microsoft / microsoft/perfview

How to create an ETW session that is both real-time and saved to ETL?

Open
#2,174 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
C#
Stars
4.7k
Forks
775
Avg merge
5d 11h
Merged PRs (30d)
9

Description

I am writing an ETW viewer (with a focus on real-time viewing), and I am using the Microsoft.Diagnostics.Tracing.TraceEvent .NET library because it looks like it has the most thorough support for parsing trace events. However, the one thing that I can't seem to do is create a real-time session that also logs to an ETL file. I have gotten multiple feature requests for this because my users want to watch their tracing in real-time but also have the ETL available to share if they encounter a bug.

The ability to do this is documented on the EVENT_TRACE_PROPERTIES struct:

If you specify only real-time logging and also provide an offset with a valid log file name, ETW will use the log file name to create a sequential log file and log events to the log file in addition to sending the events to real-time consumers. ETW also creates the sequential log file if LogFileMode is 0 and you provide an offset with a valid log file name.

As far as I can tell, this is not supported by Microsoft.Diagnostics.Tracing.TraceEvent. Is this something that could be added? It's a simple change to support through the Win32 API, but I don't know how much of this library has assumptions that they are mutually exclusive.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

The issue names Microsoft.Diagnostics.Tracing.TraceEvent and the EVENT_TRACE_PROPERTIES Win32 API, but no file or test. Locate the session-creation entry point and check assumptions that real-time and ETL logging are mutually exclusive. Done means a session can stream events in real time while also saving them to an ETL file.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
observability-sre, performance
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.