TraceEvent | Trace events in real time sessions | Monitoring library

Ideally, once you connect you should wait for the connection status, before you start asking for the list of profiles.

These are some code snippets you could use:

Device discovery

So i have solved the problem I guess by adding "\r" before the "\n"

string info = infoFromPerson.Replace("|", "\r\n");

After some further research I manged to find out that Limit-EventLog is a legacy command and has been phased out since Vista. The correct to achieve this result in later OS versions to use Get-WinEvent. Here is the full script I ended up using

There are many things wrong with your code:

1. You never dispose your command. That's a native handle to an ODBC driver, waiting for the garbage collector to dispose it is very bad practice.

2. You shouldn't be sending those commands individually anyway. Either send them all at once in one command, or use transactions to group them together.

3. This one is the reason why it's getting slower over time: File.ReadLines(file).Skip(skipCount).Take(batchSize) will read the same file over and over and ignore a growing amount of lines every attempt, and so growing slower and slower as the number of lines ignored (but processed) gets larger and larger.

To fix #3, simply create the enumerator once and iterate it in batches. In pure C#, you can do something like:

(I am a developer at Microsoft who works on the TraceProcessor project.)

I have a little more familiarity with TraceEvent than with ETW2JSON, but the same answer applies in both cases.

Each was developed by different organizations within Microsoft to best support our own performance and diagnostic investigations. In some cases, we took design inspiration or cues for TraceProcessor from other libraries, but largely we developed it for our specific use cases and according to our own design philosophies.

Those differences mean that each library has its own principles about performance, API design/consistency, and broad-based ETW support vs. well-developed first-class support for certain specific things.

TraceEvent does have .NET/CLR support, but focuses mostly on being a manged wrapper around the C++ ETW APIs. It does have support for other events, but very limited.

All in all, TraceEvent is great for first-class .NET/CLR data and the "basics" elsewhere.

TraceProcessor gives strong first-class support to the types of system and diagnostic data that you could see in other tools like XPerf and WPA. We’ve pushed for a clean, consistent, performant API across the library and emphasized strong typing to present each type of data in the most natural shape.

(I am a developer at Microsoft who works on the TraceProcessor project.)

IFilteredEventConsumer is a way to get at the unparsed events in the trace, and it's true that we have not added support for using a manifest file to simplify that parsing.

However, parsed events for that provider should be available in the IGenericEventDataSource like this:

(I worked on the TraceProcessor library until recently.)

As you've noticed, I don't think we have built-in support for VirtualAlloc events today. I'll let the current team speak to priority, but we haven't had significant requests for .NET events in the past.

For VirtualAlloc (and .NET events), yes, you could parse these events on your own. See:

https://docs.microsoft.com/en-us/windows/apps/trace-processing/extensibility

for an overview. You'd need to understand the format of a VirtualAlloc event to know how to parse it, as well as the provider ID / event ID / version of these events.

(I am a developer at Microsoft, and I work on the TraceProcessor library.)

In our docs (https://aka.ms/TraceProcessing) we have a list of the various trace.Use*() calls and the corresponding data that is accessible with each of them.

I am not an expert on TraceEvent, but I searched for FileVersionTraceData in their repo, and it seems to me that it maps to the IImage type in the TraceProcessor library. A list of the images loaded into a process's address space during the trace appears in the IProcess type, which is accessible through the trace.UseProcesses() call.

For example, you could do something like:

Unfortunately, your pseudo code does not compile. It contains several syntactical and logical errors. Furthermore, some helper classes are missing. If I did not have spare time today and was looking for a puzzle to solve, I would not have bothered making my own MCVE out of it, because that would actually have been your job. Please do read the MCVE article and learn to create one next time, otherwise you will not get a lot of qualified help here. This was your free shot because you are new on SO.

Application helper classes: