private bool DecodeEvent(EventRecord eventRecord, out DecodedEtwEvent decodedEvent) { decodedEvent = new DecodedEtwEvent { EventRecord = eventRecord }; if (false == ManifestCache.IsStringEvent(eventRecord)) { var eventDefinition = this.etwManifestCache.GetEventDefinition( eventRecord); if (null == eventDefinition) { if (!EventSourceHelper.CheckForDynamicManifest(eventRecord.EventHeader.EventDescriptor)) { // We couldn't decode this event. Skip it. this.traceSource.WriteError( this.logSourceId, "Unable to decode ETW event. The event will be skipped. Event ID: {0}, Task: {1}, Level: {2}.", eventRecord.EventHeader.EventDescriptor.Id, eventRecord.EventHeader.EventDescriptor.Task, eventRecord.EventHeader.EventDescriptor.Level); } return(false); } if (eventDefinition.IsChildEvent) { // Try to format the event. This causes the ETL reader to save information // about this event. That information is later retrieved when the parent // event is processed. string childEventType; string childEventText; var childStringRepresentation = this.etwManifestCache.FormatEvent( eventRecord, out childEventType, out childEventText); // Only parent events can be decoded. Child events supply additional // information about the parent event and cannot be decoded on their // own. return(false); } decodedEvent.TaskName = eventDefinition.TaskName; } else { decodedEvent.TaskName = EventFormatter.StringEventTaskName; } decodedEvent.Timestamp = DateTime.FromFileTimeUtc(eventRecord.EventHeader.TimeStamp); decodedEvent.Level = eventRecord.EventHeader.EventDescriptor.Level; decodedEvent.ThreadId = eventRecord.EventHeader.ThreadId; decodedEvent.ProcessId = eventRecord.EventHeader.ProcessId; decodedEvent.StringRepresentation = this.etwManifestCache.FormatEvent( eventRecord, out decodedEvent.EventType, out decodedEvent.EventText); if (null == decodedEvent.StringRepresentation) { if (!EventSourceHelper.CheckForDynamicManifest(eventRecord.EventHeader.EventDescriptor)) { // We couldn't decode this event. Skip it. this.traceSource.WriteError( this.logSourceId, "Unable to decode ETW event. The event will be skipped. Event ID: {0}, Task: {1}, Level: {2}.", eventRecord.EventHeader.EventDescriptor.Id, eventRecord.EventHeader.EventDescriptor.Task, eventRecord.EventHeader.EventDescriptor.Level); return(false); } } // If this is an FMM event, update the last timestamp of FMM events if ((WinFabricEtlType.DefaultEtl == this.windowsFabricEtlType) && decodedEvent.TaskName.Equals(Utility.FmmTaskName)) { Utility.LastFmmEventTimestamp = decodedEvent.Timestamp; } return(true); }
private void ProcessEtwEvent(EventRecord eventRecord, EtwEventTimestamp eventTimestamp) { try { // Get the event definition EventDefinition eventDefinition = this.manifestCache.GetEventDefinition( eventRecord); // Ignore event source manifests and heartbeat events if ((eventDefinition == null && eventRecord.EventHeader.EventDescriptor.Id == 0) || EventSourceHelper.CheckForDynamicManifest(eventRecord.EventHeader.EventDescriptor)) { return; } bool unexpectedEvent = false; if (eventDefinition.TaskName.Equals(HostingTaskName)) { // Verify event name if (eventDefinition.EventName.Equals(ServicePackageActivatedEventName)) { this.ProcessServicePackageActiveEvent( eventRecord, eventDefinition.TaskName, eventDefinition.EventName, eventTimestamp, MaxServicePackageActivatedEventVersion); } else if (eventDefinition.EventName.Equals(ServicePackageUpgradedEventName)) { this.ProcessServicePackageActiveEvent( eventRecord, eventDefinition.TaskName, eventDefinition.EventName, eventTimestamp, MaxServicePackageUpgradedEventVersion); } else if (eventDefinition.EventName.Equals(ServicePackageDeactivatedEventName)) { this.ProcessServicePackageInactiveEvent( eventRecord, eventDefinition.TaskName, eventDefinition.EventName, eventTimestamp, false); } else { unexpectedEvent = true; } } else if (eventDefinition.TaskName.Equals(DcaTaskName)) { if (eventDefinition.EventName.Equals(ServicePackageInactiveEventName)) { this.ProcessServicePackageInactiveEvent( eventRecord, eventDefinition.TaskName, eventDefinition.EventName, eventTimestamp, true); } else { unexpectedEvent = true; } } else { unexpectedEvent = true; } if (unexpectedEvent) { Utility.TraceSource.WriteWarning( TraceType, "Unexpected event (task name {0}, event name {1}) encountered. Event will be ignored.", eventDefinition.TaskName, eventDefinition.EventName); } } catch (Exception e) { Utility.TraceSource.WriteError( TraceType, "Exception encountered while processing event with ID {0}, Task {1}. Exception information: {2}.", eventRecord.EventHeader.EventDescriptor.Id, eventRecord.EventHeader.EventDescriptor.Task, e); } }