ETW Session - EnableKernelProvider

Question

Hi there! I have recently developed a software where a session is started using the NuGet package Microsoft.Diagnostics.Tracing.Session to retrieve information about the internet traffic of a single process. Having always tested it on Windows 8 and 10, I never noticed that there were problems with Windows 7, where the following exception is thrown:

System.ArgumentException: Illegal characters in path.

at System.IO.Path.CheckInvalidPathChars(String path, Boolean checkAdditional)

at System.IO.Path.InternalGetDirectoryName(String path)

at NativeDlls.LoadNative(String simpleName)

at Microsoft.Diagnostics.Tracing.Session.TraceEventSession.StartKernelTrace(UInt64& TraceHandle, EVENT_TRACE_PROPERTIES* properties, STACK_TRACING_EVENT_ID* stackTracingEventIds, Int32 cStackTracingEventIds)

at Microsoft.Diagnostics.Tracing.Session.TraceEventSession.EnableKernelProvider(Keywords flags, Keywords stackCapture)

at MyBackgroundWorker_DoWork(Object sender, DoWorkEventArgs e) in D:\MyFolder\MySoft\MySoft\Forms\MyClass.cs:line 994

I tried to read up on it, but couldn't find much except documents stating that on Windows 7 the session must be named "NT Kernel Session". I hope someone can help me.

Code:

private void MyBackgroundWorker_DoWork(object sender, DoWorkEventArgs e)
{
   var etwSession = new TraceEventSession(EtwSessionName);
etwSession.EnableKernelProvider(KernelTraceEventParser.Keywords
                            .NetworkTCPIP);
   etwSession.Source.Kernel.UdpIpRecv += data =>
   {
      if (data.ProcessID == processId &&
                                data.saddr.ToString() == serverIp)
                                rData = data.size;
   };

   etwSession.Source.Process();

}

Answer 1

Since this code has been running well on Windows 8 and Windows 10, I think the probability of code problems is low.
And according to the error message, illegal characters appeared in one of your paths.
Please check the configuration file that stores your path to see if there are extra line breaks or other strange characters for some reason.
Please refer to this link:
Visual Studio- Illegal characters in path

---

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

i have same issue today, and i found the reason, it happens because you copy the exe to other computer, but not copy the OSExtension.dll and 'amd64' folder from the output path. you need put the exe and other two things in a same folder to kept it work.