private void ProcessEvent(TraceEvent data, string formatString, Logger logger)
        {
            try
            {
                if (data.ProcessID == _selfProcessId)
                {
                    if (_rejectSelf)
                    {
                        return;
                    }
                }
                PropertyInfo[] property_infos = data.GetType().GetProperties();

                foreach (var property in property_infos)
                {
                    var key = "{" + property.Name + "}";
                    if (formatString.Contains(key) == true)
                    {
                        var value = property.GetValue(data).ToString() ?? "";
                        formatString = formatString.Replace(key, value);
                    }
                }
                if (_filter.FileCheck(formatString))
                {
                    logger.Info(formatString);
                }
            }
            catch (Exception x)
            {
                _logger.Error(x, "Failed to properly log " + data.ProcessName);
            }
        }
Esempio n. 2
0
        public object ParseKernel(TraceEvent eventData)
        {
            if (eventData == null)
            {
                throw new ArgumentNullException(nameof(eventData));
            }

            if (eventData.GetType() != ExpectedEventDataType)
            {
                throw new ArgumentException($"Argument was not of type {ExpectedEventDataType} (Got {eventData.GetType()} instead)", nameof(eventData));
            }

            return(ParseKernelTraceEvent(eventData));
        }
Esempio n. 3
0
        // To improve performace we drop IO events that are multiples of 4096
        // This helps filter out large IO events with the obvious disadvantage
        // of possibly overlooking needed data. In testing we found that rarely
        // happened and the benefit far outweighed (small) risk.
        static void FilterIOEvents(TraceEvent data)
        {
            // Ctrl-C will stop the sessions, but buffered events may still come in, ignore these.
            if (s_stopping)
            {
                return;
            }

            if (data.GetType().Name == "FileIOReadWriteTraceData")
            {
                FileIOReadWriteTraceData parsedData = (FileIOReadWriteTraceData)data;

                // Sometimes filenames can be blank. Not exactly sure why
                // See nano sample for example
                if (parsedData.FileName.Length > 0)
                {
                    if (DO_READ_WRITE)
                    {
                        if (parsedData.OpcodeName == "Read")
                        {
                            if (parsedData.IoSize % 4096 == 0)
                            {
                                return;
                            }
                            else
                            {
                                fileReadEvent(parsedData);
                            }
                        }
                        if (parsedData.OpcodeName == "Write")
                        {
                            if (parsedData.IoSize % 4096 == 0)
                            {
                                return;
                            }
                            else
                            {
                                fileWriteEvent(parsedData);
                            }
                        }
                    }
                }
            }
        }