0

We are generating some etw log files for our application. I use Perfview to read the .etl files. Some times Perfview shows events like the below screenshot. It does not show the proper provider name/event name and the message. Instead I can see the GUID. I am not able to find out in what scenario this happens. I cannot suspect the event source because this doesn't happen with all .etl files. Screenshot

ETL files generated using the same session with the below MultiFileMB configuration for generating multiple etl split files. Some split files are showing proper data, some are not as shown in the below image.

Session.MultiFileMB = 10;

Working and Corrupted etl files

I tried dumping the corrupted and not corrupted events from Perfview. Proper events are having <PrettyPrint> information and the TemplateType is DynamicTraceEventData, however in the corrupted events I am not getting <PrettyPrint> information. Also the TemplateType is UnhandledTraceEvent.

Dump

Amruth Raj.V
  • 51
  • 5
  • how do you raise and capture the events? – magicandre1981 Nov 09 '19 at 12:25
  • @magicandre1981: I have a windows service which will enable the etw session. For every 10MB, my session will create a new etl file. I am seeing this behavior in some of the files. Other files are proper... – Amruth Raj.V Nov 10 '19 at 10:11
  • which technology do you use for raising the events? Native API? .net with TraceEvent? – magicandre1981 Nov 10 '19 at 15:39
  • @magicandre1981 We use TraceEvent to raise the events – Amruth Raj.V Nov 11 '19 at 01:48
  • ok, so the [ManifestData event](https://stackoverflow.com/a/52316470/1466046) is missing and not added to the ETL file. you need to post more details/code – magicandre1981 Nov 11 '19 at 15:45
  • @magicandre1981: You are right. I cannot see the manifest data for the corrupted files. Added some more screenshots in the original post. I have also tried increasing BufferSizeMB of the session. But it did not help. – Amruth Raj.V Nov 12 '19 at 11:40
  • what happens if you increase the file size? Maybe the file reaches the max file limit before it can store the manifest event. – magicandre1981 Nov 12 '19 at 16:05
  • @magicandre1981 Tried increasing the file size. It did not help. – Amruth Raj.V Nov 13 '19 at 05:53
  • which file size have you tried? How large is the memory buffer? if you open the broken ETL files in perfview, do you see lost events in TraceInfo dialog? – magicandre1981 Nov 13 '19 at 15:41
  • @magicandre1981: Instead of 10 MB I have tried 25 MB file size. Memory buffer I tried giving 1 MB. By default it was 64 KB. I can see that the number of lost events is 0. That means no events are lost. I also observed that doing a merge with all these splitted files makes all corrupted data readable. If you open the merged file in perfview, I am able to see all data properly. – Amruth Raj.V Nov 14 '19 at 02:36
  • 1
    this is expected as perfview now has the manifest and can decode the events. Ask [this on github](https://github.com/microsoft/perfview/issues). I think the lib should make sure that the ManifestData event should be included in all ETLs. – magicandre1981 Nov 14 '19 at 15:48
  • Asked the same question in GitHub https://github.com/microsoft/perfview/issues/1054#issue-523225168 – Amruth Raj.V Nov 15 '19 at 03:07
  • you should also add what we discovered here in comments that the ETLs miss the Manifest Event. – magicandre1981 Nov 15 '19 at 15:00
  • @magicandre1981 Updated the question in GitHub with this information also. – Amruth Raj.V Nov 18 '19 at 02:52

0 Answers0