static ETWEvent FromTraceEvent(TraceEvent item, Dictionary<string,string> additionalProperties)
{
var data = new Dictionary<string, object>();
for (var i = 0; i < item.PayloadNames.Length; i++)
data.Add(item.PayloadNames[i], item.PayloadValue(i));
if (additionalProperties != null)
{
foreach (var property in additionalProperties)
{
if (!data.ContainsKey(property.Key))
data.Add(property.Key, property.Value);
}
}
return new ETWEvent
{
Provider = item.ProviderName,
EventName = item.EventName,
EventId = (ushort)item.ID,
Message = item.FormattedMessage ?? "none",
Level = item.Level.ToString(),
ActivityId = item.ActivityID,
Timestamp = item.TimeStamp.ToUniversalTime(),
Fields = data
};
}
unsafe protected override DynamicTraceEventData TryLookup(TraceEvent unknownEvent)
{
// WPP is always classic
if (unknownEvent.ClassicProvider)
{
var taskGuid = unknownEvent.taskGuid;
var tmfPath = GetTmfPathForTaskGuid(taskGuid);
if (tmfPath != null)
{
var templates = CreateTemplatesForTMFFile(taskGuid, tmfPath);
// Register all the templates in the file, and if we found the specific one we are looking for return that one.
DynamicTraceEventData ret = null;
foreach (var template in templates)
{
if (template.eventID == unknownEvent.eventID)
ret = template;
else
RegisterTemplate(template);
}
// If we fail, remove the file so we don't continually try to parse the file.
if (ret == null)
m_tmfDataFilePathsByFileNameBase[taskGuid.ToString()] = null;
return ret;
}
}
return null;
}
public ThreadLifetime(TraceEvent sw, ThreadLifetimeType state)
{
// Old thread id & process id
this.ProcessorNumber = sw.ProcessorNumber;
this.TimeStamp = sw.TimeStamp;
this.TimeStamp100ns = sw.TimeStamp100ns;
this.ThreadId = sw.ThreadID;
this.ProcessId = sw.ProcessID;
this.State = state;
}
public PSTraceEvent(TraceEvent traceEvent, PSHostUserInterface hostUI)
{
this.hostUI = hostUI;
Source = traceEvent;
TimeStamp = Source.TimeStamp;
ProcessName = Process.GetProcessById(Source.ProcessID)?.ProcessName ?? "";
ProviderName = Source.ProviderName;
EventName = Source.EventName;
Level = Source.Level;
PayloadOrMessage = Source.DumpPayloadOrMessage();
}
protected override void EnumerateTemplates(Func<string, string, EventFilterResponse> eventsToObserve, Action<TraceEvent> callback)
{
if (s_templates == null)
{
var templates = new TraceEvent[3];
templates[0] = EventSourceMessageTemplate(null);
templates[1] = OnEnterTemplate(null);
templates[2] = OnLeaveTemplate(null);
s_templates = templates;
}
foreach (var template in s_templates)
if (eventsToObserve == null || eventsToObserve(template.ProviderName, template.EventName) == EventFilterResponse.AcceptEvent)
callback(template);
}
public ContextSwitch(TraceEvent sw)
{
// Old thread id & process id
this.OldThreadId = (int)sw.PayloadValue(0);
this.OldProcessId = (int)sw.PayloadValue(1);
this.NewThreadId = (int)sw.PayloadValue(3);
this.NewProcessId = (int)sw.PayloadValue(4);
this.State = (ThreadState)sw.PayloadValue(13);
this.ProcessorNumber = sw.ProcessorNumber;
this.TimeStamp = sw.TimeStamp;
this.TimeStamp100ns = sw.TimeStamp100ns;
// Multiply by 10 to adjust the time as 100ns
this.NewThreadWaitTime = (int)sw.PayloadValue(15) * 10;
}
public Task<TraceEvent> Process(TraceEvent traceEvent)
{
byte[] eventBody = EventToBytes(traceEvent);
//System.IO.File.WriteAllBytes(String.Format(@"c:\temp\etw\{0}.json", Guid.NewGuid()), eventBody);
EventData eventData = new EventData(eventBody);
eventData.PartitionKey = keyGenerator.GetKey(traceEvent);
if ( !currentBatch.TryAdd(eventData, eventBody.Length) ) {
// this needs to be an atomic operation!
var batch = Interlocked.Exchange(ref this.currentBatch, Batch<EventData>.Empty(MaxBatchSize));
this.batchSender.Send(batch);
}
return Task.FromResult(traceEvent);
}
public PageFault(TraceEvent ev)
{
switch (ev.EventName)
{
case "PageFault/DemandZeroFault": this.Type = PageFaultType.Minor; break;
case "PageFault/HardPageFault": this.Type = PageFaultType.Major; break;
case "PageFault/HardFault": this.Type = PageFaultType.Major; break;
default: this.Type = PageFaultType.Unknown; break;
}
this.TimeStamp = ev.TimeStamp;
this.ProcessorNumber = ev.ProcessorNumber;
this.Process = ev.ProcessID;
this.Thread = ev.ThreadID;
}
public void Trace_CustomProperties()
{
TraceEvent capturedEvent = null;
_mockTraceWriter.Setup(p => p.Trace(It.IsAny<TraceEvent>()))
.Callback<TraceEvent>(p =>
{
capturedEvent = p;
});
_mockTextWriter.Setup(p => p.WriteLine("Test Warning"));
TraceEvent traceEvent = new TraceEvent(TraceLevel.Warning, "Test Warning", "Test Source");
traceEvent.Properties.Add("Test", "Test Property");
_traceWriter.Trace(traceEvent);
_mockTraceWriter.VerifyAll();
_mockTextWriter.VerifyAll();
Assert.Same(traceEvent, capturedEvent);
Assert.Equal("Test Property", capturedEvent.Properties["Test"]);
}
private bool IsInterestingTrace(TraceEvent data)
{
// vshub.exe internally uses ApplicationInsights
if (data.PayloadNames.Length > 1 && data.PayloadString(1) == "vshub.exe")
{
return false;
}
bool result = false;
if (data.PayloadNames.Length > 0)
{
int id = (int)data.ID;
// Not system event
if ((id > 0) && (id < 65534))
{
string domainName = data.PayloadString(data.PayloadNames.Length - 1);
result = domainName.StartsWith("/LM/W3SVC");
}
}
return result;
}
private void OnEventHelper(TraceEvent data)
{
// Ignore manifest events.
if ((int)data.ID == 0xFFFE)
return;
this.OnEvent(new EtwEvent(data));
}
public override void BeginIteration(TraceEvent beginEvent)
{
_count = 0;
}
public override double EndIteration(TraceEvent endEvent)
{
return _count;
}
public override object EndIteration(TraceEvent endEvent)
{
return _count;
}
/// <summary>
/// Print data. Note that this method is called FROM DIFFERNET THREADS which means you need to properly
/// lock any read-write data you access. It turns out Out.Writeline is already thread safe so
/// there is nothing I have to do in this case.
/// </summary>
static void Print(TraceEvent data)
{
if (s_stopping) // Ctrl-C will stop the sessions, but buffered events may still come in, ignore these.
return;
// There are a lot of data collection start on entry that I don't want to see (but often they are quite handy
if (data.Opcode == TraceEventOpcode.DataCollectionStart)
return;
Out.WriteLine(data.ToString());
if (data is UnhandledTraceEvent)
Out.WriteLine(data.Dump());
}
/// <summary>
/// Print data. Note that this method is called FROM DIFFERNET THREADS which means you need to properly
/// lock any read-write data you access. It turns out Out.Writeline is already thread safe so
/// there is nothing I have to do in this case.
/// </summary>
static void Print(TraceEvent data, SymbolReader symbolReader)
{
// There are a lot of data collection start on entry that I don't want to see (but often they are quite handy
if (data.Opcode == TraceEventOpcode.DataCollectionStart)
return;
// V3.5 runtimes don't log the stack and in fact don't event log the exception name (it shows up as an empty string)
// Just ignore these as they are not that interesting.
if (data is ExceptionTraceData && ((ExceptionTraceData) data).ExceptionType.Length == 0)
return;
Out.WriteLine("EVENT: {0}", data.ToString());
var callStack = data.CallStack();
if (callStack != null)
{
// Because symbol lookup is complex, error prone, and expensive TraceLog requires you to be explicit.
// Here we look up names in this call stack using the symbol reader.
ResolveNativeCode(callStack, symbolReader);
Out.WriteLine("CALLSTACK: {0}", callStack.ToString());
}
}
internal unsafe ProviderManifest AddChunk(TraceEvent data)
{
//SLAB update
//removed check to allow recomputing new manifest on any new incoming chunk
//if (provider != null)
// return null;
// TODO
if (data.EventDataLength <= sizeof(ManifestEnvelope) || data.GetByteAt(3) != 0x5B) // magic number
return null;
ushort totalChunks = (ushort)data.GetInt16At(4);
ushort chunkNum = (ushort)data.GetInt16At(6);
if (chunkNum >= totalChunks || totalChunks == 0)
return null;
// SLAB update
if (Chunks == null || (lastChunkReceptionTime.HasValue && lastChunkReceptionTime.Value.Add(ChunkReceptionStalePeriod) < DateTime.Now))
{
format = (ManifestEnvelope.ManifestFormats)data.GetByteAt(0);
majorVersion = (byte)data.GetByteAt(1);
minorVersion = (byte)data.GetByteAt(2);
ChunksLeft = totalChunks;
Chunks = new byte[ChunksLeft][];
}
else
{
// Chunks have to agree with the format and version information.
if (format != (ManifestEnvelope.ManifestFormats)data.GetByteAt(0) ||
majorVersion != data.GetByteAt(1) || minorVersion != data.GetByteAt(2))
return null;
}
if (Chunks[chunkNum] != null)
return null;
byte[] chunk = new byte[data.EventDataLength - 8];
Chunks[chunkNum] = data.EventData(chunk, 0, 8, chunk.Length);
--ChunksLeft;
lastChunkReceptionTime = DateTime.Now; // SLAB update
if (ChunksLeft > 0)
return null;
// OK we have a complete set of chunks
byte[] serializedData = Chunks[0];
if (Chunks.Length > 1)
{
int totalLength = 0;
for (int i = 0; i < Chunks.Length; i++)
totalLength += Chunks[i].Length;
// Concatinate all the arrays.
serializedData = new byte[totalLength];
int pos = 0;
for (int i = 0; i < Chunks.Length; i++)
{
Array.Copy(Chunks[i], 0, serializedData, pos, Chunks[i].Length);
pos += Chunks[i].Length;
}
}
Chunks = null;
lastChunkReceptionTime = null; // SLAB update
// string str = Encoding.UTF8.GetString(serializedData);
provider = new ProviderManifest(serializedData, format, majorVersion, minorVersion);
provider.ISDynamic = true;
return provider;
}
/// <summary>
/// Print data. Note that this method is called FROM DIFFERNET THREADS which means you need to properly
/// lock any read-write data you access. It turns out Out.Writeline is already thread safe so
/// there is nothing I have to do in this case.
/// </summary>
static void Print(TraceEvent data)
{
// There are a lot of data collection start on entry that I don't want to see (but often they are quite handy
if (data.Opcode == TraceEventOpcode.DataCollectionStart || data.Opcode == TraceEventOpcode.DataCollectionStop)
return;
// Merging inject some 'symbol' events that are not that interesting so we ignore those too.
if (data.ProviderGuid == SymbolTraceEventParser.ProviderGuid)
return;
// To avoid 'rundown' events that happen in the beginning and end of the trace filter out things during those times
if (data.TimeStampRelativeMSec < 1000 || 9000 < data.TimeStampRelativeMSec)
return;
Out.WriteLine(data.ToString());
}
internal EtwEvent(TraceEvent data) { _data = data.Clone(); }
/// <summary>
/// Creates a session if it does not exist and increments the reference count on the session.
/// </summary>
/// <param name="beginEvent">Unused.</param>
public override void BeginIteration(TraceEvent beginEvent)
{
if (s_session == null)
{
// The filter function here is to filter out events that we are not concerned with collecting, i.e. events from
// processes not spawned by us.
s_session = GCProcess.Collect(_context.TraceEventSource as TraceEventDispatcher, SampleRate, filterFunc: _context.IsTestEvent);
s_hasComputedRollup = false;
}
s_sessionRefCount++;
}
public static void TraceEvent(TraceEventType eventType, TraceEvent id, [Localizable(false)] string format, params object[] args)
{
_traceSwitch.TraceEvent(eventType, (int)id, format, args);
}
public static void TraceEvent(TraceEventType eventType, TraceEvent id, [Localizable(false)] string message)
{
_traceSwitch.TraceEvent(eventType, (int)id, message);
}
public static void TraceEvent(TraceEventType eventType, TraceEvent id)
{
_traceSwitch.TraceEvent(eventType, (int)id);
}
public static void TraceData(TraceEventType eventType, TraceEvent id, string data)
{
_traceSwitch.TraceData(eventType, (int)id, data);
}
private void Source_AllEvents(TraceEvent obj)
{
throw new NotImplementedException();
}
protected override void EnumerateTemplates(Func<string, string, EventFilterResponse> eventsToObserve, Action<TraceEvent> callback)
{
if (s_templates == null)
{
var templates = new TraceEvent[20];
templates[0] = ClassIDDefintionTemplate(null);
templates[1] = ModuleIDDefintionTemplate(null);
templates[2] = ObjectAllocatedTemplate(null);
templates[3] = FinalizeableObjectQueuedTemplate(null);
templates[4] = HandleCreatedTemplate(null);
templates[5] = HandleDestroyedTemplate(null);
templates[6] = RootReferencesTemplate(null);
templates[7] = ObjectReferencesTemplate(null);
templates[8] = GCStartTemplate(null);
templates[9] = GCStopTemplate(null);
templates[10] = ObjectsMovedTemplate(null);
templates[11] = ObjectsSurvivedTemplate(null);
templates[12] = CaptureStateStartTemplate(null);
templates[13] = CaptureStateStopTemplate(null);
templates[14] = ProfilerErrorTemplate(null);
templates[15] = ProfilerShutdownTemplate(null);
templates[16] = SamplingRateChangeTemplate(null);
templates[17] = CallEnterTemplate(null);
templates[18] = SendManifestTemplate(null);
templates[19] = FunctionIDDefinitionTemplate(null);
s_templates = templates;
}
foreach (var template in s_templates)
if (eventsToObserve == null || eventsToObserve(template.ProviderName, template.EventName) == EventFilterResponse.AcceptEvent)
callback(template);
}
/// <summary>
/// Yields the metric and decrements the reference count on the session, disposing it
/// if the reference count is zero.
/// </summary>
/// <param name="endEvent">Unused.</param>
/// <returns>The value of the metric calculated by this class</returns>
public override double EndIteration(TraceEvent endEvent)
{
var metric = YieldMetric();
s_sessionRefCount--;
if (s_sessionRefCount == 0)
{
s_session = null;
// not doing this results in tremendous memory leaks!
_context.TraceEventSource.Kernel.RemoveCallback<TraceEvent>(null);
_context.TraceEventSource.Clr.RemoveCallback<TraceEvent>(null);
}
return metric;
}
public override void Trace(TraceEvent traceEvent)
{
FunctionIndexingException fex = traceEvent.Exception as FunctionIndexingException;
if (fex != null)
{
fex.Handled = true;
Errors.Add(fex);
}
}
internal unsafe ProviderManifest AddChunk(TraceEvent data)
{
if (provider != null)
return null;
// TODO
if (data.EventDataLength <= sizeof(ManifestEnvelope) || data.GetByteAt(3) != 0x5B) // magic number
return null;
ushort totalChunks = (ushort)data.GetInt16At(4);
ushort chunkNum = (ushort)data.GetInt16At(6);
if (chunkNum >= totalChunks || totalChunks == 0)
return null;
if (Chunks == null)
{
format = (ManifestEnvelope.ManifestFormats)data.GetByteAt(0);
majorVersion = (byte)data.GetByteAt(1);
minorVersion = (byte)data.GetByteAt(2);
ChunksLeft = totalChunks;
Chunks = new byte[ChunksLeft][];
}
else
{
// Chunks have to agree with the format and version information.
if (format != (ManifestEnvelope.ManifestFormats)data.GetByteAt(0) ||
majorVersion != data.GetByteAt(1) || minorVersion == data.GetByteAt(2))
return null;
}
if (Chunks[chunkNum] != null)
return null;
byte[] chunk = new byte[data.EventDataLength - 8];
Chunks[chunkNum] = data.EventData(chunk, 0, 8, chunk.Length);
--ChunksLeft;
if (ChunksLeft > 0)
return null;
// OK we have a complete set of chunks
byte[] serializedData = Chunks[0];
if (Chunks.Length > 1)
{
int totalLength = 0;
for (int i = 0; i < Chunks.Length; i++)
totalLength += Chunks[i].Length;
// Concatinate all the arrays.
serializedData = new byte[totalLength];
int pos = 0;
for (int i = 0; i < Chunks.Length; i++)
{
Array.Copy(Chunks[i], 0, serializedData, pos, Chunks[i].Length);
pos += Chunks[i].Length;
}
}
Chunks = null;
// string str = Encoding.UTF8.GetString(serializedData);
provider = new ProviderManifest(serializedData, format, majorVersion, minorVersion);
return provider;
}
protected virtual void Init(TraceEvent data)
{
ProcessID = data.ProcessID;
ProcessName = data.ProcessName;
isDead = false;
}