Overview

This is an library that greatly simplifies reading Event Tracing for Windows (ETW) events. ETW is the power behind the Windows Performance Analyzer (also known as the XPerf Tool). The Windows OS has events for just about anything that you could be interested in from a performance standpoint (CPU usage, Context switched Disk I/O DLL Loads, Blocking, all with stack traces). In addition the .NET Runtime has events for garbage collection, Just In time Compilation, Assembly loading and more. It is very powerful. See TraceEvent documentation for more information on downloading this code.

Classes for Collecting Events

Classes for Analyzing Events

The library contains two sets of API. A low-level APIs for parsing a raw event stream that simply knows how to parse the raw events. Built on top of this is a higher level API that with more structure, including Processes, Threads, LoadedModules, and symbolic information. It is more efficient to use the low level APIs, so that is appropriate for simple, targeted tools, however more powerful profilding tools will want to use the high level API.

Low-level APIs:


ETW supports a very extensible system of adding new events (3rd parties such as yourself can add new events). Only the providers know the layout of the data they send in the events, so there needs to be a mechansim for describing the schema of the eventss to code that wishes to consume the events. The ETW infrastructure encodes this scheme information as an XML MANIFEST. Using a tool (Not yet up on CodePlex but soon) you use such a manifest to generate C# code that knows how to parse the binary events. The result is TraceEventParser. A TraceEventParser contains all the 'per Provider' information that is contained in the manifest. The TraceEvent.dll comes with two (VERY USEFUL) parsers

High-level APIs:


The high level API often deals with either additional information (eg information gathered from symbol (PDB) files), or dervied information (eg links between threads and the process that created them). This information is not in the ETL file, and is expensive to generate. Because of this a new file format (ETLX), was create that can contain all the information that was originally in the ETL file, as well as this additional information. The TraceLog class is effectively the programatic interface to the ETLX file format.

TraceLog is the entry point for a true object model for event data that are cross linked to each other as well as the raw events. Here are some of the players:

The result is a richly interconnected model of performance data.