/// <summary>
/// Creates a reader for one or more .etl (Event Trace Log) files
/// </summary>
/// <param name="etlFiles">up to 63 files to read</param>
/// <returns>sequence of events ordered by timestamp</returns>
public static IObservable <IDictionary <string, object> > FromFiles(params string[] etlFiles)
{
EtwTdhDeserializer d = new EtwTdhDeserializer();
var file = EtwObservable.FromFiles(etlFiles);
return(file.Select(e => new EtwTdhEvent(d, e)));
}
/// <summary>
/// Hooks to real-time ETW session. The session must be created ahead of time
/// </summary>
/// <param name="sessionName">the real-time session name</param>
/// <returns></returns>
public static IObservable <IDictionary <string, object> > FromSession(string sessionName)
{
EtwTdhDeserializer d = new EtwTdhDeserializer();
var session = EtwObservable.FromSession(sessionName);
return(session.Select(e => new EtwTdhEvent(d, e)));
}
public static void AddRealTimeSession(this IPlaybackConfiguration playback, string session)
{
playback.AddInput(
() => EtwObservable.FromSession(session),
typeof(EtwManifestTypeMap),
typeof(EtwClassicTypeMap),
typeof(EtwTypeMap));
}
public static void AddEtlFileSequence(this IPlaybackConfiguration playback, params string[] files)
{
playback.AddInput(
() => EtwObservable.FromSequentialFiles(files),
typeof(EtwManifestTypeMap),
typeof(EtwClassicTypeMap),
typeof(EtwTypeMap));
}
public static string[] ExtractFromTrace(string etlFile)
{
return(EtwObservable.ExtractManifests(etlFile));
}