microsoft / microsoft/perfview
How to create an ETW session that is both real-time and saved to ETL?
Nobody has claimed this yet.
- Dominant language
- C#
- Stars
- 4.7k
- Forks
- 775
- Avg merge
- 5d 11h
- Merged PRs (30d)
- 9
Description
I am writing an ETW viewer (with a focus on real-time viewing), and I am using the Microsoft.Diagnostics.Tracing.TraceEvent .NET library because it looks like it has the most thorough support for parsing trace events. However, the one thing that I can't seem to do is create a real-time session that also logs to an ETL file. I have gotten multiple feature requests for this because my users want to watch their tracing in real-time but also have the ETL available to share if they encounter a bug.
The ability to do this is documented on the EVENT_TRACE_PROPERTIES struct:
If you specify only real-time logging and also provide an offset with a valid log file name, ETW will use the log file name to create a sequential log file and log events to the log file in addition to sending the events to real-time consumers. ETW also creates the sequential log file if LogFileMode is 0 and you provide an offset with a valid log file name.
As far as I can tell, this is not supported by Microsoft.Diagnostics.Tracing.TraceEvent. Is this something that could be added? It's a simple change to support through the Win32 API, but I don't know how much of this library has assumptions that they are mutually exclusive.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue names Microsoft.Diagnostics.Tracing.TraceEvent and the EVENT_TRACE_PROPERTIES Win32 API, but no file or test. Locate the session-creation entry point and check assumptions that real-time and ETL logging are mutually exclusive. Done means a session can stream events in real time while also saving them to an ETL file.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp
- Domain
- observability-sre, performance
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100