Skip to content

How to create an ETW session that is both real-time and saved to ETL? #2174

Open
@brycehutchings

Description

@brycehutchings

I am writing an ETW viewer (with a focus on real-time viewing), and I am using the Microsoft.Diagnostics.Tracing.TraceEvent .NET library because it looks like it has the most thorough support for parsing trace events. However, the one thing that I can't seem to do is create a real-time session that also logs to an ETL file. I have gotten multiple feature requests for this because my users want to watch their tracing in real-time but also have the ETL available to share if they encounter a bug.

The ability to do this is documented on the EVENT_TRACE_PROPERTIES struct:

If you specify only real-time logging and also provide an offset with a valid log file name, ETW will use the log file name to create a sequential log file and log events to the log file in addition to sending the events to real-time consumers. ETW also creates the sequential log file if LogFileMode is 0 and you provide an offset with a valid log file name.

As far as I can tell, this is not supported by Microsoft.Diagnostics.Tracing.TraceEvent. Is this something that could be added? It's a simple change to support through the Win32 API, but I don't know how much of this library has assumptions that they are mutually exclusive.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions