This project has moved and is read-only. For the latest updates, please go here.

DynamicTraceEventParser example?

May 28, 2011 at 6:52 PM

Stubbled upon this library and am loving it!  I find it easy and straightfoward to consume kernel events as all of the event handlers for each event type are built-in.  But what about non-kernel Microsoft events (like: Microsoft-Windows-HttpEvent)?  I assume i'd need to use the DynamicTraceEventParser in this case (assuming the manifest is in the channel), but it's not clear how.  Does anyone know of any documentation on this or example code I could look at?

May 31, 2011 at 5:35 PM

The bad news  is that the current version TraceEventParser does not support the scenario you want.  

The good news is that the next version of TraceEventParser does support what you want (it is a subclass of DynamicTraceEventParser that will parse any event that was registered on the machine (whicn include all the OS ones).    This code already exists internally, so it is just a matter of our release schedule.     

Exactly when the next version will come out it still to be determined.     Certainly sometime before the V4.5 version of the runtime ships, but more likely well before that.  

Along with that, we may publish a tool that generates a TraceEventParser from a ETW manifest (thus you can create strongly typed C# for Microsoft-Windows-HttpEvent, just like the Kernel and CLR events).  

In the mean time you can often muddle along with 'by hand' parsing of the few critical events you want to parse (using the 'Opcode' ProviderGuid and TraceEvent.EventData() operations).   This is painful, so only do this if you really are stuck.   


Sep 27, 2011 at 5:50 PM

Any update on the new version of TraceEventParser?  Did it make it into the developer preview of .NET 4.5 that was released at Build?

We eagerly await.  Thanks!

Sep 28, 2011 at 8:02 PM

No real change in status.    The likely ETA is the end of the calendar year, (so 3 months), but that is not a promise.  

Feb 3, 2012 at 12:52 AM

Any new estimate on possible release date?  thanks!

Feb 3, 2012 at 5:43 PM

We have missed the end of the year release estimate.   It really is about having this work item bubble close enough to the top of the priority list to devote a couple days to it.   I thought that would happen in the 'lull' at the end of the year.    We do want to get this updated before release, so the next most logical time for this to get done is in the lull that happens after lockdown (that is probably this summer).   Now I would like to believe I could get to it before then, but my estimates have been pretty poor to date, so I am hesitant to make another one.  

As it turns out, we did release PerfView (see or simply type 'PerfView in a bing search), and this tool uses TraceEvent.dll (it gets unpacked under AppData\Roaming\Perfview.   This DLL is very simmiliar to the one that I will be publishing, and in particular has the suppor you are looking for.    This could tide you over until TraceEvent is updated here.   PerfView is also useful if only when you are simply 'browsing' what ETW events have in their payloads. 

May 19, 2012 at 11:04 PM

I would also like to see this next release. Will we also get the manifest -> parser generator since we've had to wait so long? :0

May 21, 2012 at 4:00 PM

Sometime this summer is still the best ETA for the next release.  

I may relase the parser generator tool as a blog posting (it is really just a utility that takes XML and spits out C#).  Note that that tool has many more 'corner cases' where it may not 'just work', which is part of the reason I only will be releasing it 'as is'.