private void ProcessEvent(TraceEvent data, string formatString, Logger logger)
{
try
{
if (data.ProcessID == _selfProcessId)
{
if (_rejectSelf)
{
return;
}
}
PropertyInfo[] property_infos = data.GetType().GetProperties();
foreach (var property in property_infos)
{
var key = "{" + property.Name + "}";
if (formatString.Contains(key) == true)
{
var value = property.GetValue(data).ToString() ?? "";
formatString = formatString.Replace(key, value);
}
}
if (_filter.FileCheck(formatString))
{
logger.Info(formatString);
}
}
catch (Exception x)
{
_logger.Error(x, "Failed to properly log " + data.ProcessName);
}
}
public object ParseKernel(TraceEvent eventData)
{
if (eventData == null)
{
throw new ArgumentNullException(nameof(eventData));
}
if (eventData.GetType() != ExpectedEventDataType)
{
throw new ArgumentException($"Argument was not of type {ExpectedEventDataType} (Got {eventData.GetType()} instead)", nameof(eventData));
}
return(ParseKernelTraceEvent(eventData));
}
// To improve performace we drop IO events that are multiples of 4096
// This helps filter out large IO events with the obvious disadvantage
// of possibly overlooking needed data. In testing we found that rarely
// happened and the benefit far outweighed (small) risk.
static void FilterIOEvents(TraceEvent data)
{
// Ctrl-C will stop the sessions, but buffered events may still come in, ignore these.
if (s_stopping)
{
return;
}
if (data.GetType().Name == "FileIOReadWriteTraceData")
{
FileIOReadWriteTraceData parsedData = (FileIOReadWriteTraceData)data;
// Sometimes filenames can be blank. Not exactly sure why
// See nano sample for example
if (parsedData.FileName.Length > 0)
{
if (DO_READ_WRITE)
{
if (parsedData.OpcodeName == "Read")
{
if (parsedData.IoSize % 4096 == 0)
{
return;
}
else
{
fileReadEvent(parsedData);
}
}
if (parsedData.OpcodeName == "Write")
{
if (parsedData.IoSize % 4096 == 0)
{
return;
}
else
{
fileWriteEvent(parsedData);
}
}
}
}
}
}
