Vance Morrison's Weblog - All Comments

re: Using TraceEvent to mine information in OS registered ETW providers

Ray Canzanese — Fri, 19 Apr 2013 16:36:01 GMT

Aha! Figured out how to extend this to the kernel tracer by going through the TraceEvent source code in more detail -- the trick is to make a call to EnableKernelProvider rather than EnableProvider, and ensure the correct DLLs are present.

re: Windows high speed logging: ETW in C#/.NET using System.Diagnostics.Tracing.EventSource

asava samuel — Sat, 13 Apr 2013 08:48:33 GMT

This logger works really well:

www.kellermansoftware.com/p-14-net-logging-library.aspx

re: Introduction Tutorial: Logging ETW events in C#: System.Diagnostics.Tracing.EventSource

asava samuel — Fri, 12 Apr 2013 19:27:48 GMT

This logger works really well:

www.kellermansoftware.com/p-14-net-logging-library.aspx

re: Next Version of PerfView has been released!

Vance Morrison — Wed, 03 Apr 2013 21:20:01 GMT

Sorry, you would need to run on WIn8 (it was assumed that the main scenario was Windows store apps, which of course need Win8). Of course you just need a Win8 machine /VM to run the experiment on.

re: Next Version of PerfView has been released!

Rich Deken — Wed, 03 Apr 2013 17:04:00 GMT

I just looked at the log output and see the lines below:

----------------

***** Attempting a ETW based JavaScript Heap Dump.

SaveETL option specified, additionally saving the JS Heap as an ETL file.

JavaScript Heap Dumping only supported on Win8 or above.

Wrote data to OUTLOOK.1.etl.

----------------

We are running on Windows 7, Outlook 2010, and IE9. Is there any way to get this to work under Windows 7?

re: Next Version of PerfView has been released!

Vance Morrison — Tue, 02 Apr 2013 23:05:24 GMT

What does the log say? (if you re-open the GCDump file it will show you the log that was dumped at the time of collection). It works when I tried it, here is the relevant snipit from the log.

***** Attempting a ETW based JavaScript Heap Dump.

SaveETL option specified, additionally saving the JS Heap as an ETL file.

Starting Kernel Logging on App.kernel.etl

Starting ETW logging on File App.etl

0.0s: Enabling JScript Heap Provider

In general JavaScript leak detection works much like .NET leak detection. The only real difference is the names of the nodes.

re: Next Version of PerfView has been released!

Rich Deken — Tue, 02 Apr 2013 16:59:35 GMT

Vance -- I'm trying to track down a JavaScript leak using PerfView. I'm choosing the option "Save JS ETL" but I don't see any additional ETL file with the JS data. Am I doing something wrong? Thx!

re: Why doesn't my EventSource produce any events?

Vance Morrison — Wed, 20 Mar 2013 16:35:45 GMT

EventSource is built on top of infrastructure that would allow its events to be sent to the windows Event Log, however to do this you need to register a manifest with a bit more meta-data (called Channels) than is done today. This is a feature that we will be adding in the near future (out of band with the .NET Framework), but it is not there today.

re: Why doesn't my EventSource produce any events?

anirudhg — Wed, 20 Mar 2013 04:24:59 GMT

Using EventSoource derived provider can we direct the ETW events that are created to the Event Log ?

re: Using TraceEvent to mine information in OS registered ETW providers

Vance Morrison — Mon, 18 Mar 2013 18:51:49 GMT

I realized that the 'Keyword' property may not be exposed in the version of TraceEvent that you have.

The code is simple enough, if you really need it and are willing to download and build it from bcl.codeplex.com.

public TraceEventKeyword Keyword

{

get { return (TraceEventKeyword)eventRecord->EventHeader.Keyword; }

}

Typically however you don't to know the keywords at event consumption time (they have already served their purpose.