ETWDeserializer is a general-purpose Windows ETW event deserialization library. It can decode events from almost all sources of Windows including the Kernel (MOF Classes), Manifest events (those available beyond Windows Vista), XPERF performance profiling events, and .NET EventSource-style events.
NOTE: This is a support library, i.e. the user of this library must setup the boiler-plate code involved in setting up an ETW Session or reading an ETW log file (.ETL). ETW2JSON and ETW2SQLite are two such applications.
Implement the IEtwWriter
interface exposed by the library and add boiler plate code to set up an ETW event session or reading from an ETW log file (.ETL)
ETW2JSON and ETW2SQLite each implement their own IEtwWriter
and also the code involved in reading an ETW log file from disk.
This library is available on Nuget -- https://www.nuget.org/packages/ETWDeserializer/1.2.0
Since this is a Windows-specific library, I'm assuming you're also building on Windows and have MSBuild Tools installed, in which case:
msbuild ETWDeserializer.csproj
is all you need to do.