Is it possible to use WPA to analyze .etl files containing custom events created using System.Diagnostics.Tracing.EventSource (.Net 4.5)?

Thanks

• Edited by Nik Z Wednesday, December 19, 2012 12:24 PM

I would like to know this as well!

I have done it with .NET 4.0. It does work when the manifest file for the events can be found by WPA.exe. I have seen some methods on TraceEventSource as well which seem to spit out a manifest file. You need to install it with wevtutil -im youManifestFile to be able to decode the events with xperf or WPA. It could be that .NET 4.5 already registered a geric manifest. You can try it out without this step and see how it does turn out.

Currently there seems to be a limitation of WPA that it cannot decode custom events when you did only start a user mode collector. You can view your traces with xperf but not with WPA. But if you start a kernel session with at least PROC_THREAD enabled and your own trace provider you can view them in WPA as well. They will show up as Custom Events for wich you can filter.

Unfortunatley WPA does not support content based filtering which would be for custom traces a big plus. There is a nice GUI available from SvcPerf which allows also to view your traces and you can filter there also content based.

It is also nice to know that you can set marks with xperf -m MarkText to get a nice overview of relevant time points in your etl file.

Yours,

  Alois Kraus

Just to let folks finding this post later know...

- System.Diagnostics.Tracing.EventSource in .NET 4.5 supports only in-line manifests (iow, you never see the manifest)

- Microsoft.Diagnostics.Tracing.EventSource is now available via NuGet (v 1.0) and has support for manifest creation so you don't have to create that yourself. See the UsersGuide that appears in the project where you install the package. The tools work with .NET 4.5 version of EventSource as well, in which case, install in a dummy project and read UG.

- WPA that is part of the Windows 8.1 ADK supports in-line manifests (and is very, very sweet). You can use this on machines with Win 8 or Win 8.1 installed, and you can evaluate a trace created on other machines with a few caveats (rolling buffers that don't understand in-line events can discard them, PerfView, at least the newest, do a rundown that solves this problem).

@Kathleen: WPA from the Windows 8.1 SDK does install and run fine on non Windows 8 machines. I use it on Windows 7 machines without any issues.

You can use in-line manifests with .NET 4.0 and Windows 7 if you use the nuget package. The main issue with managed code and Windows 7 x64 is that the call stacks stop at the first dynamically generated stack frame. You can workaround this by NGenning the assemblies to get call stacks under x64 or you switch to Windows 8.