我对如何为现有系统的ETW提供程序创建一个EventListener
感到困惑。 EnableEvents
方法期望传入一个EventSource
实例。我需要手动创建吗?是否有一种方法可以生成该EventSource
类?
我可以通过以下任一方式找到提供程序的详细信息:
logman query providers Microsoft-Windows-WinHttp
wevtutil get-publisher Microsoft-Windows-WinHttp
我甚至可以使用以下代码生成
instrumentationManifest
xml 文件:
.\PerfView.exe /nogui userCommand DumpRegisteredManifest Microsoft-Windows-WinHttp
open System.Diagnostics.Tracing
let printfn format = Printf.ksprintf System.Diagnostics.Debug.WriteLine format
[<EventSource(Name="Microsoft-Windows-NDIS-PacketCapture", Guid="2ed6006e-4729-4609-b423-3ee7bcd678ef")>]
type NdisPacketCaptureEventSource() =
inherit EventSource()
let Ethernet = LanguagePrimitives.EnumOfValue<int64, EventKeywords>(0x1L)
let WirelessWAN = LanguagePrimitives.EnumOfValue<int64, EventKeywords>(0x200L)
let Api = LanguagePrimitives.EnumOfValue<int64, EventKeywords>(0x1L)
let Send = LanguagePrimitives.EnumOfValue<int64, EventKeywords>(0x100000000L)
[<EventSource(Name="Microsoft-Windows-WinHttp", Guid="7d44233d-3055-4b9c-ba64-0d47ca40a232")>]
type WinHttpEventSource() =
inherit EventSource()
type MyEventListener() =
inherit EventListener()
override x.OnEventSourceCreated source =
printfn "OnEventSourceCreated %A" source
base.OnEventSourceCreated source
override x.OnEventWritten args =
printfn "OnEventWritten %A" args
base.OnEventWritten args
[<EntryPoint>]
let main argv =
use listener = new MyEventListener()
// use ndis = new NdisPacketCaptureEventSource()
// printfn "Name: %s, Guid: %A" ndis.Name ndis.Guid
// listener.EnableEvents(ndis, EventLevel.Verbose, EventKeywords.All)
// listener.EnableEvents(ndis, EventLevel.Verbose, Ethernet)
// listener.EnableEvents(ndis, EventLevel.Verbose, WirelessWAN)
use winHttp = new WinHttpEventSource()
// listener.EnableEvents(winHttp, EventLevel.Verbose, EventKeywords.All)
listener.EnableEvents(winHttp, EventLevel.Verbose, Send)
// for i in 0 .. 5 do
// System.Console.ReadKey() |> ignore
while true do
System.Threading.Thread.Sleep 100
0
我一直无法触发OnEventWritten
,不知道原因。有什么想法吗?
2015年12月2日更新
我已经能够使用SemanticLogging记录EventSource
事件。 这里有详细信息。它使用Microsoft.Diagnostics.Tracing.TraceEvent,似乎是可能的解决方案。