Represents a tracing event originated in a trace source.
        static ETWEvent FromTraceEvent(TraceEvent item, Dictionary<string,string> additionalProperties)
        {
            var data = new Dictionary<string, object>();

            for (var i = 0; i < item.PayloadNames.Length; i++)
                data.Add(item.PayloadNames[i], item.PayloadValue(i));

            if (additionalProperties != null)
            {
                foreach (var property in additionalProperties)
                {
                    if (!data.ContainsKey(property.Key))
                        data.Add(property.Key, property.Value);
                }
            }

            return new ETWEvent
            {
                Provider = item.ProviderName,
                EventName = item.EventName,
                EventId = (ushort)item.ID,
                Message = item.FormattedMessage ?? "none",
                Level = item.Level.ToString(),
                ActivityId = item.ActivityID,
                Timestamp = item.TimeStamp.ToUniversalTime(),
                Fields = data
            };
        }
        unsafe protected override DynamicTraceEventData TryLookup(TraceEvent unknownEvent)
        {
            // WPP is always classic 
            if (unknownEvent.ClassicProvider)
            {
                var taskGuid = unknownEvent.taskGuid;
                var tmfPath = GetTmfPathForTaskGuid(taskGuid);
                if (tmfPath != null)
                {
                    var templates = CreateTemplatesForTMFFile(taskGuid, tmfPath);

                    // Register all the templates in the file, and if we found the specific one we are looking for return that one. 
                    DynamicTraceEventData ret = null;
                    foreach (var template in templates)
                    {
                        if (template.eventID == unknownEvent.eventID)
                            ret = template;
                        else
                            RegisterTemplate(template);
                    }
                    // If we fail, remove the file so we don't continually try to parse the file.  
                    if (ret == null)
                        m_tmfDataFilePathsByFileNameBase[taskGuid.ToString()] = null;
                    return ret;
                }
            }
            return null;
        }
 public ThreadLifetime(TraceEvent sw, ThreadLifetimeType state)
 {
     // Old thread id & process id
     this.ProcessorNumber = sw.ProcessorNumber;
     this.TimeStamp = sw.TimeStamp;
     this.TimeStamp100ns = sw.TimeStamp100ns;
     this.ThreadId = sw.ThreadID;
     this.ProcessId = sw.ProcessID;
     this.State = state;
 }
        public PSTraceEvent(TraceEvent traceEvent, PSHostUserInterface hostUI)
        {
            this.hostUI = hostUI;

            Source = traceEvent;

            TimeStamp = Source.TimeStamp;
            ProcessName = Process.GetProcessById(Source.ProcessID)?.ProcessName ?? "";
            ProviderName = Source.ProviderName;
            EventName = Source.EventName;
            Level = Source.Level;
            PayloadOrMessage = Source.DumpPayloadOrMessage();
        }
 protected override void EnumerateTemplates(Func<string, string, EventFilterResponse> eventsToObserve, Action<TraceEvent> callback)
 {
     if (s_templates == null)
     {
         var templates = new TraceEvent[3];
         templates[0] = EventSourceMessageTemplate(null);
         templates[1] = OnEnterTemplate(null);
         templates[2] = OnLeaveTemplate(null);
         s_templates = templates;
     }
     foreach (var template in s_templates)
         if (eventsToObserve == null || eventsToObserve(template.ProviderName, template.EventName) == EventFilterResponse.AcceptEvent)
             callback(template);
 }
        public ContextSwitch(TraceEvent sw)
        {
            // Old thread id & process id
            this.OldThreadId = (int)sw.PayloadValue(0);
            this.OldProcessId = (int)sw.PayloadValue(1);
            this.NewThreadId = (int)sw.PayloadValue(3);
            this.NewProcessId = (int)sw.PayloadValue(4);
            this.State = (ThreadState)sw.PayloadValue(13);
            this.ProcessorNumber = sw.ProcessorNumber;
            this.TimeStamp = sw.TimeStamp;
            this.TimeStamp100ns = sw.TimeStamp100ns;

            // Multiply by 10 to adjust the time as 100ns
            this.NewThreadWaitTime = (int)sw.PayloadValue(15) * 10;
        }
        public Task<TraceEvent> Process(TraceEvent traceEvent)
        {
            byte[] eventBody = EventToBytes(traceEvent);

              //System.IO.File.WriteAllBytes(String.Format(@"c:\temp\etw\{0}.json", Guid.NewGuid()), eventBody);

              EventData eventData = new EventData(eventBody);
              eventData.PartitionKey = keyGenerator.GetKey(traceEvent);

              if ( !currentBatch.TryAdd(eventData, eventBody.Length) ) {
            // this needs to be an atomic operation!
            var batch = Interlocked.Exchange(ref this.currentBatch, Batch<EventData>.Empty(MaxBatchSize));
            this.batchSender.Send(batch);
              }
              return Task.FromResult(traceEvent);
        }
Exemple #8
0
        public PageFault(TraceEvent ev)
        {
            switch (ev.EventName)
            {
                case "PageFault/DemandZeroFault": this.Type = PageFaultType.Minor; break;
                case "PageFault/HardPageFault": this.Type = PageFaultType.Major; break;
                case "PageFault/HardFault": this.Type = PageFaultType.Major; break;

                default: this.Type = PageFaultType.Unknown; break;
            }

            this.TimeStamp = ev.TimeStamp;
            this.ProcessorNumber = ev.ProcessorNumber;
            this.Process = ev.ProcessID;
            this.Thread = ev.ThreadID;
        }
        public void Trace_CustomProperties()
        {
            TraceEvent capturedEvent = null;
            _mockTraceWriter.Setup(p => p.Trace(It.IsAny<TraceEvent>()))
                .Callback<TraceEvent>(p =>
                {
                    capturedEvent = p;
                });
            _mockTextWriter.Setup(p => p.WriteLine("Test Warning"));

            TraceEvent traceEvent = new TraceEvent(TraceLevel.Warning, "Test Warning", "Test Source");
            traceEvent.Properties.Add("Test", "Test Property");

            _traceWriter.Trace(traceEvent);

            _mockTraceWriter.VerifyAll();
            _mockTextWriter.VerifyAll();

            Assert.Same(traceEvent, capturedEvent);
            Assert.Equal("Test Property", capturedEvent.Properties["Test"]);
        }
        private bool IsInterestingTrace(TraceEvent data)
        {
            // vshub.exe internally uses ApplicationInsights
            if (data.PayloadNames.Length > 1 && data.PayloadString(1) == "vshub.exe")
            {
                return false;
            }

            bool result = false;

            if (data.PayloadNames.Length > 0)
            {
                int id = (int)data.ID;

                // Not system event
                if ((id > 0) && (id < 65534))
                {
                    string domainName = data.PayloadString(data.PayloadNames.Length - 1);
                    result = domainName.StartsWith("/LM/W3SVC");
                }
            }

            return result;
        }
Exemple #11
0
 private void OnEventHelper(TraceEvent data)
 {
     // Ignore manifest events. 
     if ((int)data.ID == 0xFFFE)
         return;
     this.OnEvent(new EtwEvent(data));
 }
 public override void BeginIteration(TraceEvent beginEvent)
 {
     _count = 0;
 }
 public override double EndIteration(TraceEvent endEvent)
 {
     return _count;
 }
 public override object EndIteration(TraceEvent endEvent)
 {
     return _count;
 }
        /// <summary>
        /// Print data.  Note that this method is called FROM DIFFERNET THREADS which means you need to properly
        /// lock any read-write data you access.   It turns out Out.Writeline is already thread safe so
        /// there is nothing I have to do in this case. 
        /// </summary>
        static void Print(TraceEvent data)
        {
            if (s_stopping)        // Ctrl-C will stop the sessions, but buffered events may still come in, ignore these.  
                return;

            // There are a lot of data collection start on entry that I don't want to see (but often they are quite handy
            if (data.Opcode == TraceEventOpcode.DataCollectionStart)
                return;

            Out.WriteLine(data.ToString());
            if (data is UnhandledTraceEvent)
                Out.WriteLine(data.Dump());
        }
        /// <summary>
        /// Print data.  Note that this method is called FROM DIFFERNET THREADS which means you need to properly
        /// lock any read-write data you access.   It turns out Out.Writeline is already thread safe so
        /// there is nothing I have to do in this case. 
        /// </summary>
        static void Print(TraceEvent data, SymbolReader symbolReader)
        {
            // There are a lot of data collection start on entry that I don't want to see (but often they are quite handy
            if (data.Opcode == TraceEventOpcode.DataCollectionStart)
                return;
            // V3.5 runtimes don't log the stack and in fact don't event log the exception name (it shows up as an empty string)
            // Just ignore these as they are not that interesting. 
            if (data is ExceptionTraceData && ((ExceptionTraceData) data).ExceptionType.Length == 0)
                return;

            Out.WriteLine("EVENT: {0}", data.ToString());
            var callStack = data.CallStack();
            if (callStack != null)
            {
                // Because symbol lookup is complex, error prone, and expensive TraceLog requires you to be explicit.  
                // Here we look up names in this call stack using the symbol reader.  
                ResolveNativeCode(callStack, symbolReader);
                Out.WriteLine("CALLSTACK: {0}", callStack.ToString());
            }
        }
            internal unsafe ProviderManifest AddChunk(TraceEvent data)
            {
                //SLAB update
                //removed check to allow recomputing new manifest on any new incoming chunk 
                //if (provider != null)
                //    return null;

                // TODO 
                if (data.EventDataLength <= sizeof(ManifestEnvelope) || data.GetByteAt(3) != 0x5B)  // magic number 
                    return null;

                ushort totalChunks = (ushort)data.GetInt16At(4);
                ushort chunkNum = (ushort)data.GetInt16At(6);
                if (chunkNum >= totalChunks || totalChunks == 0)
                    return null;

                // SLAB update
                if (Chunks == null || (lastChunkReceptionTime.HasValue && lastChunkReceptionTime.Value.Add(ChunkReceptionStalePeriod) < DateTime.Now))
                {
                    format = (ManifestEnvelope.ManifestFormats)data.GetByteAt(0);
                    majorVersion = (byte)data.GetByteAt(1);
                    minorVersion = (byte)data.GetByteAt(2);
                    ChunksLeft = totalChunks;
                    Chunks = new byte[ChunksLeft][];
                }
                else
                {
                    // Chunks have to agree with the format and version information. 
                    if (format != (ManifestEnvelope.ManifestFormats)data.GetByteAt(0) ||
                        majorVersion != data.GetByteAt(1) || minorVersion != data.GetByteAt(2))
                        return null;
                }

                if (Chunks[chunkNum] != null)
                    return null;

                byte[] chunk = new byte[data.EventDataLength - 8];
                Chunks[chunkNum] = data.EventData(chunk, 0, 8, chunk.Length);
                --ChunksLeft;
                lastChunkReceptionTime = DateTime.Now;  // SLAB update

                if (ChunksLeft > 0)
                    return null;

                // OK we have a complete set of chunks
                byte[] serializedData = Chunks[0];
                if (Chunks.Length > 1)
                {
                    int totalLength = 0;
                    for (int i = 0; i < Chunks.Length; i++)
                        totalLength += Chunks[i].Length;

                    // Concatinate all the arrays. 
                    serializedData = new byte[totalLength];
                    int pos = 0;
                    for (int i = 0; i < Chunks.Length; i++)
                    {
                        Array.Copy(Chunks[i], 0, serializedData, pos, Chunks[i].Length);
                        pos += Chunks[i].Length;
                    }
                }
                Chunks = null;
                lastChunkReceptionTime = null;  // SLAB update
                // string str = Encoding.UTF8.GetString(serializedData);
                provider = new ProviderManifest(serializedData, format, majorVersion, minorVersion);
                provider.ISDynamic = true;
                return provider;
            }
        /// <summary>
        /// Print data.  Note that this method is called FROM DIFFERNET THREADS which means you need to properly
        /// lock any read-write data you access.   It turns out Out.Writeline is already thread safe so
        /// there is nothing I have to do in this case. 
        /// </summary>
        static void Print(TraceEvent data)
        {
            // There are a lot of data collection start on entry that I don't want to see (but often they are quite handy
            if (data.Opcode == TraceEventOpcode.DataCollectionStart || data.Opcode == TraceEventOpcode.DataCollectionStop)
                return;

            // Merging inject some 'symbol' events that are not that interesting so we ignore those too.  
            if (data.ProviderGuid == SymbolTraceEventParser.ProviderGuid)
                return;

            // To avoid 'rundown' events that happen in the beginning and end of the trace filter out things during those times
            if (data.TimeStampRelativeMSec < 1000 || 9000 < data.TimeStampRelativeMSec)
                return;

            Out.WriteLine(data.ToString());
        }
Exemple #19
0
 internal EtwEvent(TraceEvent data) { _data = data.Clone(); }
        /// <summary>
        /// Creates a session if it does not exist and increments the reference count on the session.
        /// </summary>
        /// <param name="beginEvent">Unused.</param>
        public override void BeginIteration(TraceEvent beginEvent)
        {
            if (s_session == null)
            {
                // The filter function here is to filter out events that we are not concerned with collecting, i.e. events from
                // processes not spawned by us.
                s_session = GCProcess.Collect(_context.TraceEventSource as TraceEventDispatcher, SampleRate, filterFunc: _context.IsTestEvent);
                s_hasComputedRollup = false;
            }

            s_sessionRefCount++;
        }
 public static void TraceEvent(TraceEventType eventType, TraceEvent id, [Localizable(false)] string format, params object[] args)
 {
     _traceSwitch.TraceEvent(eventType, (int)id, format, args);
 }
 public static void TraceEvent(TraceEventType eventType, TraceEvent id, [Localizable(false)] string message)
 {
     _traceSwitch.TraceEvent(eventType, (int)id, message);
 }
 public static void TraceEvent(TraceEventType eventType, TraceEvent id)
 {
     _traceSwitch.TraceEvent(eventType, (int)id);
 }
 public static void TraceData(TraceEventType eventType, TraceEvent id, string data)
 {
     _traceSwitch.TraceData(eventType, (int)id, data);
 }
 private void Source_AllEvents(TraceEvent obj)
 {
     throw new NotImplementedException();
 }
 protected override void EnumerateTemplates(Func<string, string, EventFilterResponse> eventsToObserve, Action<TraceEvent> callback)
 {
     if (s_templates == null)
     {
         var templates = new TraceEvent[20];
         templates[0] = ClassIDDefintionTemplate(null);
         templates[1] = ModuleIDDefintionTemplate(null);
         templates[2] = ObjectAllocatedTemplate(null);
         templates[3] = FinalizeableObjectQueuedTemplate(null);
         templates[4] = HandleCreatedTemplate(null);
         templates[5] = HandleDestroyedTemplate(null);
         templates[6] = RootReferencesTemplate(null);
         templates[7] = ObjectReferencesTemplate(null);
         templates[8] = GCStartTemplate(null);
         templates[9] = GCStopTemplate(null);
         templates[10] = ObjectsMovedTemplate(null);
         templates[11] = ObjectsSurvivedTemplate(null);
         templates[12] = CaptureStateStartTemplate(null);
         templates[13] = CaptureStateStopTemplate(null);
         templates[14] = ProfilerErrorTemplate(null);
         templates[15] = ProfilerShutdownTemplate(null);
         templates[16] = SamplingRateChangeTemplate(null);
         templates[17] = CallEnterTemplate(null);
         templates[18] = SendManifestTemplate(null);
         templates[19] = FunctionIDDefinitionTemplate(null);
         s_templates = templates;
     }
     foreach (var template in s_templates)
         if (eventsToObserve == null || eventsToObserve(template.ProviderName, template.EventName) == EventFilterResponse.AcceptEvent)
             callback(template);
 }
        /// <summary>
        /// Yields the metric and decrements the reference count on the session, disposing it
        /// if the reference count is zero.
        /// </summary>
        /// <param name="endEvent">Unused.</param>
        /// <returns>The value of the metric calculated by this class</returns>
        public override double EndIteration(TraceEvent endEvent)
        {
            var metric = YieldMetric();
            s_sessionRefCount--;
            if (s_sessionRefCount == 0)
            {
                s_session = null;

                // not doing this results in tremendous memory leaks!
                _context.TraceEventSource.Kernel.RemoveCallback<TraceEvent>(null);
                _context.TraceEventSource.Clr.RemoveCallback<TraceEvent>(null);
            }

            return metric;
        }
 public override void Trace(TraceEvent traceEvent)
 {
     FunctionIndexingException fex = traceEvent.Exception as FunctionIndexingException;
     if (fex != null)
     {
         fex.Handled = true;
         Errors.Add(fex);
     }
 }
        internal unsafe ProviderManifest AddChunk(TraceEvent data)
        {
            if (provider != null)
                return null;

            // TODO
            if (data.EventDataLength <= sizeof(ManifestEnvelope) || data.GetByteAt(3) != 0x5B)  // magic number
                return null;

            ushort totalChunks = (ushort)data.GetInt16At(4);
            ushort chunkNum = (ushort)data.GetInt16At(6);
            if (chunkNum >= totalChunks || totalChunks == 0)
                return null;

            if (Chunks == null)
            {
                format = (ManifestEnvelope.ManifestFormats)data.GetByteAt(0);
                majorVersion = (byte)data.GetByteAt(1);
                minorVersion = (byte)data.GetByteAt(2);
                ChunksLeft = totalChunks;
                Chunks = new byte[ChunksLeft][];
            }
            else
            {
                // Chunks have to agree with the format and version information.
                if (format != (ManifestEnvelope.ManifestFormats)data.GetByteAt(0) ||
                    majorVersion != data.GetByteAt(1) || minorVersion == data.GetByteAt(2))
                    return null;
            }

            if (Chunks[chunkNum] != null)
                return null;

            byte[] chunk = new byte[data.EventDataLength - 8];
            Chunks[chunkNum] = data.EventData(chunk, 0, 8, chunk.Length);
            --ChunksLeft;
            if (ChunksLeft > 0)
                return null;

            // OK we have a complete set of chunks
            byte[] serializedData = Chunks[0];
            if (Chunks.Length > 1)
            {
                int totalLength = 0;
                for (int i = 0; i < Chunks.Length; i++)
                    totalLength += Chunks[i].Length;

                // Concatinate all the arrays.
                serializedData = new byte[totalLength];
                int pos = 0;
                for (int i = 0; i < Chunks.Length; i++)
                {
                    Array.Copy(Chunks[i], 0, serializedData, pos, Chunks[i].Length);
                    pos += Chunks[i].Length;
                }
            }
            Chunks = null;
            // string str = Encoding.UTF8.GetString(serializedData);
            provider = new ProviderManifest(serializedData, format, majorVersion, minorVersion);
            return provider;
        }
Exemple #30
0
 protected virtual void Init(TraceEvent data)
 {
     ProcessID = data.ProcessID;
     ProcessName = data.ProcessName;
     isDead = false;
 }