public void Dispose() { if (!EventTracingApi.IsInvalidProcessTraceHandle(TraceHandle)) { EventTracingApi.CloseTrace(TraceHandle); } }
private void OpenEtlFile() { // Retained the delegate objects to avoid GC. EventRecordCallbackRetainer = new EventRecordCallback(EventRecordCallback); BufferCallbackRetainer = new BufferCallback(BufferCallback); // Open the ETL log file. EVENT_TRACE_LOGFILE traceLogFile = new EVENT_TRACE_LOGFILE { LogFileName = EtlFilePath, ProcessTraceMode = EventTracingApi.PROCESS_TRACE_MODE_EVENT_RECORD, BufferCallback = BufferCallbackRetainer, EventCallback = EventRecordCallbackRetainer, }; TraceHandle = EventTracingApi.OpenTrace(ref traceLogFile); if (EventTracingApi.IsInvalidProcessTraceHandle(TraceHandle)) { var win32ErrorCode = Marshal.GetLastWin32Error(); string exceptionMessage; if (win32ErrorCode == Win32ErrorCode.ERROR_FILE_CORRUPT) { exceptionMessage = string.Format("OpenTrace function failed. The file '{0}' is corrupted.", EtlFilePath); } else { exceptionMessage = string.Format("OpenTrace function failed. The file tried to open was '{0}'.", EtlFilePath); } throw new Win32Exception(win32ErrorCode, exceptionMessage); } }
private void ProcessEtlFile() { // Start trace processing. ulong[] traceHandles = new ulong[] { TraceHandle }; uint result = EventTracingApi.ProcessTrace(traceHandles, (uint)traceHandles.Length, IntPtr.Zero, IntPtr.Zero); if (result != Win32ErrorCode.ERROR_SUCCESS) { throw new Win32Exception((int)result, string.Format("ProcessTrace function failed with 0x{0:x8}. The file that was open was '{1}'.", result, EtlFilePath)); } }