internal static void EnableProvider(TraceEventSession session, Guid providerId, EventLevel level, EventKeywords matchAnyKeyword, bool sendManifest = true) { // Make explicit the invocation for requesting the manifest from the EventSource (Provider). var values = sendManifest ? new Dictionary<string, string>() { { "Command", "SendManifest" } } : null; session.EnableProvider(providerId, (TraceEventLevel)level, (ulong)matchAnyKeyword, 0, TraceEventOptions.None, values); }
private static void CloseExistingSession(string name) { HashSet<string> sessionNames = new HashSet<string>(TraceEventSession.GetActiveSessionNames()); if (sessionNames.Contains(name)) { using (TraceEventSession existingSession = new TraceEventSession(name)) { existingSession.StopOnDispose = true; } } }
public void Start() { if (this.session != null) { throw new InvalidOperationException("The session is already started."); } CloseExistingSession(this.name); this.session = new TraceEventSession(this.name, null); this.session.StopOnDispose = true; this.session.EnableProvider(KernelProcessProviderId, TraceEventLevel.Informational, ulong.MaxValue, 0x10); this.eventSource = new ETWTraceEventSource(this.name, TraceEventSourceType.Session); this.parser = new RegisteredTraceEventParser(this.eventSource); this.parser.All += this.OnEventRead; // Process() blocks until the session is shut down, so we'll run this on another thread. this.cts = new CancellationTokenSource(); this.processTask = Task.Factory.StartNew(() => this.eventSource.Process(), TaskCreationOptions.LongRunning); }
static void RunTest() { var tmfDirectory = "."; var sessionName = "My Real Time Session"; TraceEventSession session = null; ETWTraceEventSource source = null; bool started = false; // Start a thread to listen for incoming events in real time. var listenThread = new System.Threading.Thread(delegate() { using (session = new TraceEventSession(sessionName, null)) { session.StopOnDispose = true; using (source = new ETWTraceEventSource(sessionName, TraceEventSourceType.Session)) { session.EnableProvider(WPPProviderGuid1, (TraceEventLevel)200, ulong.MaxValue); session.EnableProvider(WPPProviderGuid2, (TraceEventLevel)200, ulong.MaxValue); started = true; // This is my callback. Right now I just print. Action<TraceEvent> print = delegate(TraceEvent data) { Console.WriteLine(data.ToString()); }; // Wire up callbacks #if false // Other parsers you could enable var dynamicParser = source.Dynamic; // EventSources dynamicParser.ReadAllManifests("."); // If we have explicit manifests we wish to use (but not register with the OS). dynamicParser.All += print; var registeredParser = new RegisteredTraceEventParser(source); // OS build in events registeredParser.All += print; #endif var wppParser = new WppTraceEventParser(source, tmfDirectory); // WPP where we have the TMF files in 'tmfDirectory' wppParser.All += print; source.UnhandledEvent += print; // Optional. Shows events you don't recognize. probably worth investigating. source.Process(); // listen for incomming events. } } }); // Wait for startup while (!started) System.Threading.Thread.Sleep(1); Console.WriteLine("Listening for 1 min"); System.Threading.Thread.Sleep(60000); // To stop listening Console.WriteLine("Stopping listening"); source.StopProcessing(); source.Dispose(); session.Dispose(); Console.WriteLine("Done"); }
public void Dispose() { if (!this.disposed) { this.disposing = true; if (this.eventsLost > 0) { this.logger.TraceEventServiceProcessEventsLost(this.sessionName, this.eventsLost); } // By disposing source we force this.source.Process() to exit and end workerTask // Note that source reference is not released rigth after Dispose() to avoid 'CallbackOnCollectedDelegate'exception // that might be thrown before Process() ends. this.source.Dispose(); this.workerTask.Wait(); this.session.Dispose(); this.session = null; this.source = null; this.disposed = true; } }
private void Initialize() { this.session = TraceEventUtil.CreateSession(this.sessionName); // Hook up the ETWTraceEventSource to the specified session this.source = new ETWTraceEventSource(this.sessionName, TraceEventSourceType.Session); this.manifestCache = new TraceEventManifestsCache(this.source.Dynamic); // get any previously cached manifest this.manifestCache.Read(); // hook up to all incoming events and filter out manifests this.source.Dynamic.All += e => this.ProcessEvent(e); // listen to new manifests this.source.Dynamic.ManifestReceived += m => this.OnManifestReceived(m); // We collect all the manifests and save/terminate process when done this.source.UnhandledEvent += e => this.ProcessUnhandledEvent(e); foreach (var eventSource in this.eventSources) { // Bind the provider (EventSource/EventListener) with the session TraceEventUtil.EnableProvider(this.session, eventSource.EventSourceId, eventSource.Level, eventSource.MatchAnyKeyword); } // source.Process() is blocking so we need to launch it on a separate thread. this.workerTask = Task.Factory.StartNew(() => this.source.Process(), TaskCreationOptions.LongRunning). ContinueWith(t => this.HandleProcessTaskFault(t)); }