private static NativeMethods.EventTraceProperties ControlTrace(
string sessionName, NativeMethods.TraceControl traceControl, out int errorCode)
{
lock (sharedBufferLock)
{
var traceProperties = new NativeMethods.EventTraceProperties
{
LoggerNameOffset = TracePropertiesSize,
LogFileNameOffset = TracePropertiesSize + (MaxNameSize * sizeof(char)),
Wnode = new NativeMethods.WnodeHeader
{
BufferSize = TracePropertiesSize + ExtSize,
}
};
NativeMethods.ZeroMemory(sharedBuffer, traceProperties.Wnode.BufferSize);
Marshal.StructureToPtr(traceProperties, sharedBuffer, true);
errorCode = NativeMethods.ControlTrace(
0,
sessionName,
sharedBuffer,
(uint)traceControl);
traceProperties = (NativeMethods.EventTraceProperties)Marshal.PtrToStructure(
sharedBuffer, typeof(NativeMethods.EventTraceProperties));
return(traceProperties);
}
}
public static NativeMethods.EventTraceProperties GetProperties(string sessionName, Guid providerGuid, string path)
{
NativeMethods.EventTraceProperties properties = new NativeMethods.EventTraceProperties();
NativeMethods.LogFileMode fileMode = NativeMethods.LogFileMode.EVENT_TRACE_FILE_MODE_NEWFILE;
properties.etp.wnode.bufferSize = (uint)Marshal.SizeOf(properties);
properties.etp.wnode.guid = providerGuid;
properties.etp.wnode.flags = NativeMethods.WnodeFlagTracedGuid;
properties.etp.wnode.clientContext = 1; // Query performance counter for time stamp
properties.etp.bufferSize = 64;
properties.etp.minimumBuffers = 10;
properties.etp.maximumBuffers = 10;
properties.etp.maximumFileSize = 10 * 1024;
properties.etp.logFileMode =
(uint)(fileMode |
NativeMethods.LogFileMode.EVENT_TRACE_USE_PAGED_MEMORY |
NativeMethods.LogFileMode.EVENT_TRACE_USE_LOCAL_SEQUENCE);
properties.etp.flushTimer = (uint)10;
properties.etp.enableFlags = 0;
properties.etp.logFileNameOffset = (uint)Marshal.OffsetOf(typeof(NativeMethods.EventTraceProperties), "logFileName");
properties.etp.loggerNameOffset = (uint)Marshal.OffsetOf(typeof(NativeMethods.EventTraceProperties), "loggerName");
properties.logFileName = path;
properties.loggerName = sessionName;
return(properties);
}
public static bool TryGetCurrentFileOfSession(string sessionName, out string currentSessionFile)
{
currentSessionFile = null;
lock (sharedBufferLock)
{
var traceProperties = new NativeMethods.EventTraceProperties
{
LoggerNameOffset = TracePropertiesSize,
LogFileNameOffset = TracePropertiesSize + (MaxNameSize * sizeof(char)),
Wnode = new NativeMethods.WnodeHeader
{
BufferSize = TracePropertiesSize + ExtSize,
}
};
NativeMethods.ZeroMemory(sharedBuffer, traceProperties.Wnode.BufferSize);
Marshal.StructureToPtr(traceProperties, sharedBuffer, true);
var errorCode = NativeMethods.ControlTrace(
0,
sessionName,
sharedBuffer,
(int)NativeMethods.TraceControl.Query);
var tracePropertiesPtr = (NativeMethods.EventTraceProperties *)sharedBuffer;
if (errorCode == NativeMethods.ErrorSuccess && tracePropertiesPtr->LogFileNameOffset > 0)
{
currentSessionFile = new string((char *)(tracePropertiesPtr + (int)tracePropertiesPtr->LogFileNameOffset));
}
return(errorCode == NativeMethods.ErrorSuccess && currentSessionFile != null);
}
}
public static NativeMethods.EventTraceProperties GetProperties(string sessionName, Guid providerGuid, string path)
{
NativeMethods.EventTraceProperties properties = new NativeMethods.EventTraceProperties();
NativeMethods.LogFileMode fileMode = NativeMethods.LogFileMode.EVENT_TRACE_FILE_MODE_NEWFILE;
properties.etp.wnode.bufferSize = (uint)Marshal.SizeOf(properties);
properties.etp.wnode.guid = providerGuid;
properties.etp.wnode.flags = NativeMethods.WnodeFlagTracedGuid;
properties.etp.wnode.clientContext = 1; // Query performance counter for time stamp
properties.etp.bufferSize = 64;
properties.etp.minimumBuffers = 10;
properties.etp.maximumBuffers = 10;
properties.etp.maximumFileSize = 10 * 1024;
properties.etp.logFileMode =
(uint)(fileMode |
NativeMethods.LogFileMode.EVENT_TRACE_USE_PAGED_MEMORY |
NativeMethods.LogFileMode.EVENT_TRACE_USE_LOCAL_SEQUENCE);
properties.etp.flushTimer = (uint)10;
properties.etp.enableFlags = 0;
properties.etp.logFileNameOffset = (uint)Marshal.OffsetOf(typeof(NativeMethods.EventTraceProperties), "logFileName");
properties.etp.loggerNameOffset = (uint)Marshal.OffsetOf(typeof(NativeMethods.EventTraceProperties), "loggerName");
properties.logFileName = path;
properties.loggerName = sessionName;
return properties;
}
/// <summary>
/// Attempts to retrieve the properties (including status) of the given ETW session.
/// </summary>
/// <param name="sessionName">
/// The name for the session which the caller wants to retrieve the properties.
/// </param>
/// <param name="traceProperties">
/// The <see cref="NativeMethods.EventTraceProperties"/> instance describing the session passed
/// by the caller. It contains valid data only if the method returns true;.
/// </param>
/// <returns>
/// True if the function retrieved the session properties, false otherwise.
/// </returns>
public static bool TryGetSessionProperties(string sessionName, out NativeMethods.EventTraceProperties traceProperties)
{
int result;
traceProperties = ControlTrace(sessionName, NativeMethods.TraceControl.Query, out result);
return(result == NativeMethods.ErrorSuccess);
}
static void Main(string[] args)
{
string sessionName = "myEtlSession";
Guid providerGuid = Guid.NewGuid();
NativeMethods.EventTraceProperties properties = Program.GetProperties(
sessionName,
providerGuid,
Utils.GetFilePath("MyEtlFile_%d.etl"));
long sessionHandle = 0;
long eventRegisterHandle = 0;
try
{
Utils.RunWithErrorCodeCheck(() => NativeMethods.StartTrace(out sessionHandle, sessionName, ref properties));
// This call associates a specific trace provider with an etl session.
NativeMethods.EnableTraceParameters enableParameters = new NativeMethods.EnableTraceParameters();
enableParameters.Version = NativeMethods.ENABLE_TRACE_PARAMETERS_VERSION;
enableParameters.SourceId = providerGuid;
enableParameters.ControlFlags = 0;
unsafe
{
Utils.RunWithErrorCodeCheck(() => NativeMethods.EventRegister(ref providerGuid, null, null, ref eventRegisterHandle));
Utils.RunWithErrorCodeCheck(() => NativeMethods.EnableTraceEx2(
sessionHandle,
ref providerGuid,
(uint)NativeMethods.EnableTraceControlCode.Enable,
(byte)NativeMethods.TraceLevel.Verbose,
0,
0,
1000,
ref enableParameters));
string myData = "Hello world";
int dataLength = Encoding.ASCII.GetByteCount(myData) + sizeof(byte);
byte[] buffer = new byte[dataLength];
Encoding.ASCII.GetBytes(myData, 0, myData.Length, buffer, 0);
fixed(byte *nativeBuffer = buffer)
{
NativeMethods.EventDefinition eventDefinition = new NativeMethods.EventDefinition();
NativeMethods.EventData * eventData = stackalloc NativeMethods.EventData[1];
eventData[0].DataPointer = (IntPtr)nativeBuffer;
eventData[0].Size = dataLength;
Utils.RunWithErrorCodeCheck(() => NativeMethods.EventWrite(
eventRegisterHandle,
ref eventDefinition,
1,
eventData));
}
}
}
finally
{
Utils.RunWithErrorCodeCheck(() => NativeMethods.EventUnregister(eventRegisterHandle));
Utils.RunWithErrorCodeCheck(() => NativeMethods.ControlTrace(
0, // sessionHandle
sessionName,
ref properties,
(uint)NativeMethods.ControlTraceCode.Stop));
}
}
private static void Main(string[] args)
{
/*using (MyEventListener myListener = new MyEventListener())
* using (MyEventSource source = new MyEventSource())
* {
* myListener.EnableEvents(source, EventLevel.Verbose);
* if (source.ConstructionException != null)
* {
* throw source.ConstructionException;
* }
*
* source.String("Hello world");
* source.Int(10);
* source.Bool(true);
* }*/
/*string sessionName = "MySession";
* using (MyEventSource source = new MyEventSource())
* using (TraceEventSession session = new TraceEventSession(sessionName, null)) // the null second parameter means 'real time session'
* using (ETWTraceEventSource eventSource = new ETWTraceEventSource(sessionName, TraceEventSourceType.Session))
* {
* DynamicTraceEventParser parser = new DynamicTraceEventParser(eventSource);
* parser.All += delegate(TraceEvent data)
* {
* Console.WriteLine("Event name:{0}. Payload:{1}.", data.EventName, data.PayloadValue(0));
* };
*
* session.EnableProvider(source.Guid);
* source.String("Hello world");
* source.Int(123);
* eventSource.Process();
* }*/
string sessionName = "myEtlSession";
NativeMethods.EventTraceProperties properties = Program.GetProperties(
sessionName,
Program.providerGuid,
@"C:\Users\ulka\Documents\MyEtlFile_%d.etl");
//Path.Combine(Assembly.GetExecutingAssembly().Location, "MyEtlFile1_%d.etl"));
long sessionHandle = 0;
long eventRegisterHandle = 0;
try
{
uint errorCode = NativeMethods.StartTrace(out sessionHandle, sessionName, ref properties);
// This call associates a specific trace provider with an etl session.
NativeMethods.EnableTraceParameters enableParameters = new NativeMethods.EnableTraceParameters();
enableParameters.Version = NativeMethods.ENABLE_TRACE_PARAMETERS_VERSION;
enableParameters.SourceId = Program.providerGuid;
enableParameters.ControlFlags = 0;
unsafe
{
Guid providerGuid = Program.providerGuid;
errorCode = NativeMethods.EventRegister(ref providerGuid, null, null, ref eventRegisterHandle);
errorCode = NativeMethods.EnableTraceEx2(
sessionHandle,
ref providerGuid,
(uint)NativeMethods.EnableTraceControlCode.Enable,
(byte)NativeMethods.TraceLevel.Verbose,
0,
0,
1000,
ref enableParameters);
string myData = "Hello world";
int dataLength = Encoding.ASCII.GetByteCount(myData) + sizeof(byte);
byte[] buffer = new byte[dataLength];
Encoding.ASCII.GetBytes(myData, 0, myData.Length, buffer, 0);
fixed(byte *nativeBuffer = buffer)
{
NativeMethods.EventDefinition eventDefinition = new NativeMethods.EventDefinition();
NativeMethods.EventData * eventData = stackalloc NativeMethods.EventData[1];
eventData[0].DataPointer = (IntPtr)nativeBuffer;
eventData[0].Size = dataLength;
errorCode = NativeMethods.EventWrite(
eventRegisterHandle,
ref eventDefinition,
1,
eventData);
}
}
}
finally
{
uint errorCode = NativeMethods.EventUnregister(eventRegisterHandle);
errorCode = NativeMethods.ControlTrace(
0, // sessionHandle
sessionName,
ref properties,
(uint)NativeMethods.ControlTraceCode.Stop);
}
NativeMethods.EventTraceLogfile eventTraceLogfile = new NativeMethods.EventTraceLogfile();
eventTraceLogfile.LogFileName = @"C:\Users\ulka\Documents\MyEtlFile_1.etl";
eventTraceLogfile.LogFileMode = NativeMethods.ProcessTraceMode.PROCESS_TRACE_MODE_EVENT_RECORD;
eventTraceLogfile.BufferCallback = BufferCallback;
eventTraceLogfile.EventCallback.EventRecord = EventRecord;
long traceHandle = -1;
try
{
traceHandle = NativeMethods.OpenTrace(ref eventTraceLogfile);
uint hresult = NativeMethods.ProcessTrace(new long[] { traceHandle }, 1, IntPtr.Zero, IntPtr.Zero);
}
finally
{
NativeMethods.CloseTrace(traceHandle);
}
}
static void Main(string[] args)
{
string sessionName = "myEtlSession";
NativeMethods.EventTraceProperties properties = Program.GetProperties(
sessionName,
Program.providerGuid,
Utils.GetFilePath("MyEtlFile_%d.etl"));
long sessionHandle = 0;
long eventRegisterHandle = 0;
try
{
Utils.RunWithErrorCodeCheck(() => NativeMethods.StartTrace(out sessionHandle, sessionName, ref properties));
NativeMethods.EnableTraceParameters enableParameters = new NativeMethods.EnableTraceParameters();
enableParameters.Version = NativeMethods.ENABLE_TRACE_PARAMETERS_VERSION;
enableParameters.SourceId = Program.providerGuid;
enableParameters.ControlFlags = 0;
unsafe
{
Guid providerGuid = Program.providerGuid;
Utils.RunWithErrorCodeCheck(() => NativeMethods.EventRegister(ref providerGuid, null, null, ref eventRegisterHandle));
Utils.RunWithErrorCodeCheck(() => NativeMethods.EnableTraceEx2(
sessionHandle,
ref providerGuid,
(uint)NativeMethods.EnableTraceControlCode.Enable,
(byte)NativeMethods.TraceLevel.Verbose,
0,
0,
1000,
ref enableParameters));
string myData = "Hello world";
int dataLength = Encoding.ASCII.GetByteCount(myData) + sizeof(byte);
byte[] buffer = new byte[dataLength];
Encoding.ASCII.GetBytes(myData, 0, myData.Length, buffer, 0);
fixed(byte *nativeBuffer = buffer)
{
NativeMethods.EventDefinition eventDefinition = new NativeMethods.EventDefinition();
NativeMethods.EventData * eventData = stackalloc NativeMethods.EventData[1];
eventData[0].DataPointer = (IntPtr)nativeBuffer;
eventData[0].Size = dataLength;
Utils.RunWithErrorCodeCheck(() => NativeMethods.EventWrite(
eventRegisterHandle,
ref eventDefinition,
1,
eventData));
}
}
}
finally
{
Utils.RunWithErrorCodeCheck(() => NativeMethods.EventUnregister(eventRegisterHandle));
Utils.RunWithErrorCodeCheck(() => NativeMethods.ControlTrace(
0, // sessionHandle
sessionName,
ref properties,
(uint)NativeMethods.ControlTraceCode.Stop));
}
NativeMethods.EventTraceLogfile eventTraceLogfile = new NativeMethods.EventTraceLogfile();
eventTraceLogfile.LogFileName = Utils.GetFilePath("MyEtlFile_1.etl");
eventTraceLogfile.LogFileMode = NativeMethods.ProcessTraceMode.PROCESS_TRACE_MODE_EVENT_RECORD;
eventTraceLogfile.BufferCallback = BufferCallback;
eventTraceLogfile.EventCallback.EventRecord = EventRecord;
long traceHandle = -1;
try
{
traceHandle = NativeMethods.OpenTrace(ref eventTraceLogfile);
Utils.RunWithErrorCodeCheck(() => NativeMethods.ProcessTrace(new long[] { traceHandle }, 1, IntPtr.Zero, IntPtr.Zero));
}
finally
{
Utils.RunWithErrorCodeCheck(() => NativeMethods.CloseTrace(traceHandle));
}
}