private bool DecodeEvent(ref EventRecord eventRecord, out DecodedEtwEvent decodedEvent, out string originalEventName) { decodedEvent = new DecodedEtwEvent { EventRecord = eventRecord }; originalEventName = string.Empty; if (false == ManifestCache.IsStringEvent(eventRecord)) { var eventDefinition = this.etwManifestCache.GetEventDefinition( eventRecord); if (null == eventDefinition) { if (eventRecord.EventHeader.EventDescriptor.Task != (ushort)FabricEvents.EventSourceTaskId) { // We couldn't decode this event. Skip it. this.traceSource.WriteError( this.logSourceId, "Unable to decode ETW event. The event will be skipped. Event ID: {0}, Task: {1}, Level: {2}.", eventRecord.EventHeader.EventDescriptor.Id, eventRecord.EventHeader.EventDescriptor.Task, eventRecord.EventHeader.EventDescriptor.Level); } return(false); } if (eventDefinition.IsChildEvent) { // Try to format the event. This causes the ETL reader to save information // about this event. That information is later retrieved when the parent // event is processed. string childEventType; string childEventText; var childStringRepresentation = this.etwManifestCache.FormatEvent( eventRecord, out childEventType, out childEventText); // Only parent events can be decoded. Child events supply additional // information about the parent event and cannot be decoded on their // own. return(false); } decodedEvent.TaskName = eventDefinition.TaskName; originalEventName = eventDefinition.OriginalEventName; } else { decodedEvent.TaskName = EventFormatter.StringEventTaskName; } decodedEvent.Timestamp = DateTime.FromFileTimeUtc(eventRecord.EventHeader.TimeStamp); decodedEvent.Level = eventRecord.EventHeader.EventDescriptor.Level; decodedEvent.ThreadId = eventRecord.EventHeader.ThreadId; decodedEvent.ProcessId = eventRecord.EventHeader.ProcessId; decodedEvent.StringRepresentation = this.etwManifestCache.FormatEvent( eventRecord, out decodedEvent.EventType, out decodedEvent.EventText, 0); if (null == decodedEvent.StringRepresentation) { if (eventRecord.EventHeader.EventDescriptor.Task != (ushort)FabricEvents.EventSourceTaskId) { // We couldn't decode this event. Skip it. this.traceSource.WriteError( this.logSourceId, "Unable to decode ETW event. The event will be skipped. Event ID: {0}, Task: {1}, Level: {2}.", eventRecord.EventHeader.EventDescriptor.Id, eventRecord.EventHeader.EventDescriptor.Task, eventRecord.EventHeader.EventDescriptor.Level); return(false); } } // in case it is a string event and the eventName is not give by the eventDefinition if (string.IsNullOrEmpty(originalEventName)) { originalEventName = decodedEvent.EventType; } // If this is an FMM event, update the last timestamp of FMM events if (decodedEvent.TaskName.Equals(Utility.FmmTaskName)) { Utility.LastFmmEventTimestamp = decodedEvent.Timestamp; } return(true); }
private bool DecodeEvent(EventRecord eventRecord, out DecodedEtwEvent decodedEvent) { decodedEvent = new DecodedEtwEvent { EventRecord = eventRecord }; if (false == ManifestCache.IsStringEvent(eventRecord)) { var eventDefinition = this.etwManifestCache.GetEventDefinition( eventRecord); if (null == eventDefinition) { if (!EventSourceHelper.CheckForDynamicManifest(eventRecord.EventHeader.EventDescriptor)) { // We couldn't decode this event. Skip it. this.traceSource.WriteError( this.logSourceId, "Unable to decode ETW event. The event will be skipped. Event ID: {0}, Task: {1}, Level: {2}.", eventRecord.EventHeader.EventDescriptor.Id, eventRecord.EventHeader.EventDescriptor.Task, eventRecord.EventHeader.EventDescriptor.Level); } return(false); } if (eventDefinition.IsChildEvent) { // Try to format the event. This causes the ETL reader to save information // about this event. That information is later retrieved when the parent // event is processed. string childEventType; string childEventText; var childStringRepresentation = this.etwManifestCache.FormatEvent( eventRecord, out childEventType, out childEventText); // Only parent events can be decoded. Child events supply additional // information about the parent event and cannot be decoded on their // own. return(false); } decodedEvent.TaskName = eventDefinition.TaskName; } else { decodedEvent.TaskName = EventFormatter.StringEventTaskName; } decodedEvent.Timestamp = DateTime.FromFileTimeUtc(eventRecord.EventHeader.TimeStamp); decodedEvent.Level = eventRecord.EventHeader.EventDescriptor.Level; decodedEvent.ThreadId = eventRecord.EventHeader.ThreadId; decodedEvent.ProcessId = eventRecord.EventHeader.ProcessId; decodedEvent.StringRepresentation = this.etwManifestCache.FormatEvent( eventRecord, out decodedEvent.EventType, out decodedEvent.EventText); if (null == decodedEvent.StringRepresentation) { if (!EventSourceHelper.CheckForDynamicManifest(eventRecord.EventHeader.EventDescriptor)) { // We couldn't decode this event. Skip it. this.traceSource.WriteError( this.logSourceId, "Unable to decode ETW event. The event will be skipped. Event ID: {0}, Task: {1}, Level: {2}.", eventRecord.EventHeader.EventDescriptor.Id, eventRecord.EventHeader.EventDescriptor.Task, eventRecord.EventHeader.EventDescriptor.Level); return(false); } } // If this is an FMM event, update the last timestamp of FMM events if ((WinFabricEtlType.DefaultEtl == this.windowsFabricEtlType) && decodedEvent.TaskName.Equals(Utility.FmmTaskName)) { Utility.LastFmmEventTimestamp = decodedEvent.Timestamp; } return(true); }