Exemplo n.º 1
0
        private static unsafe void Warmup(TraceLogFilterPredicate predicate)
        {
            var record = new EVENT_RECORD();
            var info   = new TRACE_EVENT_INFO();

            predicate((IntPtr)(&record), (IntPtr)(&info), (UIntPtr)Marshal.SizeOf <TRACE_EVENT_INFO>());
        }
Exemplo n.º 2
0
        private void OnRecordEvent(ref EVENT_RECORD eventRecord)
        {
            if (eventRecord.UserData == IntPtr.Zero)
            {
                return;
            }

            string s;

            try
            {
                if (StringMessageMode)
                {
                    var len = (int)(ushort)Marshal.ReadInt16(eventRecord.UserData);
                    s = Marshal.PtrToStringUni(eventRecord.UserData + 2, len / 2);
                }
                else
                {
                    s = Marshal.PtrToStringUni(eventRecord.UserData);
                }
            }
            catch
            {
                OnRealtimeEvent(Process.GetCurrentProcess().Id, GetCurrentThreadId(), "ETW last trace had an error. This provider may not be logging string message.", EtwTraceLevel.Fatal);
                return;
            }

            if (!string.IsNullOrEmpty(s))
            {
                OnRealtimeEvent(eventRecord.EventHeader.ProcessId, eventRecord.EventHeader.ThreadId, s, eventRecord.EventHeader.EventDescriptor.Level);
            }
        }
Exemplo n.º 3
0
            public void OnEvent(ITraceEvent Event, ITraceRelogger Relogger)
            {
                IntPtr recordPtr;

                Event.GetEventRecord(out recordPtr);
                EVENT_RECORD record = (EVENT_RECORD)Marshal.PtrToStructure(recordPtr, typeof(EVENT_RECORD));

                if (IsStackWalkRecord(ref record))
                {
                    // path the timestamp in the stack walk record.
                    Marshal.WriteInt64(record.UserData, _currentTimeStamp);
                    _currentTimeStamp += _ticksPerStack;
                    if (record.UserDataLength == EmptyStackWalkSize)
                    {
                        // this is an empty stack walk, which means that the CPU is actually idle.
                        // We inject these when writing the log, and then remove them when doing
                        // the rewrite.  This lets us keep the correct timing information but removing
                        // them gets us correct CPU information in the graph.
                        return;
                    }
                }

                var prevTimeStamp = record.EventHeader.TimeStamp;

                var newTimeStamp = _currentTimeStamp;

                Event.SetTimeStamp(ref newTimeStamp);

                if (IsStackWalkRecord(ref record))
                {
                }

                Relogger.Inject(Event);
            }
Exemplo n.º 4
0
        internal void EventRecordCallback(ref EVENT_RECORD eventRecord)
        {
            Debug.Write(nameof(EventRecordCallback));
            Debug.Write(string.Format(": TotalEventRecordCount: {0}", TotalEventRecordCount));
            Debug.WriteLine("");

            // for statistics.
            TotalEventRecordCount++;

            // We handle only the NDIS provider's record and packet fragment event.
            if (eventRecord.EventHeader.ProviderId == EventTracingApi.EtwNdisPacketCaptureProviderId &&
                eventRecord.EventHeader.EventDescriptor.Id == EventTracingApi.EtwNdisPacketFragmentRecordId)
            {
                var timestamp      = GetNdisEventRecordTimestampUtc(eventRecord);
                var packetFragment = GetNdisEventRecordPacketFragment(eventRecord);
                NdisEventRecords.Add(new NdisEventRecord(timestamp, packetFragment));

                // for statistics.
                if (timestamp < OldestNdisEventRecordTimestamp)
                {
                    OldestNdisEventRecordTimestamp = timestamp;
                }

                if (timestamp > NewestNdisEventRecordTimestamp)
                {
                    NewestNdisEventRecordTimestamp = timestamp;
                }
            }
        }
Exemplo n.º 5
0
        static void Main(string[] args)
        {
            if (args.Length == 0)
            {
                Console.WriteLine(
                    @"usage: TransformPerf <size> <query>

    size is Small Medium or Large
    query is 1 2 or 3");
                Environment.Exit(0);
            }

            var size    = (EventSize)Enum.Parse(typeof(EventSize), args[0]);
            int queryId = int.Parse(args[1]);

            Init(size);

            record = new EVENT_RECORD();
            record.EventHeader.ProviderId         = new Guid("3838EF9A-CB6F-4A1C-9033-84C0E8EBF5A7");
            record.EventHeader.EventDescriptor.Id = (ushort)size;
            record.UserData       = userData.AddrOfPinnedObject();
            record.UserDataLength = (ushort)Marshal.SizeOf(userData.Target);
            recordHandle          = GCHandle.Alloc(record, GCHandleType.Pinned);

            MethodInfo method        = typeof(Program).GetMethod("RunForever", BindingFlags.NonPublic | BindingFlags.Static);
            MethodInfo methodGeneric = method.MakeGenericMethod(outputType);

            methodGeneric.Invoke(null, new object[] { queryId });
        }
Exemplo n.º 6
0
        private static byte[] GetEventRecordUserData(EVENT_RECORD eventRecord)
        {
            // Copy the unmanaged bytes to the managed byte array.
            var userData = new byte[eventRecord.UserDataLength];

            Marshal.Copy(eventRecord.UserData, userData, 0, userData.Length);
            return(userData);
        }
Exemplo n.º 7
0
 public DirectInputGenerator(EventSize size)
     : base(size)
 {
     _record       = new EVENT_RECORD();
     _recordHandle = GCHandle.Alloc(_record, GCHandleType.Pinned);
     _record.EventHeader.ProviderId         = new Guid("3838EF9A-CB6F-4A1C-9033-84C0E8EBF5A7");
     _record.EventHeader.EventDescriptor.Id = (ushort)size;
     _record.UserData       = EventData.AddrOfPinnedObject();
     _record.UserDataLength = (ushort)Marshal.SizeOf(EventData.Target);
 }
Exemplo n.º 8
0
        private static byte[] GetNdisEventRecordPacketFragment(EVENT_RECORD eventRecord)
        {
            var userData             = GetEventRecordUserData(eventRecord);
            var packetFragmentHeader = GetNdisEventRecordPacketFragmentHeader(userData);

            var packetFragment = new byte[packetFragmentHeader.FragmentSize];

            Buffer.BlockCopy(userData, Marshal.SizeOf <NdisEventRecordPacketFragmentHeader>(), packetFragment, 0, packetFragment.Length);
            return(packetFragment);
        }
Exemplo n.º 9
0
            public void OnBeginProcessTrace(ITraceEvent HeaderEvent, ITraceRelogger Relogger)
            {
                IntPtr recordPtr;

                HeaderEvent.GetEventRecord(out recordPtr);
                EVENT_RECORD record = (EVENT_RECORD)Marshal.PtrToStructure(recordPtr, typeof(EVENT_RECORD));

                EventTrace_Header props = (EventTrace_Header)Marshal.PtrToStructure(record.UserData, typeof(EventTrace_Header));

                var ticksPerMs = props.PerfFreq / 1000;// PerfFreq is frequence in # of ticks per second (same as Stopwatch.Frequency)
                var msPerStack = _executionTime.TotalMilliseconds / _stackWalkCount;

                _ticksPerStack = (long)(ticksPerMs * (ulong)msPerStack);
            }
            public unsafe EventRecordCPtr Build()
            {
                if (userData.Count > ushort.MaxValue)
                {
                    throw new OverflowException();
                }

                ushort userDataLength = (ushort)userData.Count;
                var    record         = (EVENT_RECORD *)allocator.Allocate(sizeof(EVENT_RECORD) + userDataLength);

                *record = new EVENT_RECORD();
                record->UserData       = (IntPtr)((byte *)record + sizeof(EVENT_RECORD));
                record->UserDataLength = userDataLength;
                Marshal.Copy(userData.ToArray(), 0, record->UserData, userDataLength);

                return(new EventRecordCPtr(record));
            }
Exemplo n.º 11
0
        public unsafe void Create(string providerId, ushort id, bool expected)
        {
            var builder = TraceLogFilterBuilder.Instance;

            var filter = new TraceLogFilter();

            //filter.Conditions.Add(new TraceLogFilterCondition(
            //    builder.ProviderId, true, FilterRelationKind.NotEqual, FilterConditionAction.Exclude, new Guid("E53CD252-C0DA-49DD-93B0-28744D498D0F")));
            //filter.Conditions.Add(new TraceLogFilterCondition(
            //    builder.Id, true, FilterRelationKind.Equal, FilterConditionAction.Exclude, (ushort)1));

            filter.Conditions.Add(new TraceLogFilterCondition(
                                      "ProviderId == {FF4B1F18-0D41-4DE6-A576-7FD58477A869} || id != 1", true, FilterConditionAction.Include));

            var record  = new EVENT_RECORD();
            var tei     = new TRACE_EVENT_INFO();
            var teiSize = new UIntPtr((uint)Marshal.SizeOf <TRACE_EVENT_INFO>());

            record.EventHeader.ProviderId         = new Guid(providerId);
            record.EventHeader.EventDescriptor.Id = id;

            Assert.Equal(expected, filter.CreatePredicate()(new IntPtr(&record), new IntPtr(&tei), teiSize));
        }
Exemplo n.º 12
0
 static void EventRecordCallback([In] ref EVENT_RECORD eventRecord)
 {
     counter++;
 }
Exemplo n.º 13
0
 private static bool IsStackWalkRecord(ref EVENT_RECORD record)
 {
     return(record.EventHeader.ProviderId == TraceLog.StackWalkEventGuid &&
            record.EventHeader.EventDescriptor.Opcode == 32 &&
            record.EventHeader.EventDescriptor.Version == 2);
 }
Exemplo n.º 14
0
 private static DateTime GetNdisEventRecordTimestampUtc(EVENT_RECORD eventRecord)
 {
     return(DateTime.FromFileTime(eventRecord.EventHeader.TimeStamp));
 }