Event Trace for Windows: update exiting trace with a new file and EVENT_TRACE_FILE_MODE_NEWFILE

Przemysław Walkowiak 1 Reputation point
2022-05-21T21:28:43.423+00:00

I have a question related to the Event Trace for Windows usage.

I've implemented a logger (controller + session) that handles events and forwards them to the log file with a specific max log file and the EVENT_TRACE_FILE_MODE_NEWFILE flag.
With the flag enabled and %d in the log file name, the index is automatically incremented after the log file reaches the max size.

However, from time to time, I would like to change the increment and the base name. E.g.: log_2022_21_05_%d.etl -> log_2022_21_06_%d.etl. For that purpose, I have the following snippet:

filename = L"log_2022_06_21_%d.etl"; // name is different than the original one

DWORD status = ::ControlTrace(hTrace,
                              sessionData.name.data(),
                              props,
                              EVENT_TRACE_CONTROL_QUERY);
   // props contain the up to date data

props->Wnode.BufferSize = static_cast<ULONG>(buffer.size());
props->Wnode.Flags = WNODE_FLAG_TRACED_GUID;
props->MaximumBuffers = 0; // don't want to modify
props->FlushTimer = 0; // don't want to modify
props->EnableFlags = 0; // don't want to modify
props->LoggerNameOffset = sizeof(*props);

    // assigning the same  mode as during starting the trace
props->LogFileMode = EVENT_TRACE_REAL_TIME_MODE | EVENT_TRACE_FILE_MODE_NEWFILE; 
props->LogFileNameOffset = static_cast<ULONG>(sizeof(*props) + maxSessionNameLength * sizeof(wchar_t));

auto propertyLogFileName =
    std::span(reinterpret_cast<wchar_t*>(props + 1) + maxSessionNameLength,
              filename.size() + 1);
std::ranges::fill(propertyLogFileName, 0);
std::ranges::copy(filename, propertyLogFileName.begin());

status = ::ControlTrace(hTrace,
                        sessionData.name.data(),
                        props,
                        EVENT_TRACE_CONTROL_UPDATE);

Unfortunately, the status returned by the last call of ControlTrace is always 0x87 - INVALID_PARAMETER.
The same result is when:

  • I omit LogFileMode modification (it will have the original, internal value: 0x00400109 (EVENT_TRACE_STOP_ON_HYBRID_SHUTDOWN | EVENT_TRACE_REAL_TIME_MODE | EVENT_TRACE_FILE_MODE_NEWFILE | EVENT_TRACE_FILE_MODE_SEQUENTIAL - please note, I set only REAL_TIME_MODE and NEWFILE, the value was acquired by QUERY.
  • I keep it as it is in the snippet above

However, If I change LogFileNameOffset to 0 (don't modify filename), the call succeeds, but of course, without changing the name.
The same happens if, instead of NEWFILE, the SEQUENTIAL mode is used, but then there is no way to increment the counter.

The log file name is filled the same way as while starting the trace.

Do Windows support the above scenario (changing filename while in the NEWFILE mode)? Or did I miss something?

Or maybe there is a workaround for it? I was thinking about just stopping the current trace and starting/creating it again, but there is a possibility that some data will be lost in the meantime.

Windows API - Win32
Windows API - Win32
A core set of Windows application programming interfaces (APIs) for desktop and server applications. Previously known as Win32 API.
2,428 questions
Windows 11
Windows 11
A Microsoft operating system designed for productivity, creativity, and ease of use.
8,255 questions
{count} votes