For several years now, I have had code called the 'TraceEvent library' that allows you to access ETW files (ETL files) from C#.
However for over a year now, I have not updated the public version of that library. Well, that time has ended.
I updated the TraceEvent library as well as the PerfMonitor sample at http://bcl.codeplex.com to sync up with the latest internal versions. The TraceEvent library is version 1.2.7 (corresponding to the version of PerfView that uses it), and the version of PerfMonitor is Version 2.0.
For those of you don't know, the TraceEvent library is the power behind the PerfView tool, and that makes it pretty powerful. With it you can
In short, most of what you see PerfView do with an ETL file, you can do yourself. Now if you just need a 'tweek' of what PerfView does, I recommend using PerfView's extensibility model to do the job (see the Help -> Extending PerfView menu entry in PerfView). However if you want something 'stand alone'. TraceEvent is a good choice.
If you have used TraceEvent in the past, there are some small braking changes, but the port should be easy (I updated PerfMonitor in a couple hours). There have been numerous fixes, as well as the addition of the RegisteredTraceEventParser and much better support for Symbolc resolution The DiaLib stuff is new). It is worth upgrading to.
The PerfMonitor utility can be thought of as a 'command line' version of PerfView. However I don't recommend using it as an actual tool, it almost all cases, PerfView is a better tool than PerfMonitor. PerfMonitor is more of a sample of how to use TraceEvent in non-trivial ways (it is easier to understand without all the GUI goo cluttering up the logic).
I will probably post more detailed 'how to's of using ETW with TraceEvent in future blog posts.