The Trace Windows ETL File Format?

I have a written ETW provider that my system uses to register opaque blobs of binary data using the TraceEvent API function. My system is essentially a high throughput event handling system, and I want to be able (cheaply) to capture the serialized state of certain objects as they go through the system. This will give me replayability so that at any point in the future I can replay the event trace and reproduce the exact sequence of events that led to a particular state in the application.

It's still in its early stages, so at the moment my only control over tracing is with one of the tools like logman or tracelog, which can create trace controllers to log events to a trace file using the .etl extension. I know I can write a standalone controller that could use real-time events and record events for a file, but I want to try and avoid that at this point (call it lazy :)), but seriously, why rewrite what's already available?

So, does anyone have any idea about the binary format of .etl files? I know something like tracedmp can read them and create CSVs, but that doesn't help with the binary part. If I could read these files and parse the blobs I wrote, then I would essentially be able to replay, but I can't find anything in this format.

Thanks Paul

+2


source to share


1 answer


Okay, 15 minutes to answer my own question. There should be some kind of record, but I swear I wasted half a day on this ... :)



The functions OpenTrace / ProcessTrace / CloseTrace

allow you to take events from either a live trace session or an ETL log file, which seems to be exactly what I was looking for.

+7


source







All Articles