How to store DateTime in EventSource via WriteEventCore

Question

This is my current code:

[NonEvent]
    unsafe void InsertViaWriteEventCore(
        int eventId,
        DateTime startDateTime,
        DateTime endDateTime)
    {
        const int eventDataCount = 2;
        {
            EventData* data = stackalloc EventData[eventDataCount];
            data->DataPointer = (IntPtr)(&startDateTime);
            data->Size = sizeof(DateTime);
            data[1].DataPointer = (IntPtr)(&endDateTime);
            data[1].Size = sizeof(DateTime);

            WriteEventCore(eventId, eventDataCount, data);
        }
    }

But finally, in the events that are generated, i see "8/30/3617 5:00:00 PM" as startDateTime if i provide startDateTime as "8/30/2017 5:00:00 PM" to the method. It's always adding 1600 to the year.

I tried providing 8 as the size instead of sizeof(DateTime) and i still got the same result. I get the right date values if I change the dates to string and pass to writeeventcore as string as shown in the example here. What am i doing wrong here? What is the right way to pass DateTime via WriteEventCore?

raise 2 events (1 for start and 1 for stop with correct Start/Stop Opcode). all events have a timestamp where you can calculate the diff to get the time — magicandre1981, Sep 02 '17 at 14:23
@magicandre1981 my question was around storing datetime object into EventData array. How did you create the data object? what was the size and Datapointer values you gave for a datetime object? — Alfan, Sep 05 '17 at 19:46
from your code I see you [ask how to log a duration of a event](https://stackoverflow.com/q/25066944/1466046). But this is the wrong approach which fails and now you try to find a fix for your wrong approach instead of asking the real issue. This is called [XY problem](https://meta.stackexchange.com/a/66378). — magicandre1981, Sep 06 '17 at 14:16

score 3 · Accepted Answer · answered Sep 05 '17 at 23:34

When you use ‘EventData’ you have to use what ETW expects for a dateTime. This happens to be the windows FileTime format (which is a long that is the number of seconds from 1600)

So to pass a DateTime to EventData, you have to do something like this.

long startFileTime = startDateTime.ToFileTime();
data->DataPointer = (IntPtr)(& startFileTime);
data->Size = sizeof(long);

How to store DateTime in EventSource via WriteEventCore

1 Answers1