public void OnEvent(ITraceEvent eventData, CTraceRelogger relogger)
{
var rawData = (TraceEventNativeMethods.EVENT_RECORD *)eventData.GetEventRecord();
var source = m_source;
if (source.stopProcessing)
{
return;
}
// is this the very first event? if so this could be the header event (for real time ETW)
if (m_source._syncTimeQPC == 0)
{
Initialize(rawData);
}
Debug.Assert(rawData->EventHeader.HeaderType == 0); // if non-zero probably old-style ETW header
// Give it an event ID if it does not have one.
source.m_traceLoggingEventId.TestForTraceLoggingEventAndFixupIfNeeded(rawData);
// Lookup the event;
TraceEvent anEvent = source.Lookup(rawData);
source.m_curITraceEvent = eventData;
source.m_curTraceEventRecord = anEvent.eventRecord;
// Keep in mind that for UnhandledTraceEvent 'PrepForCallback' has NOT been called, which means the
// opcode, guid and eventIds are not correct at this point. The ToString() routine WILL call
// this so if that is in your debug window, it will have this side effect (which is good and bad)
// Looking at rawData will give you the truth however.
anEvent.DebugValidate();
if (anEvent.NeedsFixup)
{
anEvent.FixupData();
}
source.Dispatch(anEvent);
// Release the COM object aggressively Otherwise you build up quite a few of these before
// the GC kicks in and cleans them all up.
Marshal.FinalReleaseComObject(source.m_curITraceEvent);
source.m_curITraceEvent = null;
}
/// <summary>
/// Create an ETWReloggerTraceEventSource that can takes its input from a variety of sources (either a single file,
/// a set of files, or a real time ETW session (based on 'type'), and can write these events to a new ETW output
/// file 'outputFileName.
/// </summary>
public ETWReloggerTraceEventSource(string fileOrSessionName, TraceEventSourceType type, string outputFileName)
: base()
{
var version = Environment.OSVersion.Version.Major * 10 + Environment.OSVersion.Version.Minor;
if (version < 62)
{
throw new NotSupportedException("System Tracing is only supported on Windows 8 and above.");
}
m_relogger = new CTraceRelogger();
if (type == TraceEventSourceType.FileOnly)
{
m_traceHandleForFirstStream = m_relogger.AddLogfileTraceStream(fileOrSessionName, IntPtr.Zero);
}
else if (type == TraceEventSourceType.Session)
{
m_traceHandleForFirstStream = m_relogger.AddRealtimeTraceStream(fileOrSessionName, IntPtr.Zero);
}
else
{
Debug.Assert(type == TraceEventSourceType.MergeAll);
List <string> logFileNames = ETWTraceEventSource.GetMergeAllLogFiles(fileOrSessionName);
bool first = true;
foreach (var logFileName in logFileNames)
{
var handle = m_relogger.AddLogfileTraceStream(logFileName, IntPtr.Zero);
if (first)
{
m_traceHandleForFirstStream = handle;
first = false;
}
}
}
m_relogger.SetOutputFilename(outputFileName);
m_myCallbacks = new ReloggerCallbacks(this);
m_relogger.RegisterCallback(m_myCallbacks);
}
public void OnFinalizeProcessTrace(CTraceRelogger relogger)
{
}
public void OnBeginProcessTrace(ITraceEvent headerEvent, CTraceRelogger relogger)
{
var rawData = (TraceEventNativeMethods.EVENT_RECORD *)headerEvent.GetEventRecord();
Initialize(rawData);
}
