ETW Session - EnableKernelProvider

C2002 1 Reputation point
2020-12-22T09:04:17.443+00:00

Hi there! I have recently developed a software where a session is started using the NuGet package Microsoft.Diagnostics.Tracing.Session to retrieve information about the internet traffic of a single process. Having always tested it on Windows 8 and 10, I never noticed that there were problems with Windows 7, where the following exception is thrown:

System.ArgumentException: Illegal characters in path.

at System.IO.Path.CheckInvalidPathChars(String path, Boolean checkAdditional)

at System.IO.Path.InternalGetDirectoryName(String path)

at NativeDlls.LoadNative(String simpleName)

at Microsoft.Diagnostics.Tracing.Session.TraceEventSession.StartKernelTrace(UInt64& TraceHandle, EVENT_TRACE_PROPERTIES* properties, STACK_TRACING_EVENT_ID* stackTracingEventIds, Int32 cStackTracingEventIds)

at Microsoft.Diagnostics.Tracing.Session.TraceEventSession.EnableKernelProvider(Keywords flags, Keywords stackCapture)

at MyBackgroundWorker_DoWork(Object sender, DoWorkEventArgs e) in D:\MyFolder\MySoft\MySoft\Forms\MyClass.cs:line 994

I tried to read up on it, but couldn't find much except documents stating that on Windows 7 the session must be named "NT Kernel Session". I hope someone can help me.

Code:

private void MyBackgroundWorker_DoWork(object sender, DoWorkEventArgs e)
{
   var etwSession = new TraceEventSession(EtwSessionName);
etwSession.EnableKernelProvider(KernelTraceEventParser.Keywords
                            .NetworkTCPIP);
   etwSession.Source.Kernel.UdpIpRecv += data =>
   {
      if (data.ProcessID == processId &&
                                data.saddr.ToString() == serverIp)
                                rData = data.size;
   };

   etwSession.Source.Process();

}
C#
C#
An object-oriented and type-safe programming language that has its roots in the C family of languages and includes support for component-oriented programming.
10,187 questions
0 comments No comments
{count} votes

2 answers

Sort by: Most helpful
  1. Timon Yang-MSFT 9,571 Reputation points
    2020-12-23T02:10:16.987+00:00

    Since this code has been running well on Windows 8 and Windows 10, I think the probability of code problems is low.
    And according to the error message, illegal characters appeared in one of your paths.
    Please check the configuration file that stores your path to see if there are extra line breaks or other strange characters for some reason.
    Please refer to this link:
    Visual Studio- Illegal characters in path


    If the response is helpful, please click "Accept Answer" and upvote it.
    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    0 comments No comments

  2. DreamProtocol REMILIA 16 Reputation points
    2023-11-09T17:21:30.23+00:00

    i have same issue today, and i found the reason, it happens because you copy the exe to other computer, but not copy the OSExtension.dll and 'amd64' folder from the output path. you need put the exe and other two things in a same folder to kept it work.

    0 comments No comments