microsoft / microsoft/krabsetw
Better performance in event parser property_iterator
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 801
- Forks
- 167
- Avg merge
- 3d 15m
- Merged PRs (30d)
- 2
Description
Hi,
I am using ETW (and krabs) very intensively in my code, I am parsing different events at a very high rate (filesystem, registry...)
To increase the performance of the parsing I am using the helpful propery_iterator instead of calls to find_property to eliminate the parser.propertyCache_ population. (to not use the find_property function, I am caching the result of size_provider::get_property_size too, then I am using pointer arithmetic to access the data in UserData)
I changed the member name_ in the class property in property.hpp used by the class property_iterator to be a const wchar_t* instead of a std::wstring. That permits me to reduce drastically the allocation rate of my code.
I think this low-level infrastructure should postpone such conversion and give the choice to the consumer to transform it (in my case with c++17 string_view give me a way to modernly work without reallocation by example)
What do you think?
Mathieu
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with property.hpp and the property_iterator implementation, then trace size_provider::get_property_size, find_property, parser.propertyCache_, and UserData access. Compare the current property-name ownership and allocation behavior with the issue's proposed deferred conversion. Done means the parser can avoid unnecessary name allocations while preserving a clear consumer-facing way to access property names.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- operating-systems
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100