Using ETW events in net

Until. net4.5, there is a convenient way to operate ETW.

The method introduced in this paper mainly originates from Microsoft.Diagnostics.Tracing.TraceEvent official database.

Get ready

(1) need to use class: Microsoft traceevent Library, this class can be downloaded to NuGet:

Install-package Microsoft.Diagnostics.Tracing.TraceEvent

(2) The version of the. NET Framework requires more than 4.5

Concept

There are three characters in the diagram:

(1) Event session. The event provider is required to submit metadata for the event data to the controller, which provides metadata for the event data to the event consumer. It also controls whether to accept event submissions from the event provider. It corresponds to the Microsoft.Diagnostics.Tracing.TraceEventSession class.

(2) Event Provider, which is a function of raising events and providing event data. It corresponds to the Microsoft.Diagnostics.Tracing.EventSource class.

(3) Event Consumer (consumer of events), the role of consumer events. It corresponds to the Microsoft.Diagnostics.Tracing.TraceEventSource class.

Create an ETW event source (event provider)

Create a class that inherits from the Eventsouce interface. Note that the member method in the class publish calls the WriteEvent () method of the base class, WriteEvent () up to 13 overloads, where a simpler method is chosen. As it is literally, it is the function of writing event data (events) to events, as shown in. The write event data is stored on disk or in memory, depending on the settings in the subsequent session.

1 using System; 2 using System.Diagnostics.Tracing; 3  4 Namespace WindowsFormsApplication2 5 {6  7 public     class Myeventsource:eventsource 8     {9 public         s Tatic Myeventsource Instance = new Myeventsource (), ten public         void Publish (string name),         {             base. WriteEvent (1, name);         }15     }16}

Create a session, bind an event source (event provider), subscribe to an event source (event consumer)

Using microsoft.diagnostics.tracing.session;using Microsoft.Diagnostics.Tracing;        private void Button1_Click (object sender, EventArgs e)        {            thread thread = new Thread (new ThreadStart (delegate            {                using (var session = new Traceeventsession ("MySession"))                {                    session. Enableprovider ("Myeventsource"); Enable Event Source (event provider)                    session. Source.Dynamic.All + = Dynamic_all;  Registers an event handler (event consumer)                    session. Source.process ();  Wait for the event to occur                 }            ));            Thread. Start ();        }        <summary>///Event handling functions///</summary>//        <param name= "obj" ></param>        void Dynamic_all (TraceEvent obj)        {            Console.WriteLine ("Event data" + obj. ToString ());        }

Careful readers may find that in the three roles mentioned above, event consumers do not seem to appear. Actually, it came up, session. SOURCE returns a Etwtraceeventsource object. Etwtraceeventsource inherits from Traceeventsource, is the event consumer.

After the session is created, in the Windows Performance Monitor (Control panel = management tool), you can see that mysession is located in the event Trace session as shown in:

Triggering events

1//<SUMMARY>2///         Trigger Event 3//</summary>4//         <param name= "Sender" ></param >5         //<param name= "E" ></param>6         private void button2_click (object sender, EventArgs e)         7 { 8             MyEventSource.Instance.Publish ("Leo"); 9         }

After executing this method, the system invokes the event handler function Dynamic_all (), which is registered above, and passes the event data "Leo" together, as shown in:

Summary

In Windows programming, ETW is often encountered, especially in logs and performance, where ETW can often be seen. In the next article, I'll show you how to subscribe to the ETW events generated by IIS.

Resources

Microsoft.Diagnostics.Tracing.TraceEvent

An end-to-end ETW tracing Example:eventsource and TraceEvent

Application analysis with Event tracing for Windows (ETW)

Category:. NET Advanced Tags: ETW events

Using ETW events in net