I am developing a ETW listener to listen to all available event sources in my system.
Q1: Please find the sample code below:
providerName = "ETW-TEST-APPLICATION";
sessionName = "ETW-TEST-APPLICATION";
using (var session = new TraceEventSession(sessionName, null))
{
try
{
session.StopOnDispose = true;
session.BufferSizeMB = 100;
Console.CancelKeyPress +=
delegate(object sender, ConsoleCancelEventArgs e) { session.Dispose(); };
using (source = new ETWTraceEventSource(sessionName, TraceEventSourceType.Session))
{
var parser = new DynamicTraceEventParser(source);
parser.AddDynamicProvider(new ProviderManifest(Environment.CurrentDirectory +
"\\ETWApplicationRegister." +
providerName +
".etwManifest.man"));
parser.All += delegate(TraceEvent data)
{
Console.WriteLine("--------------------------------------------------------------");
Console.WriteLine("ProviderName : " + data.ProviderName);
Console.WriteLine("ProviderGuid : " + data.ProviderGuid);
Console.WriteLine("EventID : " + data.ID);
Console.WriteLine("Level : " + data.Level);
Console.WriteLine("Channel : " + data.Channel);
Console.WriteLine("Task : " + data.Task);
Console.WriteLine("TaskName : " + data.TaskName);
Console.WriteLine("TimeStamp : " + data.TimeStamp);
Console.WriteLine("FormattedMessage : " + data.FormattedMessage);
Console.WriteLine("PayLoad : " + data.PayloadByName("jsonArgs"));
Console.WriteLine("--------------------------------------------------------------");
};
session.EnableProvider(providerGuid);
source.Process(); //On execution of this statement system listens to the events
}
}
}
This code holds good for one event source namely "ETW-TEST-APPLICATION". I would like this listener to be used for multiple event sources "ETW-TEST-APPLICATION2","ETW-TEST-APPLICATION3" etc.
Please let me know about the options available for achieving this. I tried with threading but didnt work.
Q2: Also let me know if i can have multiple session.EnableProvider's, i want to enable only informational & Error messages, but ignore Warning messages session.EnableProvider(providerGuid,TraceEventLevel.Informational); session.EnableProvider(providerGuid,TraceEventLevel.Error);
Q1: You shouldn't need more than one ETWTraceEventSource to enable multiple providers if they are in one session. That said, if you are forced to you may have to create a new DynamicTraceEventParser per source, then hook your event handler to each parser.
Q2: Here's a simplified example of how I've enable multiple providers by searching an assembly: