internal static void StopSession() { ulong sessionHandle = 0; GetSessionHandle(ref sessionHandle); // session not exists if (sessionHandle == 0) { return; } // disable provider first Guid providerGuid = new Guid(WsatProviderGuid); uint err = SafeNativeMethods.EnableTrace(0, 0, 0, ref providerGuid, sessionHandle); if (err == SafeNativeMethods.ERROR_SUCCESS) { EVENT_TRACE_PROPERTIES properties = new EVENT_TRACE_PROPERTIES(String.Empty, String.Empty); err = SafeNativeMethods.StopTrace(0, WsatTraceSessionName, ref properties); } // still check for SessionExist as the StopTrace API always treats us if (err != SafeNativeMethods.ERROR_SUCCESS || IsSessionExist()) { if (err == SafeNativeMethods.ERROR_ACCESS_DENIED) { // throw access denied throw new WsatAdminException(WsatAdminErrorCode.ETW_SESSION_ACCESS_DENIED, SR.GetString(SR.ErrorSessionStopAccessDenied)); } else { // throw general error message throw new WsatAdminException(WsatAdminErrorCode.ETW_SESSION_ERROR, SR.GetString(SR.ErrorSessionStop, err)); } } }
internal static void StartSession(uint logFileSize) { if (IsSessionExist()) { return; } string logFileName = String.Empty; uint logBuffers = 0; ReadParamFromReg(out logFileName, out logBuffers); BackUpLogFile(logFileName); EVENT_TRACE_PROPERTIES properties = new EVENT_TRACE_PROPERTIES(WsatTraceSessionName, logFileName); ulong sessionHandle = 0; properties.Head.Wnode.Flags = SafeNativeMethods.WNODE_FLAG_TRACED_GUID; properties.Head.Wnode.Guid = new Guid(WsatTraceSessionGuid); properties.Head.Wnode.ClientContext = 1; //QPC clock resolution properties.Head.LogFileMode = SafeNativeMethods.EVENT_TRACE_FILE_MODE_CIRCULAR | SafeNativeMethods.EVENT_TRACE_USE_PAGED_MEMORY; properties.Head.MaximumBuffers = logBuffers; properties.Head.MaximumFileSize = logFileSize; uint err = SafeNativeMethods.StartTrace(out sessionHandle, WsatTraceSessionName, ref properties); if (err != SafeNativeMethods.ERROR_SUCCESS) { switch (err) { case SafeNativeMethods.ERROR_BAD_PATHNAME: throw new WsatAdminException(WsatAdminErrorCode.ETW_SESSION_BAD_PATHNAME, SR.GetString(SR.ErrorSessionStartBadPathname)); case SafeNativeMethods.ERROR_DISK_FULL: throw new WsatAdminException(WsatAdminErrorCode.ETW_SESSION_DISK_FULL, SR.GetString(SR.ErrorSessionStartDiskFull)); case SafeNativeMethods.ERROR_FILE_NOT_FOUND: throw new WsatAdminException(WsatAdminErrorCode.ETW_SESSION_FILE_NOT_FOUND, SR.GetString(SR.ErrorSessionStartFileNotFound, logFileName)); case SafeNativeMethods.ERROR_PATH_NOT_FOUND: throw new WsatAdminException(WsatAdminErrorCode.ETW_SESSION_PATH_NOT_FOUND, SR.GetString(SR.ErrorSessionStartPathNotFound, logFileName)); default: throw new WsatAdminException(WsatAdminErrorCode.ETW_SESSION_ERROR, SR.GetString(SR.ErrorSessionStart, err)); } } Guid providerGuid = new Guid(WsatProviderGuid); err = SafeNativeMethods.EnableTrace(1, 0, 0, ref providerGuid, sessionHandle); if (err != SafeNativeMethods.ERROR_SUCCESS) { // stop trace session EVENT_TRACE_PROPERTIES properties2 = new EVENT_TRACE_PROPERTIES(String.Empty, String.Empty); SafeNativeMethods.StopTrace(0, WsatTraceSessionName, ref properties2); if (err == SafeNativeMethods.ERROR_ACCESS_DENIED) { throw new WsatAdminException(WsatAdminErrorCode.ETW_SESSION_ACCESS_DENIED, SR.GetString(SR.ErrorSessionEnableProviderAccessDenied)); } else { throw new WsatAdminException(WsatAdminErrorCode.ETW_SESSION_ERROR, SR.GetString(SR.ErrorSessionEnableProviderError, err)); } } SaveMaxTraceFileSizeToReg(logFileSize); }