internal static ulong OpenTraceFile(ref TraceEventInterop.EVENT_TRACE_LOGFILEW logFile)
{
logFile.LogFileMode = PROCESS_TRACE_MODE_EVENT_RECORD | PROCESS_TRACE_MODE_RAW_TIMESTAMP;
ulong handle = TraceEventInterop.OpenTrace(ref logFile);
if (handle == INVALID_HANDLE_VALUE)
{
Marshal.ThrowExceptionForHR(TraceEventInterop.GetHRForLastWin32Error());
}
return(handle);
}
private void ProcessTrace()
{
m_eventCount = 0;
UInt64[] handles = new UInt64[1];
handles[0] = m_handle; // have to pass in an array, even though we only have one handle
int dwErr = TraceEventInterop.ProcessTrace(handles, 1, IntPtr.Zero, IntPtr.Zero);
m_traceCompleted = true;
Close();
if (dwErr == 6)
{
throw new ApplicationException("Error opening ETL file. Most likely caused by opening a Win8 Trace on a Pre Win8 OS.");
}
}
public void Close() // call after all reads have completed or upon exception
{
TraceEventInterop.CloseTrace(ref m_handle); // worst case scenario, process exit will do this
}
