/// <summary> /// Do intialization common to the contructors. /// </summary> private void Init(string sessionName) { this.sessionHandle = TraceEventNativeMethods.INVALID_HANDLE_VALUE; if (sessionName.Length > MaxNameSize - 1) throw new ArgumentException("File name too long", "sessionName"); this.sessionName = sessionName; properties = new TraceEventNativeMethods.EVENT_TRACE_PROPERTIES(); properties.Wnode.Flags = TraceEventNativeMethods.WNODE_FLAG_TRACED_GUID; properties.LoggerNameOffset = (uint)Marshal.SizeOf(typeof(TraceEventNativeMethods.EVENT_TRACE_PROPERTIES)); properties.LogFileNameOffset = properties.LoggerNameOffset + MaxNameSize * sizeof(char); extentionSpaceOffset = properties.LogFileNameOffset + MaxNameSize * sizeof(char); // #sizeCalculation properties.Wnode.BufferSize = extentionSpaceOffset + 8 + 8 * 4 + 4 + maxStackTraceProviders * 4; unmanagedPropertiesBuffer = TraceEventNativeMethods.AllocHGlobal((int) properties.Wnode.BufferSize); TraceEventNativeMethods.ZeroMemory(unmanagedPropertiesBuffer, properties.Wnode.BufferSize); }
/// <summary> /// Open an existing Windows Event Tracing Session, with name 'sessionName'. /// /// If you are opening a new session use TraceEventSession(string, string). /// /// To support the illusion that you can have a session with both kernel and user events, /// TraceEventSession might start up both a kernel and a user session. When you want to 'attach' /// to such a combined session, the constructor needs to know if you want to control the kernel /// session or not. If attachKernelSession is true, then it opens both sessions (and thus 'Close' /// will operation on both sessions. /// </summary> public TraceEventSession(string sessionName, bool attachKernelSession) { Init(sessionName); int hr = TraceEventNativeMethods.ControlTrace(0UL, sessionName, ToUnmanagedBuffer(properties, null), TraceEventNativeMethods.EVENT_TRACE_CONTROL_QUERY); Marshal.ThrowExceptionForHR(TraceEventNativeMethods.GetHRFromWin32(hr)); isActive = true; properties = (TraceEventNativeMethods.EVENT_TRACE_PROPERTIES)Marshal.PtrToStructure(unmanagedPropertiesBuffer, typeof(TraceEventNativeMethods.EVENT_TRACE_PROPERTIES)); if (properties.LogFileNameOffset != 0) fileName = Marshal.PtrToStringUni((IntPtr)(unmanagedPropertiesBuffer.ToInt64() + properties.LogFileNameOffset)); if (attachKernelSession) { bool success = false; try { kernelSession = new TraceEventSession(KernelTraceEventParser.KernelSessionName); success = true; } finally { if (!success) Stop(); } } }