Microsoft .NET Samples

The TraceEvent library provides extensive capabilities for ETW monitoring and analysis, including:

• Real-time & File Monitoring: Monitor ETW events in real-time (via programmatic callbacks or IObservable for Reactive Extensions) or scan .etl files.
• Provider Management: Selectively enable providers using ETW 'Keywords' and 'Levels', and enumerate system/process providers.
• File Operations: Merge multiple .etl files or read/write/filter ETL files (Windows 8+).
• Stack Tracing: Capture and convert stacks to symbolic form for .NET, JScript, and native code.
• Advanced Formats: Store events in the ETLX format for efficient random access and backward/forward enumeration.
• Code Generation: Use TraceParserGen to generate strongly typed C# parsers from any ETW manifest.
• Kernel Event Access: Monitor process/thread lifecycle, CPU samples, context switches, page faults, disk/file/network I/O, registry access, and system calls.
• CLR (.NET) Event Access: Monitor GCs, allocations, object movement, JIT compilation, exceptions, and Task scheduling.
• Specialized Runtimes: Access ASP.NET, WCF, and JScript runtime events.

Concept: EventSource for ETW

EventSource is a central class used by managed-code developers to create strongly typed specifications for logging events that can be captured by Event Tracing for Windows (ETW).

Instead of passing verbosity levels or event IDs at every call site, you define a class that encapsulates the event structure. This results in a 'minimal' call site where you only provide the logging object, the method representing the event, and the necessary strongly typed parameters.

Key Benefits:

• Strong Typing: Parameters (like int, string, or DateTime) are preserved through the event pipeline, eliminating the need for string parsing in viewers.
• Minimal Call Sites: The application code remains clean, focusing only on the data being logged rather than the tracing infrastructure.
• ETW Integration: Events are natively compatible with ETW tools like PerfView.

// Example of a minimal call site
MinimalEventSource.Log.Load(0x40000, "MyFile0");

While EventSource classes should generally be sealed, you can use an abstract base class to provide common, optimized WriteEvent overloads to multiple derived EventSource types.

Constraints for Abstract Base Classes:

• They cannot define ETW-specific elements like Keywords, Tasks, Opcodes, Channels, or Events.
• They can only provide methods (like optimized WriteEvent wrappers) to be used by derived classes.

public abstract class UtilBaseEventSource : EventSource
{
    protected UtilBaseEventSource() : base() { }
    protected UtilBaseEventSource(bool throwOnEventWriteErrors) : base(throwOnEventWriteErrors) { }

    protected unsafe void WriteEvent(int eventId, int arg1, short arg2, long arg3)
    {
        if (IsEnabled())
        {
            EventSource.EventData* descrs = stackalloc EventSource.EventData[3];
            descrs[0].DataPointer = (IntPtr)(&arg1);
            descrs[0].Size = 4;
            descrs[1].DataPointer = (IntPtr)(&arg2);
            descrs[1].Size = 2;
            descrs[2].DataPointer = (IntPtr)(&arg3);
            descrs[2].Size = 8;
            WriteEventCore(eventId, 3, descrs);
        }
    }
}

[EventSource(Name = "OptimizedEventSource")]
public sealed class OptimizedEventSource : UtilBaseEventSource
{
    public static OptimizedEventSource Log = new OptimizedEventSource();

    [Event(1, Keywords = Keywords.Kwd1, Level = EventLevel.Informational, 
           Message = "LogElements called {0}/{1}/{2}.")]
    public void LogElements(int n, short sh, long l)
    {
        WriteEvent(1, n, sh, l); // Calls UtilBaseEventSource.WriteEvent
    }

    public static class Keywords
    {
        public const EventKeywords Kwd1 = (EventKeywords)1;
    }
}