/// <summary>
/// Hooks to real-time ETW session. The session must be created ahead of time
/// </summary>
/// <param name="sessionName">the real-time session name</param>
/// <returns></returns>
public static IObservable <IDictionary <string, object> > FromSession(string sessionName)
{
EtwTdhDeserializer d = new EtwTdhDeserializer();
var session = EtwObservable.FromSession(sessionName);
return(session.Select(e => d.Deserialize(ref e)));
}
/// <summary>
/// Creates a reader for one or more .etl (Event Trace Log) files
/// </summary>
/// <param name="etlFiles">up to 63 files to read</param>
/// <returns>sequence of events ordered by timestamp</returns>
public static IObservable <IDictionary <string, object> > FromFiles(params string[] etlFiles)
{
EtwTdhDeserializer d = new EtwTdhDeserializer();
var file = EtwObservable.FromFiles(etlFiles);
return(file.Select(e => d.Deserialize(ref e)));
}
/// <summary>
/// Method that materializes the event br reading (deserializing) the ETW data
/// Calling this second time is ignored as the event is already materialized
/// </summary>
void Materialize()
{
if (_materializedEvent != null)
{
return; // the event is already materialized
}
_materializedEvent = _deserializer.Deserialize(ref _nativeEvent);
}
