Comments (6)
I've put a rough fork that I'm using for this at https://github.com/jrmuizel/etw-profiler/tree/main/etw-reader
from ferrisetw.
Hey @jrmuizel ! Nice one, That's indeed quite useful!!
I would love if you'd like to adapt your fork to ferrisetw
and open a PR with the changes, I would gladly check it and merge it. If that's not possible I'll try to do it myself asap 😃
from ferrisetw.
I'm not sure I'll have time to submit PRs with my changes, but I'll try to at least open some issues about the things that I changed.
from ferrisetw.
I've just implemented support for dumping into ETL files in #91.
I won't be able to implement reading from ETL files for now.
I tried to do so, but that's harder as I planned, because ferrisetw has too much coupling between Providers (that make only sense for real-time traces) to callbacks (that make sense for both real-time and file-based traces).
That's good because this design makes it easy to add multiple callbacks for multiple ETW providers, and call the right callbacks for the right events. But this prevents us from easily call OpenTrace
without the StartTrace
/EnableTraceEx2
(which are only required for real-time sessions).
I'm afraid this would require some refacto. Doing it well would be rather heavy (and I won't have time for it in the short run). Also, this may require to change the exposed, public API and force releasing a new major version.
from ferrisetw.
OK, I finally managed to handle reading from files :)
I'll make a PR soon
from ferrisetw.
Nice!
from ferrisetw.
Related Issues (20)
- Configure kernel traces with TraceSetInformation
- support method `EtwEventUnregister`
- Unable to process different events from the same TraceLogging provider HOT 1
- Thread safety issue HOT 5
- Unexistant properties are not properly handled HOT 1
- Possible race conditions HOT 3
- Trait bound error caused by diff windows-rs dependence version HOT 2
- Missing LICENSE.md HOT 1
- Setup dependabot for ferrisetw HOT 1
- Support filter per PID for system traces
- Support enabling/disabling a provider on a running trace HOT 1
- De-duplicate code between user and kernel traces HOT 1
- Invalid widestring pointer HOT 1
- Memory usage improvements in EventTraceProperties
- Do not ignore the very last events
- Style: replace Box<Arc<T>> with Arc<T> HOT 1
- Support more TDH property types
- Manage already-running traces HOT 1
- Enable non-threaded or blocking trace session HOT 1
- Panic on Kernel Trace close HOT 4
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from ferrisetw.