Trying to get stack of event in real-time of the own (.net) process

[desdesdes]

Hi,

We would like to get a stack of an event using the real-time (non-file) based support of TraceLog. The event is published using an EventSource in the same (.net 8) process as the process which is hosting the TraceEventSession.

We where looking at the "41_TraceLogMonitor.cs" sample to implement this.

We have the basic sample running (and included) this sample does capture the event, but it only translated a very small part of the stack

CALLSTACK: CallStackIndex="39490"   <CodeAddress Address="0x7ffa106cff24" CodeAddressIndex="1343"/>
CallStackIndex="39489"   <CodeAddress Address="0x7ffa1065fed3" CodeAddressIndex="1342"/>
CallStackIndex="39488"   <CodeAddress Address="0x7ff8e11ccc2d" CodeAddressIndex="1341"/>
CallStackIndex="39487"   <CodeAddress Address="0x7ff8e13e450a" CodeAddressIndex="1340"/>
CallStackIndex="39486"   <CodeAddress Address="0x7ff8e13e4066" CodeAddressIndex="1348"/>
CallStackIndex="39485"   <CodeAddress Address="0x7ff8e13e6ebd" CodeAddressIndex="1347"/>
CallStackIndex="39484"   <CodeAddress Address="0x7ff8e13e6005" CodeAddressIndex="1346"/>
CallStackIndex="39483"   <CodeAddress Address="0x7ff882917a5d" CodeAddressIndex="1345" FullMethodName="TestCs.MyEventSource.Startup()" ModuleName="ManagedModule"/>
CallStackIndex="39446"   <CodeAddress Address="0x7ff8822336b5" CodeAddressIndex="1344"/>
CallStackIndex="39290"   <CodeAddress Address="0x7ff8e1d9b8c3" CodeAddressIndex="7"/>
CallStackIndex="39289"   <CodeAddress Address="0x7ff8e1cd0b19" CodeAddressIndex="1327"/>
CallStackIndex="39288"   <CodeAddress Address="0x7ff8e1ccd730" CodeAddressIndex="1326"/>
CallStackIndex="39287"   <CodeAddress Address="0x7ff8e1cf2fc6" CodeAddressIndex="1325"/>
CallStackIndex="39286"   <CodeAddress Address="0x7ff8e1cf32fb" CodeAddressIndex="1324"/>
CallStackIndex="39285"   <CodeAddress Address="0x7ff8e1c49141" CodeAddressIndex="1323"/>
CallStackIndex="39284"   <CodeAddress Address="0x7ff8e1d5e8b8" CodeAddressIndex="1322"/>
CallStackIndex="39283"   <CodeAddress Address="0x7ff988842b76" CodeAddressIndex="1321"/>
CallStackIndex="39282"   <CodeAddress Address="0x7ff988842e5c" CodeAddressIndex="1320"/>
CallStackIndex="39281"   <CodeAddress Address="0x7ff98884379a" CodeAddressIndex="1319"/>
CallStackIndex="39280"   <CodeAddress Address="0x7ff99e65b2c9" CodeAddressIndex="1318"/>
CallStackIndex="39279"   <CodeAddress Address="0x7ff99e65dd66" CodeAddressIndex="1317"/>
CallStackIndex="39278"   <CodeAddress Address="0x7ff99e65ffec" CodeAddressIndex="1316"/>
CallStackIndex="39277"   <CodeAddress Address="0x7ff99e65e344" CodeAddressIndex="1315"/>
CallStackIndex="39276"   <CodeAddress Address="0x7ff99e6582a0" CodeAddressIndex="1314"/>
CallStackIndex="39275"   <CodeAddress Address="0x7ff6ba02f998" CodeAddressIndex="1313"/>
CallStackIndex="39274"   <CodeAddress Address="0x7ff6ba02fda6" CodeAddressIndex="1312"/>
CallStackIndex="39273"   <CodeAddress Address="0x7ff6ba0312e8" CodeAddressIndex="1311"/>
CallStackIndex="39272"   <CodeAddress Address="0x7ffa0f93257d" CodeAddressIndex="1"/>
CallStackIndex="39271"   <CodeAddress Address="0x7ffa1068aa58" CodeAddressIndex="0"/>

This might be caused because we disabled the EnableKernelProvider and ClrRundownTraceEventParser.ProviderGuid, but if we enable it the custom event is not captured anymore. Does anybody know where are can start to fix this.

Background
First of all thank you for this great library and tools. We use EventSource in our .net 8 applications everywhere to detect all kinds of issues. Recently we are removing old (depreciated) functions. We use an event so we can detect when this happens and report it to the appropriate teams for fixing.

We are looking to make this process even more developer friendly. We have added an option in our WPF application so it display some UI elements when we detect a "DepreciatedFunctionCall" event. The developer can click on it and get some details about the "DepreciatedFunctionCall" event, such as the method name. This is all working fine.

Now we want to add the stack when the event occurs. A simple solution would be to add the stack trace as data to the event. However we noticed that perfview (with the @StacksEnabled=true) and "dotnet-trace collect" is able to get stack information without having to add it as data to the event. So we would like to add it that way to keep our events cleaner.

Thanks in advance,
Bart Vries
TestCs.zip

[brianrob]

What you're trying to do is supported. You will need some kernel and rundown events in order to resolve all symbols. Your current issue is likely that you're just getting events for methods that are jitted during the trace, but no native code or pre-compiled managed code.

For native and pre-compiled managed code, you will need to enable some kernel events. For jitted code that was jitted before the trace started, you will need rundown.

Here's an example that is likely very similar to what you're looking for: https://github.com/brianrob/examples/blob/main/src/realtime-session-with-stacks/Program.cs.

[desdesdes]

Hi Brain,

Thank you very much for your fast response. I got the sample to work and I am now trying to implement it in our application.

Best regards,
Bart Vries