ETW how to survive a reboot

Using the C ++ / Win32 API, I am creating an event trace session. My application needs to support NT5, so I cannot use the newer APIs.

I am using circular mode flags and real time flags.

I have everything running apart from one snag, when I restart my computer, the ETW session is not saved, my service starts and recreates the ETW session (as the restart killed it), which then causes the log file to be overwritten ...

According to MSDN I have to use "global" logger on NT5, of which there can be only one, or "AutoLogger" on NT6, of which there can be many. However MSDN says:

http://msdn.microsoft.com/en-us/library/windows/desktop/aa363687(v=vs.85).aspx

AutoLogger sessions increase system boot time and should be used sparingly. Services that want to capture information during the boot process should consider adding controller logic to themselves instead of using an AutoLogger session.

It looks like what I am trying to do. Indeed, my service does contain "controller" logic.

So how do I get ETW to save the trace session for the next reboot? Or alternatively, how do I recreate my ETW session on the next reboot, without overwriting the ETW file if it already exists?

+3


source to share





All Articles