Event Trace for Windows: update exiting trace with a new file and EVENT_TRACE_FILE_MODE_NEWFILE
I have a question related to the Event Trace for Windows usage.
I've implemented a logger (controller + session) that handles events and forwards them to the log file with a specific max log file and the EVENT_TRACE_FILE_MODE_NEWFILE
flag.
With the flag enabled and %d
in the log file name, the index is automatically incremented after the log file reaches the max size.
However, from time to time, I would like to change the increment and the base name. E.g.: log_2022_21_05_%d.etl
-> log_2022_21_06_%d.etl
. For that purpose, I have the following snippet:
filename = L"log_2022_06_21_%d.etl"; // name is different than the original one
DWORD status = ::ControlTrace(hTrace,
sessionData.name.data(),
props,
EVENT_TRACE_CONTROL_QUERY);
// props contain the up to date data
props->Wnode.BufferSize = static_cast<ULONG>(buffer.size());
props->Wnode.Flags = WNODE_FLAG_TRACED_GUID;
props->MaximumBuffers = 0; // don't want to modify
props->FlushTimer = 0; // don't want to modify
props->EnableFlags = 0; // don't want to modify
props->LoggerNameOffset = sizeof(*props);
// assigning the same mode as during starting the trace
props->LogFileMode = EVENT_TRACE_REAL_TIME_MODE | EVENT_TRACE_FILE_MODE_NEWFILE;
props->LogFileNameOffset = static_cast<ULONG>(sizeof(*props) + maxSessionNameLength * sizeof(wchar_t));
auto propertyLogFileName =
std::span(reinterpret_cast<wchar_t*>(props + 1) + maxSessionNameLength,
filename.size() + 1);
std::ranges::fill(propertyLogFileName, 0);
std::ranges::copy(filename, propertyLogFileName.begin());
status = ::ControlTrace(hTrace,
sessionData.name.data(),
props,
EVENT_TRACE_CONTROL_UPDATE);
Unfortunately, the status
returned by the last call of ControlTrace
is always 0x87
- INVALID_PARAMETER
.
The same result is when:
- I omit
LogFileMode
modification (it will have the original, internal value:0x00400109
(EVENT_TRACE_STOP_ON_HYBRID_SHUTDOWN | EVENT_TRACE_REAL_TIME_MODE | EVENT_TRACE_FILE_MODE_NEWFILE | EVENT_TRACE_FILE_MODE_SEQUENTIAL
- please note, I set onlyREAL_TIME_MODE
andNEWFILE
, the value was acquired byQUERY
. - I keep it as it is in the snippet above
However, If I change LogFileNameOffset
to 0
(don't modify filename), the call succeeds, but of course, without changing the name.
The same happens if, instead of NEWFILE,
the SEQUENTIAL
mode is used, but then there is no way to increment the counter.
The log file name is filled the same way as while starting the trace.
Do Windows support the above scenario (changing filename while in the NEWFILE
mode)? Or did I miss something?
Or maybe there is a workaround for it? I was thinking about just stopping the current trace and starting/creating it again, but there is a possibility that some data will be lost in the meantime.