; properties.etp.enableFlags = 0; properties.etp.logFileNameOffset = (uint)Marshal.OffsetOf(typeof(NativeMethods.EventTraceProperties), "logFileName"); properties.etp.loggerNameOffset = (uint)Marshal.OffsetOf(typeof(NativeMethods.EventTraceProperties), "loggerName"); properties.logFileName = path; properties.loggerName = sessionName; return properties; }
/// <summary> /// Attempts to retrieve the properties (including status) of the given ETW session. /// </summary> /// <param name="sessionName"> /// The name for the session which the caller wants to retrieve the properties. /// </param> /// <param name="traceProperties"> /// The <see cref="NativeMethods.EventTraceProperties"/> instance describing the session passed /// by the caller. It contains valid data only if the method returns true;. /// </param> /// <returns> /// True if the function retrieved the session properties, false otherwise. /// </returns> public static bool TryGetSessionProperties(string sessionName, out NativeMethods.EventTraceProperties traceProperties) { int result; traceProperties = ControlTrace(sessionName, NativeMethods.TraceControl.Query, out result); return(result == NativeMethods.ErrorSuccess); }
static void Main(string[] args) { string sessionName = "myEtlSession"; Guid providerGuid = Guid.NewGuid(); NativeMethods.EventTraceProperties properties = Program.GetProperties( sessionName, providerGuid, Utils.GetFilePath("MyEtlFile_%d.etl")); long sessionHandle = 0; long eventRegisterHandle = 0; try { Utils.RunWithErrorCodeCheck(() => NativeMethods.StartTrace(out sessionHandle, sessionName, ref properties)); // This call associates a specific trace provider with an etl session. NativeMethods.EnableTraceParameters enableParameters = new NativeMethods.EnableTraceParameters(); enableParameters.Version = NativeMethods.ENABLE_TRACE_PARAMETERS_VERSION; enableParameters.SourceId = providerGuid; enableParameters.ControlFlags = 0; unsafe { Utils.RunWithErrorCodeCheck(() => NativeMethods.EventRegister(ref providerGuid, null, null, ref eventRegisterHandle)); Utils.RunWithErrorCodeCheck(() => NativeMethods.EnableTraceEx2( sessionHandle, ref providerGuid, (uint)NativeMethods.EnableTraceControlCode.Enable, (byte)NativeMethods.TraceLevel.Verbose, 0, 0, 1000, ref enableParameters)); string myData = "Hello world"; int dataLength = Encoding.ASCII.GetByteCount(myData) + sizeof(byte); byte[] buffer = new byte[dataLength]; Encoding.ASCII.GetBytes(myData, 0, myData.Length, buffer, 0); fixed(byte *nativeBuffer = buffer) { NativeMethods.EventDefinition eventDefinition = new NativeMethods.EventDefinition(); NativeMethods.EventData * eventData = stackalloc NativeMethods.EventData[1]; eventData[0].DataPointer = (IntPtr)nativeBuffer; eventData[0].Size = dataLength; Utils.RunWithErrorCodeCheck(() => NativeMethods.EventWrite( eventRegisterHandle, ref eventDefinition, 1, eventData)); } } } finally { Utils.RunWithErrorCodeCheck(() => NativeMethods.EventUnregister(eventRegisterHandle)); Utils.RunWithErrorCodeCheck(() => NativeMethods.ControlTrace( 0, // sessionHandle sessionName, ref properties, (uint)NativeMethods.ControlTraceCode.Stop)); } }
private static void Main(string[] args) { /*using (MyEventListener myListener = new MyEventListener()) * using (MyEventSource source = new MyEventSource()) * { * myListener.EnableEvents(source, EventLevel.Verbose); * if (source.ConstructionException != null) * { * throw source.ConstructionException; * } * * source.String("Hello world"); * source.Int(10); * source.Bool(true); * }*/ /*string sessionName = "MySession"; * using (MyEventSource source = new MyEventSource()) * using (TraceEventSession session = new TraceEventSession(sessionName, null)) // the null second parameter means 'real time session' * using (ETWTraceEventSource eventSource = new ETWTraceEventSource(sessionName, TraceEventSourceType.Session)) * { * DynamicTraceEventParser parser = new DynamicTraceEventParser(eventSource); * parser.All += delegate(TraceEvent data) * { * Console.WriteLine("Event name:{0}. Payload:{1}.", data.EventName, data.PayloadValue(0)); * }; * * session.EnableProvider(source.Guid); * source.String("Hello world"); * source.Int(123); * eventSource.Process(); * }*/ string sessionName = "myEtlSession"; NativeMethods.EventTraceProperties properties = Program.GetProperties( sessionName, Program.providerGuid, @"C:\Users\ulka\Documents\MyEtlFile_%d.etl"); //Path.Combine(Assembly.GetExecutingAssembly().Location, "MyEtlFile1_%d.etl")); long sessionHandle = 0; long eventRegisterHandle = 0; try { uint errorCode = NativeMethods.StartTrace(out sessionHandle, sessionName, ref properties); // This call associates a specific trace provider with an etl session. NativeMethods.EnableTraceParameters enableParameters = new NativeMethods.EnableTraceParameters(); enableParameters.Version = NativeMethods.ENABLE_TRACE_PARAMETERS_VERSION; enableParameters.SourceId = Program.providerGuid; enableParameters.ControlFlags = 0; unsafe { Guid providerGuid = Program.providerGuid; errorCode = NativeMethods.EventRegister(ref providerGuid, null, null, ref eventRegisterHandle); errorCode = NativeMethods.EnableTraceEx2( sessionHandle, ref providerGuid, (uint)NativeMethods.EnableTraceControlCode.Enable, (byte)NativeMethods.TraceLevel.Verbose, 0, 0, 1000, ref enableParameters); string myData = "Hello world"; int dataLength = Encoding.ASCII.GetByteCount(myData) + sizeof(byte); byte[] buffer = new byte[dataLength]; Encoding.ASCII.GetBytes(myData, 0, myData.Length, buffer, 0); fixed(byte *nativeBuffer = buffer) { NativeMethods.EventDefinition eventDefinition = new NativeMethods.EventDefinition(); NativeMethods.EventData * eventData = stackalloc NativeMethods.EventData[1]; eventData[0].DataPointer = (IntPtr)nativeBuffer; eventData[0].Size = dataLength; errorCode = NativeMethods.EventWrite( eventRegisterHandle, ref eventDefinition, 1, eventData); } } } finally { uint errorCode = NativeMethods.EventUnregister(eventRegisterHandle); errorCode = NativeMethods.ControlTrace( 0, // sessionHandle sessionName, ref properties, (uint)NativeMethods.ControlTraceCode.Stop); } NativeMethods.EventTraceLogfile eventTraceLogfile = new NativeMethods.EventTraceLogfile(); eventTraceLogfile.LogFileName = @"C:\Users\ulka\Documents\MyEtlFile_1.etl"; eventTraceLogfile.LogFileMode = NativeMethods.ProcessTraceMode.PROCESS_TRACE_MODE_EVENT_RECORD; eventTraceLogfile.BufferCallback = BufferCallback; eventTraceLogfile.EventCallback.EventRecord = EventRecord; long traceHandle = -1; try { traceHandle = NativeMethods.OpenTrace(ref eventTraceLogfile); uint hresult = NativeMethods.ProcessTrace(new long[] { traceHandle }, 1, IntPtr.Zero, IntPtr.Zero); } finally { NativeMethods.CloseTrace(traceHandle); } }
static void Main(string[] args) { string sessionName = "myEtlSession"; NativeMethods.EventTraceProperties properties = Program.GetProperties( sessionName, Program.providerGuid, Utils.GetFilePath("MyEtlFile_%d.etl")); long sessionHandle = 0; long eventRegisterHandle = 0; try { Utils.RunWithErrorCodeCheck(() => NativeMethods.StartTrace(out sessionHandle, sessionName, ref properties)); NativeMethods.EnableTraceParameters enableParameters = new NativeMethods.EnableTraceParameters(); enableParameters.Version = NativeMethods.ENABLE_TRACE_PARAMETERS_VERSION; enableParameters.SourceId = Program.providerGuid; enableParameters.ControlFlags = 0; unsafe { Guid providerGuid = Program.providerGuid; Utils.RunWithErrorCodeCheck(() => NativeMethods.EventRegister(ref providerGuid, null, null, ref eventRegisterHandle)); Utils.RunWithErrorCodeCheck(() => NativeMethods.EnableTraceEx2( sessionHandle, ref providerGuid, (uint)NativeMethods.EnableTraceControlCode.Enable, (byte)NativeMethods.TraceLevel.Verbose, 0, 0, 1000, ref enableParameters)); string myData = "Hello world"; int dataLength = Encoding.ASCII.GetByteCount(myData) + sizeof(byte); byte[] buffer = new byte[dataLength]; Encoding.ASCII.GetBytes(myData, 0, myData.Length, buffer, 0); fixed(byte *nativeBuffer = buffer) { NativeMethods.EventDefinition eventDefinition = new NativeMethods.EventDefinition(); NativeMethods.EventData * eventData = stackalloc NativeMethods.EventData[1]; eventData[0].DataPointer = (IntPtr)nativeBuffer; eventData[0].Size = dataLength; Utils.RunWithErrorCodeCheck(() => NativeMethods.EventWrite( eventRegisterHandle, ref eventDefinition, 1, eventData)); } } } finally { Utils.RunWithErrorCodeCheck(() => NativeMethods.EventUnregister(eventRegisterHandle)); Utils.RunWithErrorCodeCheck(() => NativeMethods.ControlTrace( 0, // sessionHandle sessionName, ref properties, (uint)NativeMethods.ControlTraceCode.Stop)); } NativeMethods.EventTraceLogfile eventTraceLogfile = new NativeMethods.EventTraceLogfile(); eventTraceLogfile.LogFileName = Utils.GetFilePath("MyEtlFile_1.etl"); eventTraceLogfile.LogFileMode = NativeMethods.ProcessTraceMode.PROCESS_TRACE_MODE_EVENT_RECORD; eventTraceLogfile.BufferCallback = BufferCallback; eventTraceLogfile.EventCallback.EventRecord = EventRecord; long traceHandle = -1; try { traceHandle = NativeMethods.OpenTrace(ref eventTraceLogfile); Utils.RunWithErrorCodeCheck(() => NativeMethods.ProcessTrace(new long[] { traceHandle }, 1, IntPtr.Zero, IntPtr.Zero)); } finally { Utils.RunWithErrorCodeCheck(() => NativeMethods.CloseTrace(traceHandle)); } }