Adding support for capturing kernel events and making the observable …

…processing pipeline more flexible
tomasr · Aug 18, 2015 · 6cbf7be · 6cbf7be
1 parent 32d2e8b
commit 6cbf7be
Show file tree

Hide file tree

Showing 6 changed files with 33 additions and 2 deletions.
diff --git a/Collector/IISLogCollector/EtwLogCollector.cs b/Collector/IISLogCollector/EtwLogCollector.cs
@@ -76,15 +76,21 @@ private void CreateEventSourceOnBufferFile() {
       this.eventSource = new ETWTraceEventSource(
         oldFile, TraceEventSourceType.FileOnly
       );
-      foreach (var provider in eventProviders) {
+
+      var sortedProvs = eventProviders.OrderBy(x => x.IsKernelProvider ? 0 : 1);
+      foreach (var provider in sortedProvs) {
         provider.RegisterParser(this.eventSource);
       }
 
-      this.observableStream = this.eventSource.ObserveAll();
+      this.observableStream = JoinStreams(sortedProvs);
       this.sourceProcessor.Start(this.observableStream);
       new Task(Process).Start();
     }
 
+    private IObservable<TraceEvent> JoinStreams(IEnumerable<IEtwEventProvider> providers) {
+      return System.Reactive.Linq.Observable.Merge(providers.Select(x => x.GetEventStream()));
+    }
+
     private String SwitchBufferFiles() {
       String oldFile = this.currentFilename;
       this.currentFilename = Path.Combine(this.traceFolder, Guid.NewGuid() + ".etl");

diff --git a/Collector/IISLogCollector/EtwLogCollector.csproj b/Collector/IISLogCollector/EtwLogCollector.csproj
@@ -41,6 +41,18 @@
     <Reference Include="System.ComponentModel.Composition" />
     <Reference Include="System.configuration" />
     <Reference Include="System.Core" />
+    <Reference Include="System.Reactive.Core, Version=2.2.5.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL">
+      <HintPath>..\..\packages\Rx-Core.2.2.5\lib\net45\System.Reactive.Core.dll</HintPath>
+      <Private>True</Private>
+    </Reference>
+    <Reference Include="System.Reactive.Interfaces, Version=2.2.5.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL">
+      <HintPath>..\..\packages\Rx-Interfaces.2.2.5\lib\net45\System.Reactive.Interfaces.dll</HintPath>
+      <Private>True</Private>
+    </Reference>
+    <Reference Include="System.Reactive.Linq, Version=2.2.5.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL">
+      <HintPath>..\..\packages\Rx-Linq.2.2.5\lib\net45\System.Reactive.Linq.dll</HintPath>
+      <Private>True</Private>
+    </Reference>
     <Reference Include="System.Xml.Linq" />
     <Reference Include="System.Data.DataSetExtensions" />
     <Reference Include="Microsoft.CSharp" />

diff --git a/Collector/IISLogCollector/packages.config b/Collector/IISLogCollector/packages.config
@@ -1,4 +1,7 @@
 <?xml version="1.0" encoding="utf-8"?>
 <packages>
   <package id="Microsoft.Diagnostics.Tracing.TraceEvent" version="1.0.32" targetFramework="net451" />
+  <package id="Rx-Core" version="2.2.5" targetFramework="net451" />
+  <package id="Rx-Interfaces" version="2.2.5" targetFramework="net451" />
+  <package id="Rx-Linq" version="2.2.5" targetFramework="net451" />
 </packages>
diff --git a/Collector/TraceProcessor/IEtwEventProvider.cs b/Collector/TraceProcessor/IEtwEventProvider.cs
@@ -4,7 +4,9 @@
 
 namespace Winterdom.Diagnostics.TraceProcessor {
   public interface IEtwEventProvider {
+    bool IsKernelProvider { get; }
     void RegisterParser(TraceEventSource eventSource);
     void EnableProvider(TraceEventSession session);
+    IObservable<TraceEvent> GetEventStream();
   }
 }
diff --git a/Collector/TraceProcessor/Impl/EventHubEventProcessor.cs b/Collector/TraceProcessor/Impl/EventHubEventProcessor.cs
@@ -41,6 +41,8 @@ public void SetNotify(ISendNotify sink) {
     public Task<TraceEvent> Process(TraceEvent traceEvent) {
       byte[] eventBody = EventToBytes(traceEvent);
 
+      System.IO.File.WriteAllBytes(String.Format(@"c:\temp\etw\{0}.json", Guid.NewGuid()), eventBody);
+
       EventData eventData = new EventData(eventBody);
       eventData.PartitionKey = keyGenerator.GetKey(traceEvent);
 

diff --git a/IISTraceEvent/IISEventProvider.cs b/IISTraceEvent/IISEventProvider.cs
@@ -8,11 +8,17 @@ namespace Winterdom.Diagnostics.Tracing.IISTraceEvent {
   [Export(typeof(IEtwEventProvider))]
   public class IISEventProvider : IEtwEventProvider {
     private IISLogTraceEventParser parser;
+
+    public bool IsKernelProvider { get { return false; } }
+
     public void RegisterParser(TraceEventSource eventSource) {
       this.parser = new IISLogTraceEventParser(eventSource);
     }
     public void EnableProvider(TraceEventSession session) {
       session.EnableProvider(IISLogTraceEventParser.ProviderName);
     }
+    public IObservable<TraceEvent> GetEventStream() {
+        return parser.ObserveAll();
+    }
   }
 }