TraceEvent ETW Library published as a NuGet Package

I am happy to report that the TraceEvent Library Nuget Package and the TraceEvent Library Samples Nuget Package have been published at www.nuget.org.   If you look for them be sure to set the filtering to include ‘prerelease’ or you will not see them.    You can see this blog entry for the formal announcement of the library.   If you have feedback on the library, you can either contact me through nuget or leave a comment on that blog (or this one). 

 The library has the TraceEvent programmers guide that comes with it that tells you about the architecture of the overall package and other useful background information. (note that the previous link is a copy of this guide, the most up to date version is the one that comes with the Nuget package). 

The TraceEvent library for thosewho do not know is the library that makes PerfView possible.   The TraceEvent library makes controlling and parsing Event Tracing for Windows (ETW) logging easy to do from managed code.   For a while now we had the TraceEvent bcl.codeplex.com site, which also has a version of the code, but NuGet is significantly easier to use and we are transitioning the library there.    The code in the NuGet package is significantly newer then the codeplex site (that site is currently 9 months old), so it recommend that you go there.   The NuGet package has some breaking changes, however in the release notes you will find porting instructions.   To give you a feel, it took about 2 hours to port PerfView over, and it is probably the heaviest user of the library. 

The TraceEvent Samples are also a nice addition.   It makes it very easy to see some examples usage that you can cut and paste to get started.   The easiest way to use this samples is to create a new Console application and then install the Samples NuGet package into that project.  

As previously discussed on this blog, there is a companion library EventSource Library Nuget Package and the EventSource Library Samples Nuget Package.    EventSource as you now is the class that allows your .NET code to easily EMIT logging messages to ETW (or other places).    EventSource is part of the .NET V4.5 and you should use the framework version if you can.   However we have added features to the NuGet package that are not available (yet) in the .NET Framework Version.   Another valuable aspect of the EventSource Nuget package is that it gives you COMPILE TIME feedback if you make errors creating your EventSource.   This can avoid some frustration.   The samples package is great for learning about the API, whether you use the Framework or Nuget version.   See this blog entry for more.

 

Vance

P.S: Finally I should note that while you are more than welcome to build stuff with TraceEvent, if the functionality you want is closer to what PerfView already gives, you should consider simply writing a PerfView extension/ user command.   For more on this simply see the docs under help -> Extending PerfView.

_TraceEventProgrammersGuide.docx

Comments

• Anonymous
  August 27, 2013
  Is there any way Perfview.exe could be made to run on a system that only has .NET 3.5 installed? The most recent version seems to require .NET 4.0. Thanks

• Anonymous
  August 27, 2013
  PerfView does have a V4.0 dependency because of its GUI which is WPF based.    IF you just need collection capabilities you can do that with WPA or XPerf and then view the file on another machine.  

• Anonymous
  August 28, 2013
  Thanks. Will XPerf collect CPU Stacks like Perfview can? I'm trying to find code hotspots in w3wp.exe hosted code, Perview works wonderfully if I have .NET 4.0, but there are occasions where I cannot install .NET 4.0.

• Anonymous
  August 28, 2013
  You should collect using WPR instead of XPERF (see my blog on this) it will collect CPU samples by default and PerfView can read these.

• Anonymous
  November 28, 2013
  Any chance you could post the TraceParserGen tool too? Or if it still isn't ready for general consumption, I'd be happy to receive it at cameron.taggart@gmail.com. I want to create write and read a custom event type. What is the easiest way to do that? EventSource.WriteEventCore + whatever TraceParserGen creates?

• Anonymous
  December 02, 2013
  The comment has been removed

• Anonymous
  December 27, 2014
  Hi Vance, Is the TraceParserGen tool on your skydrive still the latest version?

• Anonymous
  December 27, 2014
  Error from TraceParserGen when extracting from "Microsoft.Windows.ApplicationServer.Applications" (WCF) I tried the following: TraceParserGen.exe c:WindowsMicrosoft.NETFramework64v4.0.30319Microsoft.Windows.ApplicationServer.Applications.45.man I got error the following error:Error c:WindowsMicrosoft.NETFramework64v4.0.30319Microsoft.Windows.ApplicationServer.Applications.45.man(785): Undefined Id Allocate I also tried several other approaches like TraceParserGen /EventSource Microsoft.Windows.ApplicationServer.Applications.dll But that resulted in "Error: Required positional parameter ManifestFile not present" Any help much appreciated.  

• Anonymous
  February 05, 2015
  Is the TraceParserGen source code available anywhere? I'd like to decorate the generated types with DataContract and DataMember attributes automatically.

• Anonymous
  February 05, 2015
  There is a copy of TraceParserGen (binary and complete source code) on my OneDrive at  http://1drv.ms/1BGLMDT.   Note that that code is as is.    

• Anonymous
  February 05, 2015
  Thank you--I failed to noticed what was right in front of me.

• Anonymous
  July 06, 2015
  Hello, Vance! Thank for TraceParserGen!!! Do you plan to publish TraceParserGen on some Source Code hosting? And provide it with TraceEvent Library (for example in nuget package)?

• Anonymous
  July 07, 2015
  My goal (assuming other priorities don't interfere), is to publish TraceEvent on GitHub before the end of summer along with PerfView.   TraceParserGen is a lower priority, but it should be easy, so I will add that to the list as well.

• Anonymous
  July 19, 2015
  Thank you for your answer. We explore the possibility of migration logging system to ETW. And one of the main points of such a solution-the ability to consistently analyze not only ours, but also system logs. However, the fact that there is no complete "official" tool chain for this task stops us.

• Anonymous
  July 20, 2015
  @Mihail   It is not clear what 'system logs' you are talking about.   What would a 'official tool chain' look like for you?    If it is just a mater of being able to decode existing ETW events, then I would say that your destiny CAN be in your hands (there is enough support out there).  If you need more information than current ETW events let you get at, then that is harder (at the least you need an updated OS, which is typically problematic in the short term).

• Anonymous
  March 05, 2016
  TraceParserGen sounds really great!! I tried to use to it to create a parser for Microsoft-Windows-Winlogon but got an error: "Reading manifest file C:tempMicrosoft-Windows-Winlogon.manifest.xml Error: Error C:tempMicrosoft-Windows-Winlogon.manifest.xml(137): Undefined Id NotificationPended" Is there possible a more updated version you can share? P.S. I created the manifest using "PerfView /nogui userCommand DumpRegisteredManifest Microsoft-Windows-Winlogon"

• Anonymous
  March 07, 2016
  The code on http://1drv.ms/1NHA1HB is the most recent.   Not also that the source code for the TraceParserGen utility is also on that share.  It is really not a complex program, as it reads in XML and spits out C# code that mimics it.   However typically if you have problems with a particular manifest, you can fix it simply by 'fixing' the XML input (often you don't care about the offending event so you can simply delete it).   Indeed the reason why TraceParserGen has this kudgy support (a spot on my one-drive), is because there are a lot of 'bad' manifests out there that are not regular enough to 'just work'.   Finally I note that you also have the option of using the DynamicTraceEventParser (which now handles all registered providers as well).   Of course you don't get compile time support that way, and it is less efficient, but that may not matter for your scenario.

  • Anonymous
    April 26, 2016
    Are there any instructions or examples on how to use the generated cs file from the TraceParserGen (the TraceEventProgrammersGuide.docx has a todo for this example :) ) ? I have a manifest file, and I'm trying to enable real-time events from the provider included in the manifest, but I'm not sure how. Tried "session.enableProvider("providerName") but this doesn't seem to work.

• Anonymous
  August 15, 2016
  Is there any particular reason why the session clock resolution is hardcoded to 1? Many scenarios do need system clock for realtime session when time synchronization is a concern.