/// <summary> /// Method to read ETW event as per the metadata stored in this class /// </summary> /// <param name="e">The ETW native event helper class for one-time read</param> /// <returns></returns> public IDictionary <string, object> Deserialize(ref EtwNativeEvent e) { Dictionary <string, object> instance = new Dictionary <string, object>(_template); instance.Add("EventId", e.Id); instance.Add("Version", e.Version); instance.Add("TimeCreated", e.TimeStamp.DateTime); instance.Add("ProcessId", e.ProcessId); instance.Add("ThreadId", e.ThreadId); instance.Add("ActivityId", e.ActivityId); Dictionary <string, object> eventData = new Dictionary <string, object>(); List <object> values = new List <object>(); foreach (var p in _properties) { uint len = p.Length; if (p.LengthPropertyName != null) { len = (uint)eventData[p.LengthPropertyName]; } object value = GetValue(p.Type, len, ref e); value = FormatValue(p, value); value = EtwTdhPostFormat.ApplyFormatting(e.ProviderId, e.Id, p.Name, value); eventData.Add(p.Name, value); values.Add(value); } instance.Add("EventData", eventData); if (_formatString == null) { instance.Add("Message", null); } else { string message = String.Format(_formatString, values.ToArray()); instance.Add("Message", message); } return(instance); }
/// <summary> /// Method to read ETW event as per the metadata stored in this class /// </summary> /// <param name="e">The ETW native event helper class for one-time read</param> /// <returns></returns> public IDictionary <string, object> Deserialize(ref EtwNativeEvent e) { Dictionary <string, object> instance = new Dictionary <string, object>(_template) { { "EventId", e.Id }, { "Version", e.Version }, { "TimeCreated", e.TimeStamp.UtcDateTime }, { "ProcessId", e.ProcessId }, { "ThreadId", e.ThreadId }, { "ActivityId", e.ActivityId } }; Dictionary <string, object> eventData = new Dictionary <string, object>(); List <object> values = new List <object>(); foreach (var p in _properties) { uint len = p.Length; if (p.LengthPropertyName != null) { try { string num = Convert.ToString(eventData[p.LengthPropertyName]); if (num.StartsWith("0x", StringComparison.CurrentCultureIgnoreCase)) { num = num.Substring(2); len = uint.Parse(num, System.Globalization.NumberStyles.HexNumber); } else { len = Convert.ToUInt32(num); } } catch (Exception ex) { ex.Data["ProviderGuid"] = e.ProviderId; throw; } } try { object value = GetValue(p.Type, len, ref e); value = FormatValue(p, value); value = EtwTdhPostFormat.ApplyFormatting(e.ProviderId, e.Id, p.Name, value); eventData.Add(p.Name, value); values.Add(value); } catch (Exception) { eventData.Add(p.Name, "Exception on retrieving value"); } } instance.Add("EventData", eventData); if (_formatString == null) { instance.Add("Message", null); } else { string message = string.Format(_formatString, values.ToArray()); instance.Add("Message", message); } return(instance); }