protected override void Capture(TraceEventSession session)
{
session.EnableKernelProvider(KernelTraceEventParser.Keywords.NetworkTCPIP, KernelTraceEventParser.Keywords.NetworkTCPIP);
//TraceLogEventSource is required on win 7
//see: https://github.com/Microsoft/dotnetsamples/blob/master/Microsoft.Diagnostics.Tracing/TraceEvent/TraceEvent/41_TraceLogMonitor.cs
using (TraceLogEventSource traceLogSource = TraceLog.CreateFromTraceEventSession(session))
{
//two events in a row for same process and IP/port means failure.
//It could be a firewall intervention, silently droping packets to that destination
//or the end service is down.
traceLogSource.Kernel.TcpIpReconnect += (TcpIpTraceData data) =>
{
try
{
_sender.Send(data.ProcessID, data.daddr + ":" + data.dport, TCP_RECONNECT);
}
catch (Exception)
{
//TODO: log it
//TODO: check all Exceptions that can be thrown by the _sender instance.
throw;
}
};
traceLogSource.Kernel.TcpIpConnect += (TcpIpConnectTraceData data) =>
{
try
{
_sender.Send(data.ProcessID, data.ToXml(new System.Text.StringBuilder()).ToString(), TCP_CONNECT);
}
catch (Exception)
{
//TODO: log it
//TODO: check all Exceptions that can be thrown by the _sender instance.
throw;
}
};
traceLogSource.Kernel.TcpIpDisconnect += (TcpIpTraceData data) =>
{
try
{
_sender.Send(data.ProcessID, data.ToXml(new System.Text.StringBuilder()).ToString(), TCP_CONNECT);
}
catch (Exception)
{
//TODO: log it
//TODO: check all Exceptions that can be thrown by the _sender instance.
throw;
}
};
traceLogSource.Process();
}
}
protected override bool OnStart()
{
if (_session != null)
{
throw new InvalidOperationException("Profiling session already started...");
}
string sessionName = "LiveCpu_Profiling_Session+" + Guid.NewGuid().ToString();
_session = new TraceEventSession(sessionName, TraceEventSessionOptions.Create);
if (!EnableProviders(_session))
{
_session.Dispose();
_session = null;
return(false);
}
_profilingTask = Task.Factory.StartNew(() =>
{
using (TraceLogEventSource source = TraceLog.CreateFromTraceEventSession(_session))
{
// CPU sampling kernel events
source.Kernel.PerfInfoSample += (SampledProfileTraceData data) =>
{
if (data.ProcessID != Pid)
{
return;
}
var callstack = data.CallStack();
if (callstack == null)
{
return;
}
MergeCallStack(callstack, Reader);
};
// this call exits when the session is stopped
source.Process();
}
});
return(true);
}
