/// <summary>
/// Open an existing Windows Event Tracing Session, with name 'sessionName'.
///
/// If you are opening a new session use TraceEventSession(string, string).
///
/// To support the illusion that you can have a session with both kernel and user events,
/// TraceEventSession might start up both a kernel and a user session. When you want to 'attach'
/// to such a combined session, the constructor needs to know if you want to control the kernel
/// session or not. If attachKernelSession is true, then it opens both sessions (and thus 'Close'
/// will operation on both sessions.
/// </summary>
public TraceEventSession(string sessionName, bool attachKernelSession)
{
Init(sessionName);
int hr = TraceEventNativeMethods.ControlTrace(0UL, sessionName, ToUnmanagedBuffer(properties, null), TraceEventNativeMethods.EVENT_TRACE_CONTROL_QUERY);
Marshal.ThrowExceptionForHR(TraceEventNativeMethods.GetHRFromWin32(hr));
isActive = true;
properties = (TraceEventNativeMethods.EVENT_TRACE_PROPERTIES)Marshal.PtrToStructure(unmanagedPropertiesBuffer, typeof(TraceEventNativeMethods.EVENT_TRACE_PROPERTIES));
if (properties.LogFileNameOffset != 0)
{
fileName = Marshal.PtrToStringUni((IntPtr)(unmanagedPropertiesBuffer.ToInt64() + properties.LogFileNameOffset));
}
if (attachKernelSession)
{
bool success = false;
try
{
kernelSession = new TraceEventSession(KernelTraceEventParser.KernelSessionName);
success = true;
}
finally
{
if (!success)
{
Stop();
}
}
}
}
/// <summary>
/// Once started, event sessions will persist even after the process that created them dies. They are
/// only stoped by this explicit Stop() API. If you used both kernel and user events, consider
/// using the code:StopUserAndKernelSession API instead.
/// </summary>
public void Stop()
{
if (stopped)
{
return;
}
stopped = true;
int hr = TraceEventNativeMethods.ControlTrace(0UL, sessionName,
ToUnmanagedBuffer(properties, null), TraceEventNativeMethods.EVENT_TRACE_CONTROL_STOP);
if (hr != 4201) // Instance name not found. This means we did not start
{
Marshal.ThrowExceptionForHR(TraceEventNativeMethods.GetHRFromWin32(hr));
}
if (kernelSession != null)
{
kernelSession.Stop();
kernelSession = null;
}
}