From 97cf5197cf5b882b2c689d8dc2b555f2edf8f418 Mon Sep 17 00:00:00 2001 From: Dave Wilson Date: Tue, 17 Mar 2015 19:50:07 -0700 Subject: Initial publish --- general/tracing/SystemTraceControl/ReadMe.md | 11 + general/tracing/SystemTraceControl/ReadMe.txt | 36 ++++ .../SystemTraceControl/SystemTraceControl.cpp | 221 +++++++++++++++++++++ .../SystemTraceControl/SystemTraceControl.sln | 28 +++ .../SystemTraceControl/SystemTraceControl.vcxproj | 179 +++++++++++++++++ .../SystemTraceControl.vcxproj.Filters | 22 ++ 6 files changed, 497 insertions(+) create mode 100644 general/tracing/SystemTraceControl/ReadMe.md create mode 100644 general/tracing/SystemTraceControl/ReadMe.txt create mode 100644 general/tracing/SystemTraceControl/SystemTraceControl.cpp create mode 100644 general/tracing/SystemTraceControl/SystemTraceControl.sln create mode 100644 general/tracing/SystemTraceControl/SystemTraceControl.vcxproj create mode 100644 general/tracing/SystemTraceControl/SystemTraceControl.vcxproj.Filters (limited to 'general/tracing/SystemTraceControl') diff --git a/general/tracing/SystemTraceControl/ReadMe.md b/general/tracing/SystemTraceControl/ReadMe.md new file mode 100644 index 00000000..f581e52e --- /dev/null +++ b/general/tracing/SystemTraceControl/ReadMe.md @@ -0,0 +1,11 @@ +SystemTraceProvider +=================== + +This sample application demonstrates how to use event tracing control APIs to collect events from the system trace provider. + +The sample code provided shows how to start an [Event Tracing](http://msdn.microsoft.com/en-us/library/windows/hardware/bb968803) for Windows trace session and how to enable system events with stacks. When you build and run the application, it collects the trace data for 30 seconds and then stops. The sample application writes the results to a file, Systemtrace.etl. For more information, see [Tools for Software Tracing](http://msdn.microsoft.com/en-us/library/windows/hardware/ff552961). + +You can process the Systemtrace.etl file using Tracerpt.exe. Tracerpt.exe is a command-line trace tool that formats trace events. It also analyzes the events and generates summary reports. Tracerpt is included in Windows XP and later versions of Windows. For more information about how to use this tool, see [Tracerpt](http://go.microsoft.com/fwlink/p/?linkid=179389) topic on the TechNet website. + +You can also process the file using the [Windows Performance Toolkit](http://go.microsoft.com/fwlink/p/?linkid=250774) (WPT), which is available in the SDK. + diff --git a/general/tracing/SystemTraceControl/ReadMe.txt b/general/tracing/SystemTraceControl/ReadMe.txt new file mode 100644 index 00000000..54609bd7 --- /dev/null +++ b/general/tracing/SystemTraceControl/ReadMe.txt @@ -0,0 +1,36 @@ +EventTracing SystemTraceProvider control sample +==================================================================================== +This sample demonstrates how to use event tracing control API's to collect events +from system trace provider. The code provided will start an ETW system trace and +enable system events with stacks. After collecting the data for 30 seconds trace +will be stopped. Resulting file (systemtrace.etl) can be processed with +inbox tracerpt.exe, programmatically (OpenTrace/ProcessTrace/CloseTrace) or using +WPT (Windows Performance Toolkit) available in the SDK. + +Sample Language Implementations +=============================== +C++ + +Files +================================================= +SystemTraceProvider.sln +SystemTraceProvider.vcxproj +SystemTraceProvider.cpp +sources +ReadMe.txt + +To build the sample using the command prompt: +============================================= + 1. Open the Command Prompt window and navigate to the directory. + 2. Type msbuild SystemTraceControl.sln. + +To build the sample using Visual Studio (preferred method): +================================================ + 1. Open File Explorer and navigate to the SystemTraceControl directory. + 2. Double-click the icon for the .sln (solution) file to open the file in Visual Studio. + 3. In the Build menu, select Build Solution. The application will be built in the default \Debug or \Release directory. + +To run the sample: +================= + 1. Navigate to the directory that contains the new executable, using the command prompt or File Explorer. + 2. Type SystemTraceControl.exe at the command line, or double-click the icon for SystemTraceControl.exe to launch it from File Explorer. \ No newline at end of file diff --git a/general/tracing/SystemTraceControl/SystemTraceControl.cpp b/general/tracing/SystemTraceControl/SystemTraceControl.cpp new file mode 100644 index 00000000..a8c55026 --- /dev/null +++ b/general/tracing/SystemTraceControl/SystemTraceControl.cpp @@ -0,0 +1,221 @@ +/*++ + +Copyright (c) Microsoft Corporation. All rights reserved. + + THIS CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY + KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE + IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A PARTICULAR + PURPOSE. + +Module Name: + + SystemTraceControl.cpp + +Abstract: + + This sample demonstrates how to collect events from SystemTraceProvider + on Windows 8. + +Environment: + + User mode only. + +--*/ + +#define INITGUID +#include +#include +#include +#include +#include + +#define MAXIMUM_SESSION_NAME 1024 + +// +// Guid definitions from "NT Kernel Logger Constants" section on MSDN. +// + +DEFINE_GUID ( /* 3d6fa8d0-fe05-11d0-9dda-00c04fd7ba7c */ + ProcessGuid, + 0x3d6fa8d0, + 0xfe05, + 0x11d0, + 0x9d, 0xda, 0x00, 0xc0, 0x4f, 0xd7, 0xba, 0x7c + ); + +DEFINE_GUID ( /* 2cb15d1d-5fc1-11d2-abe1-00a0c911f518 */ + ImageLoadGuid, + 0x2cb15d1d, + 0x5fc1, + 0x11d2, + 0xab, 0xe1, 0x00, 0xa0, 0xc9, 0x11, 0xf5, 0x18 + ); + +PEVENT_TRACE_PROPERTIES +AllocateTraceProperties ( + _In_opt_ PWSTR LoggerName, + _In_opt_ PWSTR LogFileName + ) +{ + PEVENT_TRACE_PROPERTIES TraceProperties = NULL; + ULONG BufferSize; + + BufferSize = sizeof(EVENT_TRACE_PROPERTIES) + + (MAXIMUM_SESSION_NAME + MAX_PATH) * sizeof(WCHAR); + + TraceProperties = (PEVENT_TRACE_PROPERTIES)malloc(BufferSize); + if (TraceProperties == NULL) { + wprintf(L"Unable to allocate %d bytes for properties structure.\n", BufferSize); + goto Exit; + } + + // + // Set the session properties. + // + + ZeroMemory(TraceProperties, BufferSize); + TraceProperties->Wnode.BufferSize = BufferSize; + TraceProperties->Wnode.Flags = WNODE_FLAG_TRACED_GUID; + TraceProperties->LoggerNameOffset = sizeof(EVENT_TRACE_PROPERTIES); + TraceProperties->LogFileNameOffset = sizeof(EVENT_TRACE_PROPERTIES) + + (MAXIMUM_SESSION_NAME * sizeof(WCHAR)); + + if (LoggerName != NULL) { + StringCchCopy((LPWSTR)((PCHAR)TraceProperties + TraceProperties->LoggerNameOffset), + MAXIMUM_SESSION_NAME, + LoggerName); + } + + if (LogFileName != NULL) { + StringCchCopy((LPWSTR)((PCHAR)TraceProperties + TraceProperties->LogFileNameOffset), + MAX_PATH, + LogFileName); + } + +Exit: + return TraceProperties; +} + +VOID +FreeTraceProperties ( + _In_ PEVENT_TRACE_PROPERTIES TraceProperties + ) +{ + free(TraceProperties); + return; +} + +int +__cdecl +wmain() +{ + CLASSIC_EVENT_ID EventId[2]; + ULONG Status = ERROR_SUCCESS; + TRACEHANDLE SessionHandle = 0; + PEVENT_TRACE_PROPERTIES TraceProperties; + ULONG SystemTraceFlags[8]; + PWSTR LoggerName = L"MyTrace"; + + HeapSetInformation(NULL, HeapEnableTerminationOnCorruption, NULL, 0); + + // + // Allocate EVENT_TRACE_PROPERTIES structure and perform some + // basic initialization. + // + // N.B. LoggerName will be populated during StartTrace call. + // + + TraceProperties = AllocateTraceProperties(NULL, L"SystemTrace.etl"); + if (TraceProperties == NULL) { + Status = ERROR_OUTOFMEMORY; + goto Exit; + } + + // + // Configure additinal trace settings. + // + + TraceProperties->LogFileMode = EVENT_TRACE_FILE_MODE_SEQUENTIAL | EVENT_TRACE_SYSTEM_LOGGER_MODE; + TraceProperties->Wnode.ClientContext = 1; // Use QueryPerformanceCounter for time stamps + TraceProperties->MaximumFileSize = 100; // Limit file size to 100MB max + TraceProperties->BufferSize = 512; // Use 512KB trace buffers + TraceProperties->MinimumBuffers = 64; + TraceProperties->MaximumBuffers = 128; + + // + // Start trace session which can receive events from SystemTraceProvider. + // + + Status = StartTrace(&SessionHandle, LoggerName, TraceProperties); + if (Status != ERROR_SUCCESS) { + wprintf(L"StartTrace() failed with %lu\n", Status); + goto Exit; + } + + // + // Configure stack walking. In this example stack traces will be collected on + // ImageLoad and ProcessCreate events. + // + // N.B. Stack tracing is configured before enabling event collection. + // + + ZeroMemory(EventId, sizeof(EventId)); + EventId[0].EventGuid = ImageLoadGuid; + EventId[0].Type = EVENT_TRACE_TYPE_LOAD; + EventId[1].EventGuid = ProcessGuid; + EventId[1].Type = EVENT_TRACE_TYPE_START; + + Status = TraceSetInformation(SessionHandle, + TraceStackTracingInfo, + EventId, + sizeof(EventId)); + + if (Status != ERROR_SUCCESS) { + wprintf(L"TraceSetInformation(StackTracing) failed with %lu\n", Status); + goto Exit; + } + + // + // Enable system events for Process, Thread and Loader groups. + // + + ZeroMemory(SystemTraceFlags, sizeof(SystemTraceFlags)); + SystemTraceFlags[0] = (EVENT_TRACE_FLAG_PROCESS | + EVENT_TRACE_FLAG_THREAD | + EVENT_TRACE_FLAG_IMAGE_LOAD); + + Status = TraceSetInformation(SessionHandle, + TraceSystemTraceEnableFlagsInfo, + SystemTraceFlags, + sizeof(SystemTraceFlags)); + + if (Status != ERROR_SUCCESS) { + wprintf(L"TraceSetInformation(EnableFlags) failed with %lu\n", Status); + goto Exit; + } + + // + // Collect trace for 30 seconds. + // + + Sleep(30 * 1000); + +Exit: + + // + // Stop tracing. + // + + if (SessionHandle != 0) { + Status = ControlTrace(SessionHandle, NULL, TraceProperties, EVENT_TRACE_CONTROL_STOP); + if (Status != ERROR_SUCCESS) { + wprintf(L"StopTrace() failed with %lu\n", Status); + } + } + + if (TraceProperties != NULL) { + FreeTraceProperties(TraceProperties); + } + + return Status; +} diff --git a/general/tracing/SystemTraceControl/SystemTraceControl.sln b/general/tracing/SystemTraceControl/SystemTraceControl.sln new file mode 100644 index 00000000..4e74108b --- /dev/null +++ b/general/tracing/SystemTraceControl/SystemTraceControl.sln @@ -0,0 +1,28 @@ + +Microsoft Visual Studio Solution File, Format Version 12.00 +# Visual Studio 2013 +VisualStudioVersion = 12.0 +MinimumVisualStudioVersion = 12.0 +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "SystemTraceControl", "SystemTraceControl.vcxproj", "{BBB08463-9C86-4690-B95B-106B49DD46E2}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|Win32 = Debug|Win32 + Release|Win32 = Release|Win32 + Debug|x64 = Debug|x64 + Release|x64 = Release|x64 + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {BBB08463-9C86-4690-B95B-106B49DD46E2}.Debug|Win32.ActiveCfg = Debug|Win32 + {BBB08463-9C86-4690-B95B-106B49DD46E2}.Debug|Win32.Build.0 = Debug|Win32 + {BBB08463-9C86-4690-B95B-106B49DD46E2}.Release|Win32.ActiveCfg = Release|Win32 + {BBB08463-9C86-4690-B95B-106B49DD46E2}.Release|Win32.Build.0 = Release|Win32 + {BBB08463-9C86-4690-B95B-106B49DD46E2}.Debug|x64.ActiveCfg = Debug|x64 + {BBB08463-9C86-4690-B95B-106B49DD46E2}.Debug|x64.Build.0 = Debug|x64 + {BBB08463-9C86-4690-B95B-106B49DD46E2}.Release|x64.ActiveCfg = Release|x64 + {BBB08463-9C86-4690-B95B-106B49DD46E2}.Release|x64.Build.0 = Release|x64 + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection +EndGlobal diff --git a/general/tracing/SystemTraceControl/SystemTraceControl.vcxproj b/general/tracing/SystemTraceControl/SystemTraceControl.vcxproj new file mode 100644 index 00000000..556e6d7d --- /dev/null +++ b/general/tracing/SystemTraceControl/SystemTraceControl.vcxproj @@ -0,0 +1,179 @@ + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + {BBB08463-9C86-4690-B95B-106B49DD46E2} + $(MSBuildProjectName) + Debug + Win32 + {E8A8798D-133D-48CA-B07A-E8D8A7C82C30} + + + + Windows10 + False + Desktop + + WindowsApplicationForDrivers10.0 + Application + + + Windows10 + True + Desktop + + WindowsApplicationForDrivers10.0 + Application + + + Windows10 + False + Desktop + + WindowsApplicationForDrivers10.0 + Application + + + Windows10 + True + Desktop + + WindowsApplicationForDrivers10.0 + Application + + + + $(IntDir) + + + + + + + + + + + + + + + + SystemTraceControl + + + SystemTraceControl + + + SystemTraceControl + + + SystemTraceControl + + + + %(PreprocessorDefinitions);UNICODE;_UNICODE + %(AdditionalIncludeDirectories);$(SDK_LIB_PATH) + true + Level4 + + + + + %(PreprocessorDefinitions);UNICODE;_UNICODE + %(AdditionalIncludeDirectories);$(SDK_LIB_PATH) + + + %(PreprocessorDefinitions);UNICODE;_UNICODE + %(AdditionalIncludeDirectories);$(SDK_LIB_PATH) + + + + + %(PreprocessorDefinitions);UNICODE;_UNICODE + %(AdditionalIncludeDirectories);$(SDK_LIB_PATH) + true + Level4 + + + + + %(PreprocessorDefinitions);UNICODE;_UNICODE + %(AdditionalIncludeDirectories);$(SDK_LIB_PATH) + + + %(PreprocessorDefinitions);UNICODE;_UNICODE + %(AdditionalIncludeDirectories);$(SDK_LIB_PATH) + + + + + %(PreprocessorDefinitions);UNICODE;_UNICODE + %(AdditionalIncludeDirectories);$(SDK_LIB_PATH) + true + Level4 + + + + + %(PreprocessorDefinitions);UNICODE;_UNICODE + %(AdditionalIncludeDirectories);$(SDK_LIB_PATH) + + + %(PreprocessorDefinitions);UNICODE;_UNICODE + %(AdditionalIncludeDirectories);$(SDK_LIB_PATH) + + + + + %(PreprocessorDefinitions);UNICODE;_UNICODE + %(AdditionalIncludeDirectories);$(SDK_LIB_PATH) + true + Level4 + + + + + %(PreprocessorDefinitions);UNICODE;_UNICODE + %(AdditionalIncludeDirectories);$(SDK_LIB_PATH) + + + %(PreprocessorDefinitions);UNICODE;_UNICODE + %(AdditionalIncludeDirectories);$(SDK_LIB_PATH) + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/general/tracing/SystemTraceControl/SystemTraceControl.vcxproj.Filters b/general/tracing/SystemTraceControl/SystemTraceControl.vcxproj.Filters new file mode 100644 index 00000000..bc043bf7 --- /dev/null +++ b/general/tracing/SystemTraceControl/SystemTraceControl.vcxproj.Filters @@ -0,0 +1,22 @@ + + + + + cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx;* + {C2A52F8F-D414-40D4-998E-62C57FFF543E} + + + h;hpp;hxx;hm;inl;inc;xsd + {CF32093A-DFB7-4C18-B086-1F1DB68AA8F4} + + + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms;man;xml + {C370B48B-D85C-4319-911D-CC6D213BB287} + + + + + Source Files + + + \ No newline at end of file -- cgit v1.3.1