internal static ulong OpenTraceFile(ref TraceEventInterop.EVENT_TRACE_LOGFILEW logFile) { logFile.LogFileMode = PROCESS_TRACE_MODE_EVENT_RECORD | PROCESS_TRACE_MODE_RAW_TIMESTAMP; ulong handle = TraceEventInterop.OpenTrace(ref logFile); if (handle == INVALID_HANDLE_VALUE) { Marshal.ThrowExceptionForHR(TraceEventInterop.GetHRForLastWin32Error()); } return(handle); }
private void ProcessTrace() { m_eventCount = 0; UInt64[] handles = new UInt64[1]; handles[0] = m_handle; // have to pass in an array, even though we only have one handle int dwErr = TraceEventInterop.ProcessTrace(handles, 1, IntPtr.Zero, IntPtr.Zero); m_traceCompleted = true; Close(); if (dwErr == 6) { throw new ApplicationException("Error opening ETL file. Most likely caused by opening a Win8 Trace on a Pre Win8 OS."); } }
public void Close() // call after all reads have completed or upon exception { TraceEventInterop.CloseTrace(ref m_handle); // worst case scenario, process exit will do this }