I am recording plenty of traces with xperf where I am looking only at a specific process (of course when not looking on CPU usage per core etc). Now those traces get very large and working with them is tedious.
Is there a way to remove process from the etl to reduce its size? Since I am not inspecting cross-process issues I will never look at them and it would be great if etls could be processed once to reduce their size so that opening and comparing them gets easier.
You can check out this code to do it yourself. https://github.com/Donpedro13/etwprof
You can do it either in real time, or using a relogger.
Notice that you might lose some info because certain events relating to your process originate from other processes (such as Readying events etc).