예제 #1
0
 public static void ProcessTraces(Guid providerGuid, string sessionName, EtwTraceLevel level, long keyword)
 {
     using (var listener = new EventRealtimeListener(providerGuid, sessionName, level, keyword))
     {
         listener.ProcessTraces();
     }
 }
예제 #2
0
 public EventRealtimeEventArgs(int processId, int threadId, string message, EtwTraceLevel level)
 {
     ProcessId = processId;
     ThreadId  = threadId;
     Message   = message;
     Level     = level;
 }
예제 #3
0
        public EventRealtimeListener(Guid providerGuid, string sessionName, EtwTraceLevel level, long keyword)
        {
            if (providerGuid == Guid.Empty)
            {
                throw new ArgumentException(null, nameof(providerGuid));
            }

            if (sessionName == null)
            {
                throw new ArgumentNullException(nameof(sessionName));
            }

            _cb  = OnEvent;
            _rcb = OnRecordEvent;

            ProviderGuid = providerGuid;
            SessionName  = sessionName;

            int    status;
            IntPtr properties = BuildProperties(false, out int size);

            try
            {
                status = StartTrace(out _handle, SessionName, properties);
                if (status != 0)
                {
                    if (status != ERROR_ALREADY_EXISTS)
                    {
                        throw new Win32Exception(status);
                    }

                    // this can happen if something went wrong on another session with the same name
                    // so let's try to stop this existing thing and restart
                    StopTrace();

                    status = StartTrace(out _handle, SessionName, properties);
                    if (status != 0)
                    {
                        throw new Win32Exception(status);
                    }
                }
            }
            catch (Exception e)
            {
                App.AddTrace("EventRealtimeListener e:" + e);
                return;
            }
            finally
            {
                Marshal.FreeCoTaskMem(properties);
            }

            status = EnableTraceEx(providerGuid, IntPtr.Zero, _handle, 1, (byte)level, keyword, keyword, 0, IntPtr.Zero);
            if (status != 0)
            {
                throw new Win32Exception(status);
            }

            _traceOn = true;
        }
 /// <summary>
 /// Initializes a new instance of the <see cref="ProviderConfiguration"/> class with the specific
 /// values given by the caller.
 /// </summary>
 /// <param name="id">
 /// The id that identifies the provider.
 /// </param>
 /// <param name="level">
 /// The logging level from which events should be logged.
 /// </param>
 /// <param name="keywordsAny">
 /// The "keywords any" value to be used when enabling this provider.
 /// </param>
 /// <param name="keywordsAll">
 /// The "keywords all" value to be used when enabling this provider.
 /// </param>
 public ProviderConfiguration(Guid id, EtwTraceLevel level, long keywordsAny, long keywordsAll)
 {
     this.Id          = id;
     this.Level       = level;
     this.KeywordsAny = keywordsAny;
     this.KeywordsAll = keywordsAll;
 }
예제 #5
0
        public EventRealtimeListener(Guid providerGuid, string sessionName, EtwTraceLevel level, long keyword)
        {
            if (providerGuid == Guid.Empty)
                throw new ArgumentException(null, "guid");

            if (sessionName == null)
                throw new ArgumentNullException("sessionName");

            _cb = OnEvent;
            
            ProviderGuid = providerGuid;
            SessionName = sessionName;

            int status;
            int size;
            IntPtr properties = BuildProperties(false, out size);
            try
            {
                status = StartTrace(out _handle, SessionName, properties);
                if (status != 0)
                {
                    if (status != ERROR_ALREADY_EXISTS)
                        throw new Win32Exception(status);

                    // this can happen if something went wrong on another session with the same name
                    // so let's try to stop this existing thing and restart
                    StopTrace();

                    status = StartTrace(out _handle, SessionName, properties);
                    if (status != 0)
                        throw new Win32Exception(status);
                }
            }
            catch (Exception e)
            {
#if TRACESPY_SERVICE
                Program.Log("EventRealtimeListener e:" + e);
#else
                Main.Log("EventRealtimeListener e:" + e);
#endif
                return;
            }
            finally
            {
                Marshal.FreeCoTaskMem(properties);
            }

            status = EnableTraceEx(providerGuid, IntPtr.Zero, _handle, 1, (byte)level, keyword, keyword, 0, IntPtr.Zero);
            if (status != 0)
                throw new Win32Exception(status);

            _traceOn = true;
        }
예제 #6
0
        private void UpdateEtwEvents()
        {
            DisposeEtwEvents();
            if (!_settings.CaptureEtwTraces)
            {
                return;
            }

            foreach (EtwProvider provider in _settings.EtwProviders)
            {
                EventRealtimeListener listener;
                _etwListeners.TryGetValue(provider.ProviderGuid, out listener);
                if (listener == null)
                {
                    if (!provider.Active)
                    {
                        continue;
                    }

                    // this would be a serialization bug
                    if (provider.ProviderGuid == Guid.Empty)
                    {
                        continue;
                    }

                    EtwTraceLevel level = (EtwTraceLevel)provider.TraceLevel;

                    listener             = new EventRealtimeListener(provider.ProviderGuid, provider.ProviderGuid.ToString(), level);
                    listener.Description = provider.Description;

                    Thread t = new Thread(ProcessEtwTrace);
                    t.Start(listener);

                    listener.RealtimeEvent += OnEtwListenerRealtimeEvent;
                    _etwListeners.Add(provider.ProviderGuid, listener);
                }
                else
                {
                    if (!provider.Active)
                    {
                        listener.RealtimeEvent -= OnEtwListenerRealtimeEvent;
                        listener.Dispose();
                        _etwListeners.Remove(provider.ProviderGuid);
                        continue;
                    }
                }
            }
        }
예제 #7
0
 public EventRealtimeListener(Guid providerGuid, string sessionName, EtwTraceLevel level)
     : this(providerGuid, sessionName, level, 0)
 {
 }
예제 #8
0
 private void OnRealtimeEvent(int processId, int threadId, string s, EtwTraceLevel level) => RealtimeEvent?.Invoke(this, new EventRealtimeEventArgs(processId, threadId, s, level));
예제 #9
0
 public static void ProcessTraces(Guid providerGuid, string sessionName, EtwTraceLevel level, long keyword)
 {
     using (EventRealtimeListener listener = new EventRealtimeListener(providerGuid, sessionName, level, keyword))
     {
         listener.ProcessTraces();
     }
 }
예제 #10
0
 public EventRealtimeListener(Guid providerGuid, string sessionName, EtwTraceLevel level)
     : this(providerGuid, sessionName, level, 0)
 {
 }