microsoft / microsoft/perfview

Handles events, Windows 10 and "NT Kernel session" in EventTracing API

Open
#1,776 0 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
C#
Stars
4.7k
Forks
775
Avg merge
5d 11h
Merged PRs (30d)
9

Description

I was under impression that you do not need special singleton "kernel" session called "NT Kernel Logger" starting from Windows 8 or something like that anymore.

And indeed this is true when I work with EventTracing API (TraceEventSession object) EnableKernelProvider with "KernelTraceEventParser.Keywords.Process" and such flags. Before in Win7 I needed this session, now I don't.

However, if/when I try run it with "KernelTraceEventParser.Keywords.Handle" flag I get an error (On Windows 10) that I need to have this single session.
I checked the source code there and it looks like it comes from following check: in "EnableKernelProvider" :

if (m_SessionName != KernelTraceEventParser.KernelSessionName) { if ((flags & KernelTraceEventParser.NonOSKeywords) != 0) { throw new NotSupportedException("Keyword specified this is only supported on the " + KernelTraceEventParser.KernelSessionName + " session."); }

So, assuming there is a bug in NonOSKeywords definition I removed this check, now it all passed but handle events ("ObjectCreateHandle" and so on) do not happen (even after my fix in https://github.com/microsoft/perfview/issues/1768 )

So basically I have a two part question:

  1. If this intentional/required to have this single session in Win10 too to work with handles event ? Or it just result as @brianrob mentioned in other bug this flow was never executed and tested at all ?
  2. If later :) is it possible to fix it ? As my understanding (or better to say luck of it :)) of inner workings of the internal native API that does event tracing does not allow me to understand whats going on there and fix it.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with TraceEventSession.EnableKernelProvider and the KernelTraceEventParser.NonOSKeywords and KernelSessionName checks described in the issue. Reproduce the Handle-keyword behavior on Windows 10, including the result from issue 1768, and trace whether ObjectCreateHandle events are emitted. Done means documenting or fixing the required session behavior with a regression test or clear reproduction result.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
operating-systems, performance
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.