/// <summary>
/// Creates a reader for one or more .etl (Event Trace Log) files
/// </summary>
/// <param name="etlFiles">up to 63 files to read</param>
/// <returns>sequence of events ordered by timestamp</returns>
public static IObservable <IDictionary <string, object> > FromFiles(params string[] etlFiles)
{
EtwTdhDeserializer d = new EtwTdhDeserializer();
var file = EtwObservable.FromFiles(etlFiles);
return(file.Select(e => new EtwTdhEvent(d, e)));
}
/// <summary>
/// Hooks to real-time ETW session. The session must be created ahead of time
/// </summary>
/// <param name="sessionName">the real-time session name</param>
/// <returns></returns>
public static IObservable <IDictionary <string, object> > FromSession(string sessionName)
{
EtwTdhDeserializer d = new EtwTdhDeserializer();
var session = EtwObservable.FromSession(sessionName);
return(session.Select(e => new EtwTdhEvent(d, e)));
}
public EtwTdhEvent(EtwTdhDeserializer deserializer, EtwNativeEvent nativeEvent)
{
_deserializer = deserializer;
_nativeEvent = nativeEvent;
}