Add ETW probe support
- Dominant language
- C++
- Stars
- 379
- Forks
- 52
- PR merge metrics
- No merged PRs in 30d
Description
The PID and FBT probe types can't be supported until the signing requirements of the dtrace system/kernel extensions is changed by microsoft - as they use the windows hypervisor which doesn't boot when SB and DSE are set to off. The ETW probe type however doesn't rely on the hypervisor and should be implementable. If someone wants to perform that research, lets chat here.
Contributor guide
No contributing guide indexed for this repository
Research direction
No files or tests are named. Start by researching how STrace represents probe types and how Windows ETW can provide equivalent probe support, using the signing and hypervisor constraints as context. Done means ETW probe support is implemented and its behavior is validated.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- observability-sre, operating-systems
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100