ETW custom Controller and Consumer (Provider using .net 4.5 EventSource)

Question

I've been trying to work with ETW in .net 4.5. I have a small sample application which uses EventSource to write messages, however, I'm struggling to understand how to create my own ETW controller and consumer application.

I've used PerfView to enable and see that the eventsources are working, as well as add EventListners within the same assembly. Now I want to be able to have my own custom "PerfView" to manage and view the live trace. I just cannot figure out how to tie into the EventSources.

OpenTrace/ProcessTrace/StopTrace might be what you need. http://stackoverflow.com/questions/8256690/which-api-does-windows-resource-monitor-use/8311368#8311368 — Peter, Aug 16 '12 at 03:51
any final solution with full source code sample working about it ? — Kiquenet, Jun 24 '13 at 11:20

score 1 · Answer 1 · answered Sep 01 '12 at 19:19

Check out PerfMonitor and the TraceEvent class on which it was built.

PerfMonitor is a wrapper app that can control sources as well as consume their output so you can see how things work, and TraceEvent does most of the heavy lifting so you can include that in your project.

PerfMonitor and TraceEvent come with complete source code and they're licensed under Ms-PL.

Overview of PerfMonitor: http://bcl.codeplex.com/wikipage?title=PerfMonitor

Overview of TraceEvent: http://bcl.codeplex.com/wikipage?title=TraceEvent

score 1 · Answer 2 · answered Feb 27 '15 at 01:45

I would recommend to use Tx (LINQ to logs and traces) library.

Also there is dedicated LINQpad driver available so you could write historical or standing queries over ETL files of real ETW sessions and see the result immediately in LINQpad without even writing real code.

score 0 · Answer 3 · answered Nov 24 '20 at 14:09

In 2020 you can use Microsoft.Diagnostics.Tracing.TraceEvent to create a simple listener. Example:

class Program
{
    static void Main(string[] args)
    {
        var sessionName = Guid.NewGuid().ToString();
        using (var session = new
            Microsoft.Diagnostics.Tracing.Session.TraceEventSession(sessionName))
        {
            // press CTRL-C to quit
            Console.CancelKeyPress += (sender, e) => session.Stop();

            session.Source.Dynamic.All += data =>
            {
                var line = $"{data}\n";
                Console.WriteLine(line);
            };

            var providerGuid = Microsoft.Diagnostics.Tracing.Session.TraceEventProviders.GetEventSourceGuidFromName
                ("MyCompany-MyApp-MyEventSource1");
            session.EnableProvider(providerGuid);

            session.Source.Process();
        }
    }
}

More information is available in The TraceEvent Library Programmers Guide.

ETW custom Controller and Consumer (Provider using .net 4.5 EventSource)

3 Answers3