Skip to main content
467 questions
Newest Active Bountied Unanswered
Filter by
Sorted by
Tagged with
-1 votes
0 answers
97 views

I am using Event Tracing for Windows to monitor disk io and network usage of processes. I have used ETW with KERNEL_LOGGER_NAME , EVENT_TRACE_FLAG_PROCESS , EVENT_TRACE_FLAG_DISK_IO, ...
K A's user avatar
  • 9
3 votes
0 answers
165 views

This CPU Usage (Precise) view below seems to indicate that this thread's quantum is expiring after only 0.012 milliseconds on row 19. Rows 6 and 29 look normal with a 15 millisecond thread quantum ...
Marc Sherman's user avatar
  • 2,413
0 votes
0 answers
58 views

I would like to collect events with the keyword Winevent_Keyword_Process (0x10). My system is Windows Server 2016, and the available providers are shown in the screenshot below: Then, I used logman ...
陳昇昇's user avatar
  • 35
0 votes
0 answers
43 views

I am using the following code to set the DACL on my ETW session object using EventAccessControl, to only allow processes under SYSTEM to be able to access the session object: // Initialize the ...
OneAndOnly's user avatar
  • 1,066
2 votes
0 answers
113 views

I have a question regarding ETW (Event Tracing for Windows) programming. My goal is simple: I want to use ETW base program to record every user-launched program on Windows. I have already implemented ...
Tyler's user avatar
  • 111
0 votes
0 answers
79 views

I want to create a custom event channel to which an executable running as a limited user and a kernel mode driver both are able to write to it. How can I do this? Following are the things I tried but ...
Ankit's user avatar
  • 71
1 vote
1 answer
121 views

I'm executing PowerShell scripts from within a C# application using the System.Management.Automation library. My goal is to capture script actions through ETW events from the Microsoft-Windows-...
Lifka's user avatar
  • 279
0 votes
0 answers
52 views

ETW Provider Microsoft-Windows-TCPIP provides various events like: TcpShutdownTcb = 1044, TcpDataTransferReceive = 1074, TcpDataTransferSend = 1332, TcpDataTransferRetransmitRound = ...
KRR's user avatar
  • 43
1 vote
0 answers
135 views

It's easy to capture call stacks with ETW for managed code that throws exception, the CLR provides all. But what can I do for native code that behaves badly? Let's assume I have a large application ...
Achim's user avatar
  • 790
0 votes
0 answers
72 views

I created a trace on my Windows 10 laptop using this logman command: logman create trace "Microsoft-Windows-Kernel-File" -p Microsoft-Windows-Kernel-File 0x1800 -o "C:\Logs\Microsoft-...
nmd19's user avatar
  • 11
1 vote
0 answers
126 views

I want to monitor when some process reads a specific file When I use procmon to monitor the said file I can see that it gets queried and read a lot Now I want to monitor a specific file and act once ...
boop's user avatar
  • 7,922
0 votes
1 answer
106 views

I have an ETL file (e.g. sample.etl) to parse using the Native WinAPI. Using cpp I am able to parse and process an existing windows etl log. Now, I'm trying to use python to call into the same windows ...
hkder's user avatar
  • 3
1 vote
0 answers
45 views

I am conducting a research project and have encountered an issue with an older version of Mono (a modified version used in Unity, around 2015-2016, exact version unknown). When using a profiling tool ...
丁凌烁's user avatar
  • 11
0 votes
0 answers
182 views

Working on creating a tool to log kernel events to get better understanding of ETW. I used the below MS sample to create a kernel logger session and added the opentrace/processtrace/closetrace apis in ...
devstability's user avatar
  • 71
0 votes
1 answer
204 views

Error: Unable to Start ETW Trace Session in C++ (Error Code 87) I'm developing a C++ application to consume and print real-time events using Event Tracing for Windows (ETW). However, I'm encountering ...
90_Priyanshu kumar Singh's user avatar
  • 1
0 votes
0 answers
125 views

Need to find amount of incoming outgoing network bytes using cmd/powershell command for specific application. So I researched and found that there isn't any direct way to filter this data using netsat/...
Vedang Agarwal's user avatar
  • 1
0 votes
1 answer
132 views

I am trying to forward some kernel-level events from my Splunk UF to my Splunk receiver. I experienced with windows' built in utility - logman and was able to produce etl files and convert them to XML ...
Aka's user avatar
  • 1
0 votes
1 answer
137 views

I am using C# with the .NET 6.0 framework in Windows 10 and trying to use the NuGet Microsoft.O365.Security.Native.ETW package, corresponding to the Microsoft Krabsetw library, which allows the use of ...
Lifka's user avatar
  • 279
0 votes
0 answers
55 views

I've created an application in .Net Framework 4.6.2 which logs to the event log by extending the EventSource class (https://learn.microsoft.com/en-us/dotnet/api/system.diagnostics.tracing.eventsource?...
Leo D'Arcy's user avatar
  • 1
1 vote
1 answer
346 views

I'm trying to use Brendan Gregg's flamegraph, and I'm trying to fold/collapse my stacks with the stack trace/diagsession I got from application insight/azure profiler, but I can't get it to generate ...
itsme017's user avatar
  • 87
0 votes
1 answer
178 views

We have a system where some malicious code sends out arbitrary beeps, probably by calling the Beep() function in the Win32 API I need to find out which executable does this, and want to use ETW for ...
Achim's user avatar
  • 790
1 vote
1 answer
280 views

I'm new to profiling and stack traces. I'm trying to use a stack trace and downloaded it from application insights profiler;however many of the stack names, functions, and so forth don't have a name. ...
itsme017's user avatar
  • 87
0 votes
1 answer
683 views

I am new to performance in general and have been learning Perfview. I was curious how to go about using PerfView to test the performance of my APIs hosted on ASP.NET Core Web APIs? I was wondering if ...
itsme017's user avatar
  • 87
0 votes
1 answer
159 views

For context, I have API's that are hosted/monitored on Azure and have the profiler enabled. I was wondering if it was possible to get a DIAGSESSION/ETW/ETL file from application insights profiler and ...
itsme017's user avatar
  • 87
2 votes
1 answer
344 views

Assume we want to capture IPv4 and IPv6 packets and do deep packet scans on them. I came to notice that it is also possible to capture packets using the Microsoft-Windows-NDIS-PacketCapture ETW ...
OneAndOnly's user avatar
  • 1,066
0 votes
0 answers
1k views

I'm following the suggestions in this question to allow filtering packets by process ID in a Windows 10 system. @OneAndOnly recently suggested WinShark, which has a github page here. It describes the ...
tim11g's user avatar
  • 2,033
0 votes
0 answers
126 views

I have an app that attempts to establish an EventPipe session with some .NET Core processes in order to get an access to their Event Counters. The code uses Microsoft.Diagnostics.NETCore.Client: ...
LA.27's user avatar
  • 2,290
0 votes
0 answers
111 views

I am following the "hello world" style example for the ETW API provided in https://kallanreed.com/2016/05/28/creating-an-etw-provider-step-by-step/ When I use the "mc.exe" to ...
Toby Price's user avatar
  • 1
1 vote
0 answers
190 views

I am trying to create a REAL TIME ETW consumer in VC++ . My objective is to get the file names which are accessed. I am using the GUID. Microsoft-Windows-Kernel-File {EDD08927-9CC4-4E65-...
user846940's user avatar
  • 39
0 votes
0 answers
228 views

Lately I've been tracing Win32 Window Messages using ETW (logman, xperf, WPA, et cetera) which is relatively straightforward because the Microsoft-Windows-Win32k provider exports ETW events for ...
Dai's user avatar
  • 158k
0 votes
2 answers
497 views

I have a workload similar to the following: while True: data = get_data_from_network(); filename = sha1(data); write_to_file(filename, data, data.size()); Occasionally I read back from ...
Zachary Turner's user avatar
  • 792
2 votes
0 answers
215 views

I see there are go packages for collecting ETW logs. But seems no package to write ETW logs. Especially no package using TraceLoggingWrite APIs to implement. Anyone is aware of packages or easy way to ...
Shusheng Li's user avatar
  • 21
2 votes
1 answer
85 views

I have an ETW provider, but the Visual Studio debug CRT is reporting memory leaks in it. The calls to register an event create a wchar_t* on the heap: auto msg = convertToWchar(string); // calls ...
the_mandrill's user avatar
  • 31.1k
0 votes
0 answers
79 views

Need your help to understand how can we log ETW events to track Task started & Task completed inside parallel.foreach. I basically need to see when event got fired. I have gone through few ...
Sks's user avatar
  • 610
1 vote
0 answers
89 views

I was trying to create a listener for camera events (turn on, turn off). I found out whenever I turn my camera on/off, ArcSoftEventProvider reports certain events in Windows Event Viewer in my laptop (...
Jason's user avatar
  • 13
1 vote
1 answer
3k views

I'm recently using ETW to collect events from builtin providers. I use logman to consume events and save them to a .etl file, like this: logman create trace evt -p Microsoft-Windows-RPC -ets ...After ...
1c3's user avatar
  • 11
1 vote
1 answer
653 views

I am working on a HoloLens 2 application using Unity which includes some features (mainly UDP connection to other device) that requires the application to be deployed to the HoloLens for most test ...
Finrod_Amandil's user avatar
  • 119
1 vote
0 answers
58 views

I have a simple usage of ETW. I've subscribed to receive events from USB4 provider. I have 2 sessions: A real time session which I use to print to the console log Second for log the events to a log ...
R.P's user avatar
  • 195
0 votes
1 answer
114 views

I want to export stack trace data from an ETL file (Event Tracing for Windows) into a more readable format. CPU profiling data is only useful with method names, but when on the recording machine no ...
Alois Kraus's user avatar
  • 13.6k
-1 votes
1 answer
802 views

I need some guidance in how to troubleshoot a low level issue I am facing with some USB devices. Background: I have a .NET Windows Service that, scans connected USB devices via WMI queries + reads low ...
Veverke's user avatar
  • 11.6k
0 votes
0 answers
110 views

Is it possible to monitor calls to specific DLL functions in ETW? I am still new to ETW, so is there any good site or procedure that might be helpful to me? It would be great to be able to run it from ...
tea's user avatar
  • 1
5 votes
0 answers
5k views

I have two code-identical .NET 6 applications running on two separate App Services under two separate App Service Plans on Azure. The first one I deployed a few months back and seems to be running ...
Daniel Attfield's user avatar
  • 2,062
1 vote
1 answer
1k views

I want to subscribe my script to ETW to Microsoft-Windows-Kernel-Process => Process Start event. But I can't find any way to get the Command line parameters and working directory how my process has ...
jrpz's user avatar
  • 93
0 votes
1 answer
576 views

I have been trying to use ETW for always on profiling within my app, by using the circular buffer tracing mode. Specifically CPU profiler events for the entire system, using the kernel mode event ...
jossgray's user avatar
  • 511
1 vote
0 answers
129 views

I am using ETW (Event Tracing for Windows) to track certain network events such as: TCP connection accepted TCP data sent TCP data received, etc. If you are not familiar with ETW, that is OK, my ...
aampere's user avatar
  • 280
4 votes
0 answers
202 views

I'm trying to get socket connections data for analysis from the Microsoft-Windows-Winsock-AFD publisher on both Windows host machine and docker container. But it seems like that these events are ...
Tan-Linh Ha's user avatar
  • 41
0 votes
1 answer
251 views

I'm trying to use functions from the Microsoft TDH library building with Visual Studio 2019. The project is using WindowsApplicationForDrivers10.0 Platform Toolset and the program is very simple: #...
Uriel's user avatar
  • 669
2 votes
0 answers
249 views

I am using ETW to get some Microsoft pre-defined events. I set the EVENT_TRACE_PROPERTIE as follow: TraceProperties->LogFileMode = EVENT_TRACE_REAL_TIME_MODE; TraceProperties->MaximumFileSize = ...
Q_7iu's user avatar
  • 21
2 votes
0 answers
65 views

Currently, I'm using EventSourceAttribute to create a hierarchy of subfolders in Application and Services log in Event Viewer. This is my code [EventSource(Name = "Service-MacClient-EventSource&...
John Evans Solachuk's user avatar
  • 2,105
0 votes
1 answer
135 views

I am trying to programatically get the list of device drives from an ETW with the great TraceProcessing Library which is used by WPA. using ITraceProcessor processor = TraceProcessor.Create(...
Alois Kraus's user avatar
  • 13.6k

1
2 3 4 5
…
10